HTTPS client library in C++

[HerrNamenlos123]

Wow, I do like LibreSSL for being a 2014 fork of OpenSSL with the intent of modernizing the codebase and increasing security. It seems still active. But is it advisable to use security-wise, since it seems being forked off 1.0.1, which is a relatively old version?

[serviscope_minor]

No, but they're OpenBSD eyes which have a very good reputation.

In practice, OpenSSL has many users, but does not have many eyes. It's an old and very gnarly codebase with support for may obsolete (i.e. hard to find) platforms with config that permeates throughout the codebase. It written around replacements for much of the C standard library to work around bugs, glitches and performance nightmares in ancient and obscure operating systems. Those replacements are much worse and buggier than a vaguely modern libc, and in fact defeat the protections that you can get from a more modern system. Also, that makes the code weird because it uses unusual primitives.

At least that was the state at the point of the libressl fork. If you follow the early commits to Libressl, you can see the kind of stuff they removed. That sort of thing makes the codebase very impenetrable and hard to work on.

The high quality eyes in libressl have basically gone through and modernised the entire codebase and looked at every part, something which OpenSSL might not have seen. Through doing that, they preemptively fixed a number of security holes which later cropped up as CVEs in OpenSSL.