Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

My concern with the server side of this would be a bug in OpenSSL (which I assume this uses) could give a hacker access to the memory space of all current connections, a feature the default forking servers don't have to worry about. It's a benefit that helped qmail remain secure for so long.

And yet I say this as a creator of an async SMTP server, so I don't think these days it is that big of an issue.



I checked the source and I don't see any references to openssl.

that doesn't mean that it wont get pulled in as a dependency somewhere else.


It uses https://cryptography.io/en/latest/ , the origin of which is described at https://lwn.net/Articles/595790/ . Under the hood that uses OpenSSL.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: