Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sorry state of OpenSSL usability (2017)

jameshfisher.com

Post reply on HN
Print view View original

31–40 of 84 posts

Re: The sorry state of OpenSSL usability (2017)

#31

Post by HugoDaniel »

ivl wrote: post #25
brynet wrote: post #20

> Unfortunately, http://www.libressl.org/ won’t help you either, because there literally isn’t any documentation of LibreSSL. This is untrue. The front page contains links to the documentation inline, OpenBSD/LibreSSL converted all of OpenSSL's awful perlpod documentation to semantic mdoc(5) markup, and even wrote new man pages for functions completely undocumented by OpenSSL. See Ingo Schwarze' EuroBSDCon 2018 talk…

You're not wrong, but there's a big middleground here. To a user without some curiosity this: LibreSSL releases contain several parts: libcrypto: a library of cryptography fundamentals libssl: a TLS library libtls: a new TLS library, designed to make it easier to write foolproof applications Various utilities such as openssl(1), nc(1), and ocspcheck(8). With libcrypto, libssl, libtls, openssl, nc, and ocspcheck all l…

I found it strange since OpenBSD is known for their excellent docs. So after opening the libressl site they have that paragraph stating the parts of the lib and links to their docs. That page works as the documentation index.

Namely

https://man.openbsd.org/openssl.1

Which the author was complaining about needing to use google for. Specifically the https://man.openbsd.org/openssl.1#GENRSA seems well document.

Forks are just the way open source works and if documentation could be better then we are all free to contribute to it.

Re: The sorry state of OpenSSL usability (2017)

#32

Post by kayfox »

kevin_b_er wrote: post #13
tedivm wrote: post #8

Earlier quoted context omitted.

Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.

> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…

On #3, I bet the man pages do exist, just not for openssl itself, but for each of the modules like genrsa, rsa, s_client, x509, etc.

Re: The sorry state of OpenSSL usability (2017)

#33

Post by CiPHPerCoder »

mhb_eng wrote: post #17
minusf wrote: post #12

libressl has documentation. it's an OpenBSD project so you use the man pages. http://man.openbsd.org/openssl

Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)

If anyone really wanted FIPS 140-2 compliance for libressl they should pony up the money to get it certified instead of complaining about it on message boards.

Re: The sorry state of OpenSSL usability (2017)

#34

Post by jandrese »

thepangolino wrote: post #28
ivl wrote: post #25

Earlier quoted context omitted.

You're not wrong, but there's a big middleground here. To a user without some curiosity this: LibreSSL releases contain several parts: libcrypto: a library of cryptography fundamentals libssl: a TLS library libtls: a new TLS library, designed to make it easier to write foolproof applications Various utilities such as openssl(1), nc(1), and ocspcheck(8). With libcrypto, libssl, libtls, openssl, nc, and ocspcheck all l…

So what your saying the issue is libressl should put a link to the documentation on their front page? Sounds like a fair request. Perhaps someone should send them an email to let them know. That being said, you put a finger on the main issue most security and privacy tool have: user friendliness.

In many ways user friendliness corresponds directly with real life security level. Lots of compromises aren't due to a deficiency in the code, but someone using it incorrectly. Maybe by assuming the defaults are sane, or not understanding the implications of some of the technical jargon in the manual.

Remember Sony, a 60 billion dollar company, completely fubared the DRM on the Playstation 2 because a developer didn't understand what an IV is. And you go through the OpenSSL docs and it will tell you where to supply your IV without ever explaining what it is. All it needs is a single paragraph explaining the best practices, probably 5 or 10 lines in the manual.

Re: The sorry state of OpenSSL usability (2017)

#35

Post by PuercoPop »

thepangolino wrote: post #28
ivl wrote: post #25

Earlier quoted context omitted.

You're not wrong, but there's a big middleground here. To a user without some curiosity this: LibreSSL releases contain several parts: libcrypto: a library of cryptography fundamentals libssl: a TLS library libtls: a new TLS library, designed to make it easier to write foolproof applications Various utilities such as openssl(1), nc(1), and ocspcheck(8). With libcrypto, libssl, libtls, openssl, nc, and ocspcheck all l…

So what your saying the issue is libressl should put a link to the documentation on their front page? Sounds like a fair request. Perhaps someone should send them an email to let them know. That being said, you put a finger on the main issue most security and privacy tool have: user friendliness.

It _is_ linked to in their front page. The article is complaining about not finding documentation for the openssl command while literally linking to the front page that contains a link to said the documentation. They don't even have to Google, just read!

Re: The sorry state of OpenSSL usability (2017)

#36

Post by JdeBP »

beefhash wrote: post #19

> OpenSSL decided to use a “512 bit long modulus”, the default. We’re told: “don’t roll your own crypto; instead trust standard tools like OpenSSL”. The modulus length is a good example of why: a wrong value results in a trivially breakable key, and you the user shouldn’t need to know what the right value is. So OpenSSL chooses a sensible modulus length for you. Checking the OpenBSD man page for the LibreSSL genrsa,…

2.2.7 came out in May 2016. The switch to 2048 bits was in May 2014.

* https://github.com/libressl-portable/openbsd/commit/30eb68d7...

Re: The sorry state of OpenSSL usability (2017)

#37

Post by zwerdlds »

crescentfresh wrote: post #14
eloy wrote: post #11

> And stop forking OpenSSL; you’re just making things worse. Yeah no. OpenBSD developers did a really good job by improving the codebase of OpenSSL. See also some of their presentations: https://www.libressl.org/papers.html

> by improving the codebase of OpenSSL Just to clarify: LibreSSL forked OpenSSL [1]. By definition they did not improve the codebase of OpenSSL. [1] https://en.wikipedia.org/wiki/LibreSSL

Didnt most of their changes get merged back?

Re: The sorry state of OpenSSL usability (2017)

#38

Post by upofadown »

snazz wrote: post #22
mhb_eng wrote: post #17

Earlier quoted context omitted.

Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)

This is not a priority at all for the OpenBSD developers. Most of them are Canadian anyway, as I understand it.

That is actually understating it. The libressl developers purged the code base of the FIPS stuff as part of a policy. From here:

* https://marc.info/?l=openbsd-misc&m=139819485423701&w=2

"Note that FIPS mode isn't just worthless, it's actively harmful."

Re: The sorry state of OpenSSL usability (2017)

#39

Post by toast0 »

PuercoPop wrote: post #35
thepangolino wrote: post #28

Earlier quoted context omitted.

So what your saying the issue is libressl should put a link to the documentation on their front page? Sounds like a fair request. Perhaps someone should send them an email to let them know. That being said, you put a finger on the main issue most security and privacy tool have: user friendliness.

It _is_ linked to in their front page. The article is complaining about not finding documentation for the openssl command while literally linking to the front page that contains a link to said the documentation. They don't even have to Google, just read!

Unfamiliar people might not realize openssl(1) is linking to the manual page for openssl, or that it's in section one of the manual, thus the (1).
Post reply on HN