Greetings,
* Bruce Momjian (bruce@momjian.us) wrote:
> On Thu, Feb 3, 2022 at 02:33:37PM -0500, Robert Haas wrote:
> > As a philosophical matter, I don't think it's great for us - or the
> > Internet in general - to be too dependent on OpenSSL. Software
> > monocultures are not great, and OpenSSL has near-constant security
> > updates and mediocre documentation. Now, maybe anything else we
>
> I don't think it is fair to be criticizing OpenSSL for its mediocre
> documentation when the alternative being considered, NSS, has no public
> documentation. Can the source-code-defined NSS documentation be
> considered better than the mediocre OpenSSL public documentation?
This simply isn't the case and wasn't even the case at the start of this
thread. The NSPR documentation was only available through the header
files due to it being taken down from MDN. The NSS documentation was
actually still there. Looks like they've now (mostly) fixed the lack of
NSPR documentation, as noted in the recent email that I sent.
> For the record, I do like the idea of adding NSS, but I am concerned
> about its long-term maintenance, we you explained.
They've come out and explicitly said that the project is active and
maintained, and they've been doing regular releases. I don't think
there's really any reason to think that it's not being maintained at
this point.
Thanks,
Stephen