Nginx + LibreSSL – a first test(mare-system.de)
mare-system.de
Nginx + LibreSSL – a first test
https://www.mare-system.de/blog/page/1405201517/
3 comments
We shouldn't really have to wonder about this kind of thing. explicit_bzero() for glibc, please!
It's probably dynamic/static noise. I don't think zeroisation would have an overhead as big as 4%. But then, I haven't measured: it's easy enough to do an A-B test with a castrated version and see?
It's probably dynamic/static noise. I don't think zeroisation would have an overhead as big as 4%. But then, I haven't measured: it's easy enough to do an A-B test with a castrated version and see?
Possibly, but it could also be much faster with all the cruft gone. Dynamic linking has a small overhead, so would love to see an apples to apples comparison.
Definitely to some extent, but I think the cruft would have a much smaller effect. Much of it was dead code - commented out, whole files not actually compiled, code ifdefed out, or bits of code only compiled on platforms that nobody has used this decade etc. It was making maintainability a nightmare and making it a lot harder to find bugs, but I don't think it would have had a huge performance impact.
you might be right: i did a new test with nginx+libressl static and the results are very similar: https://www.mare-system.de/static/bimages/nginx-libressl/per...
Cool, it builds!
Reminder: You still have RC4 enabled. It's time to take that out.
Reminder: You still have RC4 enabled. It's time to take that out.
yes, i know, but accoring to the blogpost below it should be no problem for newser browsers when using tls 1.2, but might e usefull to keep compatibility with very legacy clients, no?
disclaimer: i'm not a crypto-guru, the ciphers used are copypasta'd from https://www.ssllabs.com/projects/best-practices/.
https://community.qualys.com/blogs/securitylabs/2013/03/19/r...
https://community.qualys.com/blogs/securitylabs/2013/03/19/r...
an updated version is available, now with nginx+libressl statically linked
It could mean that a fair bit of that important cleaning was being optimised out before with OpenSSL.