Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The sorry state of OpenSSL usability (2017)

jameshfisher.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: The sorry state of OpenSSL usability (2017)

#61

Post by lol768 »

tedivm wrote: post #8
CaliforniaKarl wrote: post #5

I think this should be retitled to "The sorry state of OpenSSL usability [on macOS]", because the author is using the built-in OpenSSL on macOS (which, as is eventually discovered, isn't actually OpenSSL). If you want to use OpenSSL on macOS, I suggest using the OpenSSL provided either in Brew or in MacPorts. That will give you a fully-functional setup (including help and man pages).

Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.

  $ lsb_release -a          
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description: Ubuntu 19.04
  Release: 19.04
  Codename: disco
  $ openssl --help           
  Invalid command '--help'; type "help" for a list.
  $ openssl help 2>&1 | head -n 3
  Standard commands
  asn1parse         ca                ciphers           cms               
  crl               crl2pkcs7         dgst              dhparam           
  $ openssl help asn1parse
  Usage: asn1parse [options]
  Valid options are:
  -help            Display this summary
  -inform PEM|DER  input format - one of DER PEM
  -in infile       input file
  -out outfile     output file (output format is always DER)
  -i               indents the output
  $ openssl genrsa -out foo.pem
  Generating RSA private key, 2048 bit long modulus (2 primes)
  ......................................................+++++
  .......................+++++
  e is 65537 (0x010001)

Re: The sorry state of OpenSSL usability (2017)

#62

Post by JdeBP »

lol768 wrote: post #61
tedivm wrote: post #8

Earlier quoted context omitted.

Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.

$ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 19.04 Release: 19.04 Codename: disco $ openssl --help Invalid command '--help'; type "help" for a list. $ openssl help 2>&1 | head -n 3 Standard commands asn1parse ca ciphers cms crl crl2pkcs7 dgst dhparam $ openssl help asn1parse Usage: asn1parse [options] Valid options are: -help Display this summary -inform PEM|DER input form…

And as pointed out in this very discussion at https://news.ycombinator.com/item?id=20043375 and https://news.ycombinator.com/item?id=20042633 , they do not even apply to MacOS.

Re: The sorry state of OpenSSL usability (2017)

#63

Post by x38iq84n »

CiPHPerCoder wrote: post #45

My question is: Why are you trying to use RSA at all? It's 2019! I can't think of anyone who seriously recommends RSA anymore. Switch to elliptic curve cryptography, where footbullets like a 512-bit RSA key offer aren't even on the table.

Sometimes it is a necessity to accommodate for various networking gear as load balancers, wireless controllers etc as RSA may be the only thing that they support.

Re: The sorry state of OpenSSL usability (2017)

#64

Post by GTP »

If on macOS openSSL is replaced by LibreSSL isn't OpenSSL's fault, and I also think that the title "The sorry state of OpenSSL usability" isn't right since it's actually talking about LibreSSL. By the way I've just ran "man openssl" on a Linux box and got the manual for OpenSSL, so I'm thinking that this could be more a problem of macOS than OpenSSL. Of course I agree that the online docs should say if something is deprecated or is using a default value that is no longer safe, but the rest of the article doesn't seem well made to me

Re: The sorry state of OpenSSL usability (2017)

#65

Post by tech-no-logical »

kayfox wrote: post #32
kevin_b_er wrote: post #13

Earlier quoted context omitted.

> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…

On #3, I bet the man pages do exist, just not for openssl itself, but for each of the modules like genrsa, rsa, s_client, x509, etc.

on a generic openbsd machine :

  OPENSSL(1)                  General Commands Manual                 OPENSSL(1)

  NAME
     openssl ? OpenSSL command line tool

  SYNOPSIS
     openssl command [command_opts] [command_args]

     openssl list-standard-commands | list-message-digest-commands |
             list-cipher-commands | list-cipher-algorithms |
             list-message-digest-algorithms | list-public-key-algorithms

     openssl no-command

  DESCRIPTION
     OpenSSL is a cryptography toolkit implementing the Transport Layer
     Security (TLS v1) network protocol, as well as related cryptography
     standards.
[...]

Re: The sorry state of OpenSSL usability (2017)

#66

Post by clarry »

tedivm wrote: post #16
kevin_b_er wrote: post #13

Earlier quoted context omitted.

> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…

1. The OpenSSL API hasn't changed, and if Apple changed it on their own that would break more things 2. The issue the author complained about was `openssl --help` not working, and it doesn't work on any platform (because he got the command wrong). `openssl help` does work on OSX (I literally just tested it). 3. Yeah, that's the one issue we agree is an Apple issue. 4. Apple didn't make LibreSSL. Other systems besides…

> 4. Apple didn't make LibreSSL. Other systems besides Apple use LibreSSL, and the authors complaints about their lack of documentation are relevant regardless of what Apple does.

No, this is specifically Apple's fuck up. The documentation is right there on OpenBSD! It pretty much always was. I have a live system running OpenBSD older than this rant, and the man pages are there. The default modulus is 2048 too.

Re: The sorry state of OpenSSL usability (2017)

#67

Post by mls-pl »

bromonkey wrote: post #3

manpages for openssl (`man openssl`) exist on Linux + Solaris + BSD, this seems like a mac usability issue to me...

it's not quite true - on latest macOS (10.14.5), on openssl based on LibreSSL 2.6.5 there's complete man page available - but, the funniest thing, it's dated on... today

Re: The sorry state of OpenSSL usability (2017)

#68

Post by notacoward »

If you think the user interface is bad, try the programmer interface. OMG. Layer upon layer of nonsensical objects to initialize and chain together, each with a bazillion options and no decent documentation about which few are secure. No decent interface for getting the specifics about an error. Not thread-safe unless you create your own array of locking functions (which must meet barely-documented requirements) and pass them in for the library to call at random times. Weird WANT_READ/WANT_WRITE nonsense that makes integration with a bog-standard poll/select loop more difficult. It's like the OpenSSL developers think SSL is the main thing your program should be doing and you're lucky they let any other functionality exist in the same program. The phrase "fractal of bad design" was originally invented for PHP but applies to OpenSSL just as much.

Re: The sorry state of OpenSSL usability (2017)

#69

Post by tomxor »

tedivm wrote: post #8
CaliforniaKarl wrote: post #5

I think this should be retitled to "The sorry state of OpenSSL usability [on macOS]", because the author is using the built-in OpenSSL on macOS (which, as is eventually discovered, isn't actually OpenSSL). If you want to use OpenSSL on macOS, I suggest using the OpenSSL provided either in Brew or in MacPorts. That will give you a fully-functional setup (including help and man pages).

Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.

Debian (OpenSSL), man page is present, and 2048 mod is default:

    openssl genrsa -out private_key.pem
    Generating RSA private key, 2048 bit long modulus (2 primes)
These are all either MacOS or LibreSSL problems.

This may not even be a LibreSSL problem since the version the author is using is 3 years old [1] MacOS userland is always so ancient, the other bits of BSD userland are even worse as far as I remember.

[1] https://www.libressl.org/releases.html

Re: The sorry state of OpenSSL usability (2017)

#70

Post by clarry »

tomxor wrote: post #69
tedivm wrote: post #8

Earlier quoted context omitted.

Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.

Debian (OpenSSL), man page is present, and 2048 mod is default: openssl genrsa -out private_key.pem Generating RSA private key, 2048 bit long modulus (2 primes) These are all either MacOS or LibreSSL problems. This may not even be a LibreSSL problem since the version the author is using is 3 years old [1] MacOS userland is always so ancient, the other bits of BSD userland are even worse as far as I remember. [1] http…

> These are all MacOS | LibreSSL problems

Just MacOS.

> If you want documented examples, everyone should know this is where man pages suck in general, they are usually just reference manuals.

OpenBSD is generally pretty good about providing some useful examples in man pages. The libressl man page has examples too, for genpkey at least.

Post reply on HN