{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/998","labels_url":"https://api.github.com/repos/facebook/osquery/issues/998/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/998/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/998/events","html_url":"https://github.com/facebook/osquery/issues/998","id":68839738,"number":998,"title":"Use LibreSSL for remote/TLS needs","user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/forum","name":"forum","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-04-16T04:04:23Z","updated_at":"2015-04-16T04:28:14Z","closed_at":null,"body":"Thoughts? Is this possible given tight coupling from our dependent libraries: both the dependencies we build from source and those installed on/by the OS."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/93636744","html_url":"https://github.com/facebook/osquery/issues/998#issuecomment-93636744","issue_url":"https://api.github.com/repos/facebook/osquery/issues/998","id":93636744,"user":{"login":"tomrittervg","id":163497,"avatar_url":"https://avatars.githubusercontent.com/u/163497?v=3","gravatar_id":"","url":"https://api.github.com/users/tomrittervg","html_url":"https://github.com/tomrittervg","followers_url":"https://api.github.com/users/tomrittervg/followers","following_url":"https://api.github.com/users/tomrittervg/following{/other_user}","gists_url":"https://api.github.com/users/tomrittervg/gists{/gist_id}","starred_url":"https://api.github.com/users/tomrittervg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomrittervg/subscriptions","organizations_url":"https://api.github.com/users/tomrittervg/orgs","repos_url":"https://api.github.com/users/tomrittervg/repos","events_url":"https://api.github.com/users/tomrittervg/events{/privacy}","received_events_url":"https://api.github.com/users/tomrittervg/received_events","type":"User","site_admin":false},"created_at":"2015-04-16T04:28:14Z","updated_at":"2015-04-16T04:28:14Z","body":"So I would question how frequently you push security updates. Bundling LibreSSL (or OpenSS or BoringSSL) means you're willing to track a third party component, pull in its security releases, and push urgent or semi-urgent updates to your users. (And Libre/Boring, AFAIK, don't issue \"security notices\" like OpenSSL does.)\r\n\r\nIf you don't have a process for cutting security releases and pushing them to your users OR if you do have an upgrade process but your users aren't tracking you as a package that needs 'urgent security updates' from time-to-time - then taking on bundling an SSL library seems more trouble than it's worth.\r\n\r\nThe other question I would ask would be \"If I could break an SSL connection back home, what would it get me?\"  If the answer is \"Code Execution as root\" - I would start thinking about how you might be able to mitigate some of that TLS attack surface with (e.g.) client certificates."}}