Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

61–70 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#61

Post by mrtksn »

agwa wrote: post #19

I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…

O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?

Re: OpenSSL is written by monkeys (2009)

#62

Post by oneeyedpigeon »

nknighthb wrote: post #22
aaronem wrote: post #11

Earlier quoted context omitted.

Within the page you didn't bother to read, presumably due to the mortal terror well known to be inflicted by presentation of a self-signed SSL certificate for a resource for which there's no reason to give a damn about identity validation in the first place, there's an expanded version of the metaphor which involves a reference to flung feces. So, no, I'm pretty sure that when the author says "monkeys", it's monkeys…

It's not mortal terror, it's declining to enable someone who uses racially-charged language to attack their fellow human beings while configuring their server in a way that anyone competent to evaluate OpenSSL's merits in the first place would know was no better than not having SSL at all, and in fact much worse, since it trains people to ignore certificate warnings.

Woah - have you never heard the phrase "pay peanuts, get monkeys"? Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? It's a little sinister to bring race into this at all - I don't think anyone else went remotely near that connotation until you brought it up.

Re: OpenSSL is written by monkeys (2009)

#64

Post by sliverstorm »

conformal wrote: post #37
gnu8 wrote: post #21

Earlier quoted context omitted.

If the NSA is going to spend our tax dollars analyzing that code, the least they could do is contribute formatting cleanup patches!

i don't think the NSA works like that :) remember "national security" equates to "we will watch you all the time and steal all your dataz". it would obviously be great if "national security" meant what it was supposed to...

The NSA wrote SELinux.

Re: OpenSSL is written by monkeys (2009)

#66

Post by nknighthb »

antientropic wrote: post #56
nknighthb wrote: post #25

Earlier quoted context omitted.

If someone has passive access to snoop, the odds they can perpetrate an active attack are so close to 100% as to make the distinction immaterial. Encryption without authentication accomplishes nothing. Worse, self-signed certificates train users to freely click through certificate warnings. People running servers with self-signed certificates are actively reducing what security we have available for the web. If we ev…

I guess you don't agree with Poul-Henning Kamp in his FOSDEM keynote this year: https://www.youtube.com/watch?v=fwcl17Q0bpk (around 15:00) His claim is that browsers treating websites with self-signed certificates as less secure than non-encrypted websites by displaying big fat warnings is just about the greatest gift we can give to organisations like the NSA. It's not true that there is no material distinction betwe…

PHK says many things I disagree with.

You can't make browsers simply treat self-signed certificates the same as plain HTTP. You still have to warn the user that their desire for a secure connection (conveyed by their request to retrieve an https URL) cannot be fulfilled, and do so in a way that assures all users will notice before they do something like, say, type in their password.

There is very little self-signed HTTPS traffic out there. The NSA assuredly has the resources to MITM all of it.

Yes, someone at some point would notice if it were all attacked, but the key thing is that, almost all of the time, nobody would, and you yourself have no assurance that your connection has not been MITM'd unless you have done some other out-of-band verification on that specific certificate. That is almost never done, especially by the general public.

You might be willing to gamble your own security, but you should not gamble everyone's security.

Re: OpenSSL is written by monkeys (2009)

#67

Post by markwakeford »

ghshephard wrote: post #54
ScottWhigham wrote: post #26

Earlier quoted context omitted.

Yes, I trust my own self-signed certs and I might trust the self-signed certs of certain sites. However, telling me that "There is nothing wrong with self-signed certificates." is irresponsible IMO. Who runs "peereboom.us"? #### if I know. I'm going to tell FF "It's okay - I'm good" this time b/c I'm not doing anything that matters but, as a rule, self-signed certs for unknown sites is not okay.

Would you trust visiting a site that's just HTTP? Self signed certs for unknown sites are fine. There is zero problem visiting them.

ahmen

Re: OpenSSL is written by monkeys (2009)

#68

Post by betterunix »

mrtksn wrote: post #61
agwa wrote: post #19

I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…

O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?

1. Other libraries do exist -- NSS, GnuTLS, etc.

2. Do you have time for a rewrite? What makes you think anyone else would?

3. The (generally correct) mindset is don't implement your own crypto. This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewrite.

Re: OpenSSL is written by monkeys (2009)

#69

Post by kyllo »

raverbashing wrote: post #48
adrianpike wrote: post #2

I'm getting a certificate warning on Chrome 33.0.1750.152. Is there a security corollary to Muphry's law?[1] [1] - http://en.wikipedia.org/wiki/Muphry's_law

Those with glass ceilings shouldn't throw stones I'm not visiting something criticizing OpenSSL if they can't get basic security right. And I've had with the "encryption without checking certificates provides an illusion of security" people, so yes, I won't visit the site.

Calm down, it's a static HTML page without any forms in it. There is no reason why it needs to be encrypted anyway.

Re: OpenSSL is written by monkeys (2009)

#70

Post by nknighthb »

aaronem wrote: post #53
nknighthb wrote: post #41

Earlier quoted context omitted.

The author brought race into it by comparing human beings to monkeys, a common racist trope. If your only defense for someone calling people sub-humans is "but it might not be racist!", you need to think hard about what you're defending.

If your only justification for calling someone a racist is "but sometimes racists use that word!", you need to spend less time on Tumblr.

I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would.

People raised not to call others monkeys are not somehow the result of the latest social media fad.

Post reply on HN