Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

41–50 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#41

Post by nknighthb »

koenigdavidmj wrote: post #29
nknighthb wrote: post #22

Earlier quoted context omitted.

It's not mortal terror, it's declining to enable someone who uses racially-charged language to attack their fellow human beings while configuring their server in a way that anyone competent to evaluate OpenSSL's merits in the first place would know was no better than not having SSL at all, and in fact much worse, since it trains people to ignore certificate warnings.

You're the only one bringing race into this. All that is meant is that the author views OpenSSL as approximately what you would get if you flung poo around for a while.

The author brought race into it by comparing human beings to monkeys, a common racist trope.

If your only defense for someone calling people sub-humans is "but it might not be racist!", you need to think hard about what you're defending.

Re: OpenSSL is written by monkeys (2009)

#42

Post by marssaxman »

dkarapetyan wrote: post #36

Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?

What is the alternative?

Re: OpenSSL is written by monkeys (2009)

#45

Post by rodgerd »

a3_nm wrote: post #15
adrianpike wrote: post #2

I'm getting a certificate warning on Chrome 33.0.1750.152. Is there a security corollary to Muphry's law?[1] [1] - http://en.wikipedia.org/wiki/Muphry's_law

This might be intended. Supporting SSL is better than not supporting it (well, except in situations where an OpenSSL bug could leak your server's memory, but that's a bit of a stretch " rel="nofollow">http://filippo.io/Heartbleed/#www.peereboom.us> -- but put this aside), because it's always better to encrypt traffic even in a way vulnerable to passive attacks; and some people may reasonably opt-out of the SSL CA bus…

I'd trusts self-signed certs ahead of most CAs, frankly.

Re: OpenSSL is written by monkeys (2009)

#46

Post by syshax »

devinj wrote: post #33
nknighthb wrote: post #25

Earlier quoted context omitted.

If someone has passive access to snoop, the odds they can perpetrate an active attack are so close to 100% as to make the distinction immaterial. Encryption without authentication accomplishes nothing. Worse, self-signed certificates train users to freely click through certificate warnings. People running servers with self-signed certificates are actively reducing what security we have available for the web. If we ev…

Can you MITM public wifi? Real question, but I thought the answer was "no", which would make public wifi a compelling counter-example.

Yes. You arp poison the default gateway and route traffic through your own host instead.

Re: OpenSSL is written by monkeys (2009)

#47

Post by tptacek »

dkarapetyan wrote: post #36

Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?

It's not just number theory; it's a web of interlocking state machines implementing the TLS protocol, which itself depends on a variety of different marshalling formats for the number theoretic parameters, built on the shifting sands of optimizations for different machines, all evolved over the the course of ~15 years, starting from a package that was, literally, Eric Young's "teach myself C" project.

Re: OpenSSL is written by monkeys (2009)

#48

Post by raverbashing »

adrianpike wrote: post #2

I'm getting a certificate warning on Chrome 33.0.1750.152. Is there a security corollary to Muphry's law?[1] [1] - http://en.wikipedia.org/wiki/Muphry's_law

Those with glass ceilings shouldn't throw stones

I'm not visiting something criticizing OpenSSL if they can't get basic security right.

And I've had with the "encryption without checking certificates provides an illusion of security" people, so yes, I won't visit the site.

Re: OpenSSL is written by monkeys (2009)

#49

Post by rst »

keule wrote: post #38
agwa wrote: post #19

I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…

So I only have a basic/intermediate understanding of SSL and X509, but I am curious about your opinion: Is the awful code design just a flaw in that particular implementation, or are the standards involved so hard to implement correctly?

While the core parts of the crypto algorithms are, to some extent, intrinsically messy, that doesn't have much to do with the specific complaints here: inconsistent error return codes, pseudorandom indentation, #ifdef and if(0) stuff which deeply obscures control flow, and so forth. All of that is just bad style.

Re: OpenSSL is written by monkeys (2009)

#50

Post by dijit »

dkarapetyan wrote: post #36

Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?

inertia, it's what people know and too few people know it's internals to care.

if every google search for "https apache" comes back with openssl examples, it will be what's deployed.

personally I use gnutls for my irc servers, but, I'm the exception there. Those in the security community openly mock openssl due to the fact that it was a boys method of learning how SSL worked, which has been adopted but never properly structured...

.. or that the 'openssl' command itself is actually supposed to be for development only.

Post reply on HN