The Go crypto package is really a treat. I found it scary and incomprehensible to do anything with certificates using the OpenSSL command line, convenience wrappers notwithstanding. Adam Langley’s work shows what a reasonably ergonomic and approachable interface for this domain could look like. Turns out that issuing certificates doesn’t have to be dark magic.
The sorry state of OpenSSL usability (2017)
21–30 of 84 posts
Re: The sorry state of OpenSSL usability (2017)
#22libressl has documentation. it's an OpenBSD project so you use the man pages. http://man.openbsd.org/openssl
Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)
This is not a priority at all for the OpenBSD developers. Most of them are Canadian anyway, as I understand it.
Re: The sorry state of OpenSSL usability (2017)
#23libressl has documentation. it's an OpenBSD project so you use the man pages. http://man.openbsd.org/openssl
Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)
Yes, this is why I had to stick to OpenSSL for my Linux distribution even though I would have preferred LibreSSL.
Re: The sorry state of OpenSSL usability (2017)
#24A lot of comments here about LibreSSL and Apple vs OpenSSL. Which is fine, that was my immediate reaction. But do the criticisms re:weak defaults, unlabeled deprecated commands, and uninformative output apply? Because I'll admit - every time I have to use (some version of) openSSL I google for the command I need and blindly use it. The commands are cryptic and meaningless. If this is true outside of LibreSSL, that de…
Yeah the accessibility of the manpages was clearly the least significant objection by far, but yours is the first comment about anything else.
Re: The sorry state of OpenSSL usability (2017)
#25> Unfortunately, http://www.libressl.org/ won’t help you either, because there literally isn’t any documentation of LibreSSL. This is untrue. The front page contains links to the documentation inline, OpenBSD/LibreSSL converted all of OpenSSL's awful perlpod documentation to semantic mdoc(5) markup, and even wrote new man pages for functions completely undocumented by OpenSSL. See Ingo Schwarze' EuroBSDCon 2018 talk…
You're not wrong, but there's a big middleground here. To a user without some curiosity this:
LibreSSL releases contain several parts:
libcrypto: a library of cryptography fundamentals
libssl: a TLS library
libtls: a new TLS library, designed to make it easier to write foolproof applications
Various utilities such as openssl(1), nc(1), and ocspcheck(8).
They are undoubtedly present, but unless you click around assuming those aren't links to individual components, you wouldn't think so at a glance.
Re: The sorry state of OpenSSL usability (2017)
#26Earlier quoted context omitted.
Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.
> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…
> Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all.
Apple would actually very much like you to not use their OpenSSL: it is deprecated and you are not supposed to rely on it in your own applications.
Re: The sorry state of OpenSSL usability (2017)
#27Earlier quoted context omitted.
Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)
This is not a priority at all for the OpenBSD developers. Most of them are Canadian anyway, as I understand it.
Canada actually respects FIPS 140-2 certification (and cooperates in certifying implementations!), so this would very much be relevant in a Canadian context.
Re: The sorry state of OpenSSL usability (2017)
#28> Unfortunately, http://www.libressl.org/ won’t help you either, because there literally isn’t any documentation of LibreSSL. This is untrue. The front page contains links to the documentation inline, OpenBSD/LibreSSL converted all of OpenSSL's awful perlpod documentation to semantic mdoc(5) markup, and even wrote new man pages for functions completely undocumented by OpenSSL. See Ingo Schwarze' EuroBSDCon 2018 talk…
You're not wrong, but there's a big middleground here. To a user without some curiosity this: LibreSSL releases contain several parts: libcrypto: a library of cryptography fundamentals libssl: a TLS library libtls: a new TLS library, designed to make it easier to write foolproof applications Various utilities such as openssl(1), nc(1), and ocspcheck(8). With libcrypto, libssl, libtls, openssl, nc, and ocspcheck all l…
So what your saying the issue is libressl should put a link to the documentation on their front page?
Sounds like a fair request. Perhaps someone should send them an email to let them know.
That being said, you put a finger on the main issue most security and privacy tool have: user friendliness.
Re: The sorry state of OpenSSL usability (2017)
#29[deleted]
Re: The sorry state of OpenSSL usability (2017)
#30> Unfortunately, http://www.libressl.org/ won’t help you either, because there literally isn’t any documentation of LibreSSL. This is untrue. The front page contains links to the documentation inline, OpenBSD/LibreSSL converted all of OpenSSL's awful perlpod documentation to semantic mdoc(5) markup, and even wrote new man pages for functions completely undocumented by OpenSSL. See Ingo Schwarze' EuroBSDCon 2018 talk…
You're not wrong, but there's a big middleground here. To a user without some curiosity this: LibreSSL releases contain several parts: libcrypto: a library of cryptography fundamentals libssl: a TLS library libtls: a new TLS library, designed to make it easier to write foolproof applications Various utilities such as openssl(1), nc(1), and ocspcheck(8). With libcrypto, libssl, libtls, openssl, nc, and ocspcheck all l…
They're rather working on the assumption that readers know that anything with a "(1)" or an "(8)" after it is a reference to a user manual. This is a very common thing in BSD doco, and in Unix doco more generally.
For experienced Unix users this is likely to be true. It's something that one just learns. For novice users, it is less likely.