15 October 2014, 14:40

A vulnerability has been discovered in SSL3.0 and it's called Poodle. That SSL3.0 has issues is not new, but after this discovery there is no excuse left to keep using it.

Although Hiawatha has support for SSL3.0, it is disabled by default. So, unless you have changed this behaviour via the MinSSLversion, you have nothing to worry about. In the next release, I will completely remove the support for SSL3.0. No more more leniency for WindowsXP and IE8 users.

Leo Unglaub
15 October 2014, 15:42
i am very happy that you will remove the SSLv3 support completly. There is an old saying. Good developers write good code, awesome developers remove legacy code!

15 October 2014, 15:58
I use since a while MinSSLversion = TLS1.1
Everybody should avoid old XP stuff.
Thank you Hugo.
Chris Wadge
16 October 2014, 03:15
I hate POODLEs... both kinds.

Personally, I disable SSLv3 and RC4 on all of my browsers. In Chrome, change the launch link to append the following:

--cipher-suite-blacklist=0x0004,0x0005,0xc011,0xc007 --ssl-version-min=tls1

On Firefox, you can enter about:config and make the following changes:
1) Set security.tls.version.min to 1
2) Search for rc4 and set each value to false

For more browser/OS combos, see here: https://zmap.io/sslv3/browsers.html [zmap.io]

To test your browser more thoroughly, see here: https://www.ssllabs.com/ssltest/viewMyClient.html [www.ssllabs.com]
Hugo Leisink
16 October 2014, 09:36
Another nice site to check your browser's SSL capabilities: https://www.howsmyssl.com/
16 October 2014, 11:06
SSLv3 Poodle Attack check :
16 October 2014, 18:28
I decided to switch to LibreSSL Portable on my Linux and OSX machines. This is maybe off topic for Hiawatha, but its a higher security level

Bob's Mail:
We have released LibreSSL 2.1.1- which should be arriving in the
LIbreSSL directory of an OpenBSD mirror near you very soon.
This release includes:
* Address POODLE attack by disabling SSLv3 by default
* Fix Eliptical Curve cipher selection bug
As well as continued ongoing fixes as we proactively change the
codebase to reflect modern safe programming practices. The success of
this is reflected in the fact that LibreSSL was not vulnerable to the
two memory leak issues released on "OpenSSL Tuesday" - They were in
fact initially
fixed in LibreSSL.
As noted before, we welcome feedback from the broader community.


Of course you have todo some symlinks in Mac OSX for libssl.dylib ...
Hugo Leisink
16 October 2014, 19:05
LibreSSL better and more secure than PolarSSL? I seriously doubt it...
Chris Wadge
17 October 2014, 00:51
I doubt LibreSSL is more secure than PolarSSL, but as a drop-in replacement for OpenSSL it's definitely an improvement.
17 October 2014, 03:59
Yes, dont get me wrong, I dont say its more secure than PolarSSL, I only use it as drop-in replacement. This is working on my OS X too (symlink libssl.dylib ...)

Is the goal for PolarSSL to be a drop-in replacement too? Any experiences here? Maybe with OS X?
17 October 2014, 04:15

PolarSSL is a direct replacement for OpenSSL when you look at the standards. If you look at our Features you will see similar items as on the OpenSSL feature list. The major difference is the way we make the code. We aim to help you make better applications. We provide as many documentation, examples and support as you need to be happy with the result.

PolarSSL does not yet offer an OpenSSL API. We try to make things intuitive and in most cases that means, doing it differently than the OpenSSL API. Functionally they do the same, but from a pure interface perspective, the OpenSSL API differs from the PolarSSL API in a lot of places.

From PolarSSL Website. If you dont need the OpenSSL API, than you can replace directly.
Hugo Leisink
17 October 2014, 07:04
For PolarSSL to be a drop-in replacement for OpenSSL, it needs to have the same API as OpenSSL. This horrible undocumented API is one of the things I hate about OpenSSL. So, no, I don't want PolarSSL to be a drop-in replacement for OpenSSL.
Chris Wadge
17 October 2014, 08:44
@Hugo: Exactly. Use PolarSSL where you can (Hiawatha!), use LibreSSL/BoringSSL where you must.
17 October 2014, 13:39
Thats it, there are many tools in a system enviroment, which need it. Thats the issue. Your choice for Hiawarha was the right one and the best. PolarSSL is clean, completly new written and fast. So you do not have old ballast. But in my case, I cant replace the old api in the system, because many basic tools need it.
It depends on the Distris. You cant run an Ubuntu Desktop without OpenSSL API, you cant run Mac OSX. And LibreSSL or BoringSSL (I dont know it in reall life) is a choice to replace the old original OpenSSL Code. Embeded code in Hiawatha and there is an OpenVPN Version its great.
Please dont think I'm a fighter for LibreSSL, Im only happy to have a chance to replace the original OpenSSL on my systems. Please dont be mad, there was NO criticism on Hiawatha or PolarSSL. PolarSSL proteced us from Heattbleed and other issues. I really like PolarSSL.
23 October 2014, 13:56
Today's update:

My first tests are working well with Hiawatha 9.8
Chris Wadge
24 October 2014, 23:46
I've built new Debian packages which pull in PolarSSL 1.3.9. All unit tests are passing, also verified with Qualys SSLLabs. files.tuxhelp.org/hiawatha/ [files.tuxhelp.org]

apt.sparkz.no [apt.sparkz.no] should be synced shortly.
21 December 2014, 22:12
Well, it's a bit of a bummer that XP needs the old TLS.. I guess it's time to upgrade.