On: Securing an HTTPS server

[tptacek]

OpenSSL is somewhat notorious for being a high-maintenance codebase. I personally think jailing it is overkill, but this argument (about whether the code is perfectly safe for a pre-auth attack surface) is a rathole.