[deleted]
OpenSSL is written by monkeys (2009)
31–40 of 188 posts
Re: OpenSSL is written by monkeys (2009)
#32What alternatives are out there?
It is time for a new open source SSL implementation, maybe minimizing what is supported to reduce attack surface?
Re: OpenSSL is written by monkeys (2009)
#33Earlier quoted context omitted.
This might be intended. Supporting SSL is better than not supporting it (well, except in situations where an OpenSSL bug could leak your server's memory, but that's a bit of a stretch " rel="nofollow">http://filippo.io/Heartbleed/#www.peereboom.us> -- but put this aside), because it's always better to encrypt traffic even in a way vulnerable to passive attacks; and some people may reasonably opt-out of the SSL CA bus…
If someone has passive access to snoop, the odds they can perpetrate an active attack are so close to 100% as to make the distinction immaterial. Encryption without authentication accomplishes nothing. Worse, self-signed certificates train users to freely click through certificate warnings. People running servers with self-signed certificates are actively reducing what security we have available for the web. If we ev…
Can you MITM public wifi? Real question, but I thought the answer was "no", which would make public wifi a compelling counter-example.
Re: OpenSSL is written by monkeys (2009)
#34I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…
well, i appreciate mr dipropyl tryptamine having linked this. anyone who has looked at openssl source knows the score.
to quote one of our devs (davec) on the topic of openssl:
"funding openssl won't stop it from happening again... openssl is largely unmaintainable is the problem"
the ifdefs alone in the source make it nigh unreadable, much less the inconsistent variable naming, inconsistent indentation/nesting and inconsistent overall style.
Re: OpenSSL is written by monkeys (2009)
#35[deleted]
To be frank, OpenSSL website itself is vulnerable. (At the time of this writing.)
Re: OpenSSL is written by monkeys (2009)
#36Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?
Re: OpenSSL is written by monkeys (2009)
#37I seriously wonder what else is hidden in the mess called OpenSSL. And especially how much of the bugs are known by the NSA. Something like Heartbleed would definitely make a live-injection attack feasible!
If the NSA is going to spend our tax dollars analyzing that code, the least they could do is contribute formatting cleanup patches!
i don't think the NSA works like that :)
remember "national security" equates to "we will watch you all the time and steal all your dataz". it would obviously be great if "national security" meant what it was supposed to...
Re: OpenSSL is written by monkeys (2009)
#38I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…
So I only have a basic/intermediate understanding of SSL and X509, but I am curious about your opinion: Is the awful code design just a flaw in that particular implementation, or are the standards involved so hard to implement correctly?
Re: OpenSSL is written by monkeys (2009)
#39Earlier quoted context omitted.
If someone has passive access to snoop, the odds they can perpetrate an active attack are so close to 100% as to make the distinction immaterial. Encryption without authentication accomplishes nothing. Worse, self-signed certificates train users to freely click through certificate warnings. People running servers with self-signed certificates are actively reducing what security we have available for the web. If we ev…
Can you MITM public wifi? Real question, but I thought the answer was "no", which would make public wifi a compelling counter-example.
I have no idea where you'd get the idea that the answer is "no". The answer is emphatically yes.
Re: OpenSSL is written by monkeys (2009)
#40a guy setting out to write a CA (with LDAP backend! cue in nostalgy for my old days at one well known BigCo ) for what seems to be a first time, and as a first timer he obviously goes for OpenSSL (has he ever heard at least about NSS?). Does it all sound like part of the same problem he talks about?