I think that is a real problem, yes; I also think that problem is endemic to ope...

midas007 · on April 25, 2014

But that's not an acceptable assessment of leadership for a vital crypto WG, much less the leading implementation. So far, OpenSSL has added one dev and it seems like business as usual. Does anyone know if anything's changed at TLS WG (I'm not on the mailing lists)?

In other news, I ported LibreSSL to OSX today[0].

[0] https://github.com/steakknife/libressl

tptacek · on April 25, 2014

I'm not sure what to tell you. I follow the mailing lists but very deliberately don't post on them, because I would drastically increase the noise level, which is already often bad. I can say that it does not look like the TLS WG has a "default deny" stance w/r/t/ new features for TLS.

I like what Google is doing; they control the Internet's most important server properties and one of the most important clients, and are taking full advantage of that to testbed TLS refinements and then bring them to the IETF as working code.

midas007 · on April 27, 2014

That's what I was after... confirmation that it's a Tragedy of the Commons.

There's political ammo now to make necessary changes in how things are done to make sure OpenSSL, TLS WG doesn't continue with business-as-usual.