Feeds

Bored yet? Now there's ANOTHER OpenSSL fork – it's from Google

Because Heartbleed is the gift that keeps on giving

Securing Web Applications Made Simple and Scalable

With developers still struggling to plug vulnerabilities in the open source OpenSSL crypto library, Google has spun off a new fork of the project based on its own, internal work with the code, dubbed BoringSSL.

"We have used a number of patches on top of OpenSSL for many years," Google dev Adam Langley said in a blog post announcing the effort. "Some of them have been accepted into the main OpenSSL repository, but many of them don't mesh with OpenSSL's guarantee of API and ABI stability and many of them are a little too experimental."

Google uses its hacked-on version of OpenSSL in Chrome, Android, and various other things, but that has meant maintaining and patching multiple code bases. BoringSSL marks the beginning of an attempt to unify Google's code into a single, consistent library that can be shared across many projects.

Complicating matters, this isn't the first fork of OpenSSL to be announced since all of the Heartbleed mess. In April, the OpenBSD project's Theo de Raadt announced LibreSSL, which aims to be a thoroughly cleaned-up version of a project de Raadt has described as being "not developed by a responsible team."

But Langley says BoringSSL isn't meant to compete with LibreSSL. In fact, due to the nature of Google's patches, it won't even be a drop-in replacement for OpenSSL, as LibreSSL aims to be.

And for that matter, Google kicks in money to both the OpenBSD Foundation and the Core Infrastructure Initiative, which is one of the groups working to clean up the original OpenSSL code base, rather than forking it.

Instead, Langley said, switching to a new development model will make it easier for the Chocolate Factory to maintain its custom crypto code in the long run, and it will even make it easier for it to import changes from LibreSSL, when that seems like a good idea.

"The result of that will start to appear in the Chromium repository soon and, over time, we hope to use it in Android and internally too," Langley wrote.

He added that Google will continue to contribute bug fixes to OpenSSL when it finds them.

If you'd like to take a peek at what Google's code gremlins have done so far, the BoringSSL source code is available on the company's public Git repository, here. ®

Bridging the IT gap between rising business demands and ageing tools

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.