dysfun , vor 10 Tagen

@icing curious they mention rustls. rustls is based upon ring, which has a security policy of full disclosure and no means of privately reporting issues.

fasterthanlime , vor 10 Tagen

@dysfun @icing I wouldn't say "based upon" — ring is one of the available crypto backends, aws-lc-rs is another one

dysfun , vor 10 Tagen

@fasterthanlime @icing ah cool. is it still default?

fasterthanlime , vor 10 Tagen

@dysfun @icing nope:

> While Rustls itself is platform independent, by default it uses aws-lc-rs for implementing the cryptography in TLS. See the aws-lc-rs FAQ for more details of the platform/architecture support constraints in aws-lc-rs.
>
> ring is also available via the ring crate feature: see the supported ring target platforms.

https://lib.rs/crates/rustls

dysfun , vor 10 Tagen

@fasterthanlime @icing oh, sweet. guess i wasn't paying enough attention 😬​

fasterthanlime , vor 10 Tagen

@dysfun @icing the ecosystem is still lagging behind a bit afaict (rustls 0.22 vs 0.23), but we'll get there.