On Apr 4, 2014 10:31 AM, "R P Herrold" <herrold@owlriver.com> wrote:
On Fri, 4 Apr 2014, R P Herrold wrote:
Following on myself, this paper [1] touches on similar issues which are uncovered in current Open Source crypto libraries and tools
I know there was a comment in the JIRA [2] distrusting whether enerprise vendors backport security fixes. I strongly disagree with that view. Certainly the upstream of CentOS is quite good about issuing prompt fixes which backport into a stable API, and moving away from locally carried libraries is a good way to get securitry updates, 'for free' into FreeSwitch, compared to using old 'carried around' tarballs of indeterminate security
It's also possibly a good way to get new bugs added to FS for free. Actually, that has been observed recently. Nonetheless, we are moving to system libs in many cases. To solve all of our problems, we would need a meta distribution that spans all operating systems and provides a dependency track for popular open source packages for not only Linux but Mac, Win32 etc. Since there is not such a thing afaik, we now must put more strain on the users of those env to find suitable depends.
-- Russ herrold
[1] https://www.cs.utexas.edu/~shmat/shmat_oak14.pdf [2] https://jira.freeswitch.org/browse/FS-353
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org