Top all-time · #5625
jbp.io
Personal blog · jbp.io · on HN as ctzsecurityprogramming
jbp.io is a personal blog at jbp.io about security and programming. Since 2013, 14 different Hacker News readers have linked it 29 times, most often “TLS Performance: Rustls versus OpenSSL”. The last post was in 2018, but the archive is still widely read.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers cite jbp.io for benchmarks comparing rustls with OpenSSL and BoringSSL, and for the rustls security audit.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- TLS Performance: Rustls versus OpenSSL5 people · 5 mentions · first linked 2019-07-03
- OpenSSL bug exposed up to 255 bytes of client heap and existed since 20113 people · 3 mentions · first linked 2024-06-27
- /2015/06/11/cve-2015-1788-openssl-binpoly-hang/2 people · 2 mentions · first linked 2015-06-11
- Third-Party Audit of Rustls2 people · 2 mentions · first linked 2020-06-14
What Hacker News says?
There are fairly comprehensive measurements from 2019: https://jbp.io/2019/07/01/rustls-vs-openssl-performance.html I'm pretty sure current versions of rustls are faster than the ones from 2019, but I don't have an intuition for how OpenSSL performance has evolved in the past three years. I'd like to do another comparison some time soon. (Yes, the underlying ring crypto library should take advantages of specific ins…
Comment linking /2019/07/01/rustls-vs-openssl-performance.html
on “OpenSSL 3.0.7 fixes X.509 email address buffer overflows”Submitted OpenSSL bug exposed up to 255 bytes of client heap and existed since 2011 as a story · 149 points
HN discussionI've also submitted patches to OpenSSL and been entirely ignored[1]. The latest of which strictly improved testing, documentation and included a detailed study and write-up of actual bugs in OpenSSL and downstream code[2]. My conclusion was that the OpenSSL project is not interested in external contributions. [1]: https://www.mail-archive.com/openssl-dev@openssl.org/msg3362... [2]: http://jbp.io/2014/01/16/openssl-r…
Comment linking /2014/01/16/openssl-rand-api/
on “"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"”Submitted Third-Party Audit of Rustls as a story · 109 points
HN discussionhttp://jbp.io/2013/07/07/tls-downgrade/ An old writeup of mine on TLS downgrade, if anyone's interested.
Comment linking /2013/07/07/tls-downgrade/
on “This POODLE bites: exploiting the SSL 3.0 fallback”Submitted TLS Performance: Rustls versus OpenSSL as a story · 47 points
HN discussionAre you not aware of the recentish audit of rustls and, by extension, parts of ring ? https://jbp.io/2020/06/14/rustls-audit.html (I also don't think all of RustCrypto has been audited, only very limited parts AIUI.)
Comment linking /2020/06/14/rustls-audit.html
on “Mundane: Rust cryptography library that is difficult to misuse”Submitted TLS Performance: Rustls versus OpenSSL as a story · 16 points
HN discussionHacker News readers would probably do well to read the actual post: https://jbp.io/2019/07/01/rustls-vs-openssl-performance.html It also comes with four separate posts that dig into the details, figuring out why the discrepancy exists. Additionally, rustls is a tls library built on top of ring . ring is a project that is porting BoringSSL to Rust + assembly, bit by bit. BoringSSL was forked from OpenSSL. So there's…
Comment linking /2019/07/01/rustls-vs-openssl-performance.html
on “A Rust-based TLS library outperformed OpenSSL in almost every category”Submitted CVE-2024-5535: `SSL_select_next_proto` buffer overread as a story · 7 points
HN discussionI have the same experience ( http://jbp.io ). But I noticed that my DNS zone is quite different to how Github now tell you to do it (I have an A record to 204.232.175.78). So perhaps that is a factor.
Comment linking /
on “GitHub Pages with a custom root domain is slow”Submitted Analysis of the OpenSSL random API as a story · 7 points
HN discussionIt seems that RustCrypto performance is not competitive according to these benchmarks: https://jbp.io/graviola/
Comment linking /graviola/
on “Rustls Outperforms OpenSSL and BoringSSL”Submitted Using SGX to harden password hashing as a story · 6 points
HN discussionrustls recently received a third party security audit and seemed to do quite well, if you're looking for an alternative: http://jbp.io/2020/06/14/rustls-audit.html
Comment linking /2020/06/14/rustls-audit.html
on “GnuTLS audit: passive cleartext recovery attack”Submitted OpenSSL CVE-2024-5535: `SSL_select_next_proto` buffer overread as a story · 5 points
HN discussionhttps://jbp.io/2015/08/11/pbkdf2-performance-matters/ https://github.com/Ayrx/python-fastpbkdf2
Comment linking /2015/08/11/pbkdf2-performance-matters/
on “Enough with the Salts: Updates on Secure Password Schemes”Submitted How to monetise the IoT through energy markets as a story · 4 points
HN discussion> Good that OS X will update to a more recent version in El Capitan and also switch to LibreSSL (great step forward). Not sure if you're being sarcastic? "LibreSSL has the affected code and is thought to be vulnerable (untested)." - https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang...
Comment linking /2015/06/11/cve-2015-1788-openssl-binpoly-hang/
on “OpenSSL Security Advisory”Submitted You shouldn't put all your eggs into the TLS forward secrecy basket as a story · 4 points
HN discussionHere's a writeup of CVE-2015-1788: https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang... It's embarrassing rather than terribly dangerous. edit: Please note: there are other issues in this advisory. You should read the advisory, first and foremost.
Comment linking /2015/06/11/cve-2015-1788-openssl-binpoly-hang/
on “OpenSSL Security Advisory”Submitted TLS Performance: Rustls versus OpenSSL as a story · 3 points
HN discussionSome other similar solutions to this problem: https://jbp.io/2013/12/17/crime-vs-zlib.html https://www.blackhat.com/docs/eu-16/materials/eu-16-Karakost... Always good to see practical defensive computer security research.
Comment linking /2013/12/17/crime-vs-zlib.html
on “A Solution to Compression Oracles on the Web”Submitted Benchmarking Modern Authenticated Encryption on €1 Devices as a story · 3 points
HN discussionSubmitted Audio as a low-bandwidth authentic channel (2015) as a story · 2 points
HN discussionSubmitted TLS bulk performance: rustls versus OpenSSL as a story · 2 points
HN discussionSubmitted Abusing U2F to 'store' keys as a story · 2 points
HN discussionSubmitted Libotr: the code review as a story · 1 points
HN discussionSubmitted Guessing the Android SecureRandom vulnerability as a story · 1 points
HN discussion
