Take the 2-minute tour ×  We plan in distribute Node.JS
webservers, for their advantage of async I/O. The Node.JS https
servers use OpenSSL libraries.  It appears that OpenSSL has
vulnerabilities resolved on a regular basis. This makes me
wonder if I should move the SSL layer to a separate Java process
/ something more proven, that will not have buffer overflow, and
other vulnerabilities.  The Oracle Solaris package repo
publishes only an out of date release, so compilation from
source would be necessary for prompt install.  There would of
course be a delay between
discovery->release->compilation->distribution to the servers
running. And additional administration cost/delay in the event
there is a problem with the build.    • How effective will
prompt updates be against attackers? What kind of work would be
necessary for the attacker, once a vulnerability is identified?
• Do you recommend an alternative, more secure approach to
installing the https layer?   • Is there an older, more stable
version of OpenSS