Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

11–20 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#11

Post by aaronem »

nknighthb wrote: post #8

I'm going to assume "monkeys" is a poor translation from another language. Maybe it's supposed to say "OpenSSL is written by fuzzy hackers". It's impossible to tell without accepting a self-signed certificate I have no means of validating. The irony is delicious, much like a banana.

Within the page you didn't bother to read, presumably due to the mortal terror well known to be inflicted by presentation of a self-signed SSL certificate for a resource for which there's no reason to give a damn about identity validation in the first place, there's an expanded version of the metaphor which involves a reference to flung feces. So, no, I'm pretty sure that when the author says "monkeys", it's monkeys he means.

Re: OpenSSL is written by monkeys (2009)

#12

Post by dfc »

nknighthb wrote: post #8

I'm going to assume "monkeys" is a poor translation from another language. Maybe it's supposed to say "OpenSSL is written by fuzzy hackers". It's impossible to tell without accepting a self-signed certificate I have no means of validating. The irony is delicious, much like a banana.

Why do you think the sky is going to fall if you temporarily accept a certificate?

Re: OpenSSL is written by monkeys (2009)

#13

Post by RyanZAG »

geuis wrote: post #9

Be security conscious folks. Don't click through to a site with a self-signed cert.

Huh? All it means is that the site you are trying to visit may be an imposter. Since you don't even know who the site is in the first place, does it matter to you if someone is impersonating that site? Of course not.

Feel free to accept the self-signed cert, there is no security worries there. If you go to your bank's website - or anything at all with private data - then you need to make sure it isn't self signed.

Re: OpenSSL is written by monkeys (2009)

#15

Post by a3_nm »

adrianpike wrote: post #2

I'm getting a certificate warning on Chrome 33.0.1750.152. Is there a security corollary to Muphry's law?[1] [1] - http://en.wikipedia.org/wiki/Muphry's_law

This might be intended. Supporting SSL is better than not supporting it (well, except in situations where an OpenSSL bug could leak your server's memory, but that's a bit of a stretch " rel="nofollow">http://filippo.io/Heartbleed/#www.peereboom.us> -- but put this aside), because it's always better to encrypt traffic even in a way vulnerable to passive attacks; and some people may reasonably opt-out of the SSL CA business because they do not like the way it is structured, doubt the security it offers, or feel that they do not need it.

(I use a free StartSSL signed certificate, but only because it's free and not very hard to get. If there were no free provider with widespread support, I would be very happy to use a self-signed cert and think of it as a protest against the stupidity of browsers which present SSL+self-signed as less secure than plain HTTP).

Re: OpenSSL is written by monkeys (2009)

#16

Post by dfc »

AdrianRossouw wrote: post #6

put the text up in a gist, to get around the dodgy cert. https://gist.github.com/anonymous/10204608

dodgy cert for read only site + magic verisign fairy dust = unicorns and rainbows?

For future reference you can use archive.org in the future if you are afraid of dodgy certs: http://web.archive.org/web/20140125144231/http://www.peerebo...

Re: OpenSSL is written by monkeys (2009)

#19

Post by agwa »

I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible.

The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 means success, and sometimes it's a combination. This is really, really bad for a crypto library since properly detecting errors is usually critical to security.

Post reply on HN