SSL & Heartbleed?

[Blaisorblade]

Let me ask a stupid question. Given the recent openssl bug, how do we know that the ssl implementation used by handin-server is good, assuming that openssl was patched (after the Racket install)?

This test page says that my server is safe, but I don't understand enough to know whether to trust the result when another server is used. I'd like to be reassured by a statement like, for instance, "we link dynamically to the system library" or "we link statically to an unaffected version" or "we use an alternative reputable unaffected implementation".

[Blaisorblade]

The docs of the openssl module document the used openssl version:
http://docs.racket-lang.org/openssl/index.html?q=openssl

Hence closing. Should I find some docs of handin that could be improved, I'll submit a PR, but it's not obvious there is such an opportunity.