Hacker News new | past | comments | ask | show | jobs | submit login

It's built from source. You can just diff it. Of course, you don't have to, because they provide the patches.

Don't use any FIPS branch of any platform, because FIPS is terrible. But the argument presented here seems facile.




FIPS is terrible, except that sometimes if you shout "FIPS 140 compliance for US gov contracts" enough into the corporate hierarchy you eventually get the budget to implement any security whatsoever, even though it's just FIPS.

If you're not trying to get US government contracts that require it, don't bother with FIPS. It mandates older algorithms; they're mostly secure enough but not as performant and there are a lot more footguns. FIPS 140-3 fixed a few, but not all.


There's a difference between FIPS approved algorithms, which are actually pretty broad and well-selected these days, and FIPS validated implementations, which are at best a PITA and often actively harmful. Very rarely do you actually need a FIPS-validated implementation.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: