On Apr 4, 2014 10:31 AM, "R P Herrold" <herrold@owlriver.com> wrote:
>
> On Fri, 4 Apr 2014, R P Herrold wrote:
>
> Following on myself, this paper [1] touches on similar issues
> which are uncovered in current Open Source crypto libraries
> and tools
>
> I know there was a comment in the JIRA [2] distrusting whether
> enerprise vendors backport security fixes.  I strongly
> disagree with that view.  Certainly the upstream of CentOS is
> quite good about issuing prompt fixes which backport into a
> stable API, and moving away from locally carried libraries is
> a good way to get securitry updates, 'for free' into
> FreeSwitch, compared to using old 'carried around' tarballs of
> indeterminate security

It's also possibly a good way to get new bugs added to FS for free.  Actually, that has been observed recently.

Nonetheless, we are moving to system libs in many cases.

To solve all of our problems, we would need a meta distribution that spans all operating systems and provides a dependency track for popular open source packages for not only Linux but Mac, Win32 etc.  Since there is not such a thing afaik,  we now must put more strain on the users of those env to find suitable depends.

> -- Russ herrold
>
> [1] https://www.cs.utexas.edu/~shmat/shmat_oak14.pdf
> [2] https://jira.freeswitch.org/browse/FS-353
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting@freeswitch.org
> http://www.freeswitchsolutions.com
>
> FreeSWITCH-powered IP PBX: The CudaTel Communication Server
> http://www.cudatel.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-dev mailing list
> FreeSWITCH-dev@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev
> http://www.freeswitch.org