| ▲ | throwawaymaths 5 days ago | |
yeah and iirc erlang's ssl was one of the only ssl implementations not affected by heaetbleed since erlang is memory safe | ||
| ▲ | toast0 4 days ago | parent [-] | |
I'm a big fan of Erlang, but I don't think this is a fair thing to praise. Only OpenSSL had heartbleed. No other implementation of TLS protocols was affected. Many systems integrate with OpenSSL's protocol code, but there's also several that do their own protocol work and use ciphers from OpenSSL (and some that do both). Erlang's ssl implementation at the time of heartbleed wasn't anywhere close in throughput to using OpenSSL separately. If I'm remembering right, OTP 18 (June 2015) is when it got good enough that it made more sense to run an Erlang https server without a separate TLS termination daemon. Heartbleed became known April 2014, so Erlang SSL was too late to help there, really. More secure, but unusable wirh load doesn't help much. Also, Erlang SSL was one of many implementations thst needed to be reminded of 1998 era security issues in 2017. [1] | ||