OpenBSD Releases Version 5.6 With LibreSSL

OpenBSD has released version 5.6 of its operating system of the same name. The code includes LibreSSL, a fork of OpenSSL that was created after the Heartbleed bug revealed a serious vulnerability in OpenSSL’s code.

In the implementation of LibreSSL in OpenBSD 5.6, as previously announced by OpenBSD project founder Theo de Raadt, many potentially vulnerable and outdated protocols have been omitted. For example, support for SSLv2, TLS compression and weak SSL ciphers based on ‘US Export’ regulation is missing.

Support for various hardware has also been removed from the code of LibreSSL, because it is outdated or because the relevant chips from IBM and Broadcom, among others, can only be accessed using proprietary drivers. In OpenSSL, the most widely used open source SSL/tls implementation, these components are still present.

OpenBSD, based on FreeBSD that celebrated its 21st anniversary last Sunday, also includes an improved installation tool and broader support for modern hardware in version 5.6. OpenSMTPD has continued to be chosen as the default smtp-mail demon, but unlike many other open source operating systems, Oracle’s MySQL has not yet been traded for MariaDB. Furthermore, OpenBSD users can choose from a KDE or Gnome environment. Despite the emphasis on operating system security, OpenBSD also contains flaws. For example, last month a dangerous bug was discovered that had been present in the source code for ten years.