More Open Source Security episodes
Published 9 Mar 2026
Duration: 33:34
OpenSSL 3.0 is criticized for increased complexity, performance issues, and insufficient progress in testing and memory safety, sparking debate over its adoption and the need for alternative cryptographic libraries.
Josh talks to Paul Kehrer and Alex Gaynor, from the Python Cryptographic Authority. Alex and Paul recently published a statement discuss the challenge...
The podcast highlights concerns from the Python Cryptographic Authority about OpenSSL 3.0, emphasizing challenges such as increased API complexity, internal code obscurity, performance regression, and stagnation in critical areas like testing and memory safety. The transition to OpenSSL 3.0 is criticized for diverging from user expectations and reflecting broader industry frustrations with its design and implementation. The discussion also notes that alternatives like LibreSSL, BoringSSL, and AWS LC prioritize different goals, such as simplicity or performance, while exploring how Rusts memory-safe code and efficient parsing could enhance cryptographic safety and performance.
The podcast underscores the importance of formal verification to ensure cryptographic reliability and the need for cross-platform consistency in cryptographic APIs. It stresses that long-term improvements in cryptographic libraries must balance usability, security, and performance, avoiding over-reliance on OpenSSL for future advancements like post-quantum cryptography. Collaborative efforts are highlighted as essential to address these challenges and drive sustainable progress in cryptographic software development.
21 Sept 2026 The curl summer of Bliss with Daniel and Stefan
"Explored open-source security challenges, highlighting curl's 'Summer of Bliss' initiative to reduce maintainer burnout, the impact of AI-generated vulnerability reports, and the need for human expertise in security management, while advocating for sustainable practices in open-source development."
14 Sept 2026 CRA vulnerability reporting with Daniel Thompson
"Cyber Resilience Act imposes strict vulnerability reporting rules on manufacturers, raising concerns over inefficiency, ethical disclosures, and industry compliance challenges."
31 Aug 2026 Sovereign Tech Agency with Erik Moller
"Explores the Sovereign Tech Agency's efforts to sustain open-source software as critical infrastructure, emphasizing public investment, digital sovereignty, and strategic funding for projects like *curl* and AI security."
17 Aug 2026 Maintaining EOL Open Source with Commonhaus and HeroDevs
"Explores open-source maintenance challenges, solutions for solo maintainers, and the role of organizations like Common House and HeroDevs in sustaining projects through financial, legal, and administrative support, emphasizing governance, dependency management, and enterprise-community collaboration to ensure long-term sustainability."
10 Aug 2026 Cleanup, Speedup, Levelup open source at e18e
"E18e enhances JavaScript by reducing dependencies, optimizing tools, and improving security, as seen in its work with Storybook, while promoting cleaner code and community collaboration."