Hacker News Reader

Comment by boricj | Hacker News Reader

That sucks. It's integrated fairly deeply with the Zephyr ecosystem and I'm working on several products that use it, some of them fresly migrated to it...

I've made a PR a while back to add support for authenticated attributes and chain certificates (https://github.com/Mbed-TLS/mbedtls/pull/10232), turns out there are several open PRs for that feature set over the years and they just all sit there. That doesn't inspire contributors to stick around.

View on HN

There are several other embedded-targeted crypto libraries that have been around more or less forever, mbedTLS isn't the only game in town.

As it is used by Zephyr, maybe the Linux Foundation could take ownership and fund the further development of MbedTLS?

I sure hope so. From what I've seen, it's a genuinely well engineered and written library.

I've had to debug both Mbed-TLS and OpenSSL in parallel to figure out a bug in that PR by finding out the point of divergence between the two. The former was a good time, the latter very much not so.

I can only speculate as to why the long-term support of Mbed-TLS 4.1 (which was supposed to last until March 2029) was effectively recanted, but maintaining an internet-facing TLS/X.509/PKCS library in the age of LLM doesn't sound like a good time...

BearSSL is still in beta, but looks very solid already. If all else fails…

no TLS 1.3, and last released in 2018?

True, but its in active development, see https://bearssl.org/gitweb/?p=BearSSL;a=summary.

The thing is very carefully designed.

Reply on news.ycombinator.com