LibreSSL by default

[Patrick]

LibreSSL might have similar APIs as OpenSSL but simply replacing the OpenSSL libraries with LibreSSL libraries and preserving the old names of the libraries in system without changing the code and recompiling the user program might not work as expected. It depends on implementation and compilation details and needs to be actually tested.

It would also help to ask LibreSSL developers explicitly if replacing the OpenSSL files which previously were provided by OpenSSL such as /usr/lib/x86_64-linux-gnu/libssl.so.1.1 is supported / sane / expected or if recompilation is advised.

@madaidan

Having LibreSSL used by default would make it far less likely for there to be critical vulnerabilities in the TLS implementation such as Heartbleed.

LibreSSL was forked from OpenSSL in 2014. In these 6 years since, has one project have had a better track record then the other?

This would need some more citations. Also major distributions switching to LibreSSL or at least discussing this would help.

LibreSSL sounds really good indeed:

LibreSSL - Wikipedia

But things need to be done the correct™ way:

Focus on low-effort maintainability

Quote Tails Focus on low-effort maintainability Many, many Live system projects — including a few ones that aimed at enhancing their users’ privacy — have lived fast and died young. We explain this by their being one wo/man efforts, as well as design decisions that made their maintenance much too costly timewise and energywise. We want Tails to live as long as it is needed: Tails is not meant to be solely a pet project. Since the early days of this project (i.e. early 2009), ease of maintena…