On Thu, 19 Jan 2012, Paul Bakker wrote:

Thanks for pointing these things out!

> I would like to point to
> http://polarssl.org/trac/wiki/SecurityAdvisory201102
>
> My advice is to move from HAVEGE to the CTR_DRBG where possible.

Ugha. So why rename the function at all? Why not simply remove it to prevent
people (like us) who don't pay attention to keep using an unsafe function?

Any chance I can lure you into writing a patch that makes it use CTR_DRBG
instead?

> In addition, I see that error codes are reported in a debug function.
>
> PolarSSL now includes error.c which has error_strerror() for translating
> error codes to human-readable format.

I'll save those ones for the people who actually are using libcurl with
polarssl to fix...

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html