Apparently we don't have enough eyeballs.
OpenSSL is written by monkeys (2009)
71–80 of 188 posts
Re: OpenSSL is written by monkeys (2009)
#72I highly recommend fixing the style before attempting to read: https://www.dropbox.com/s/euuuyrjydo8z5jy/Screenshot%202014-...
Re: OpenSSL is written by monkeys (2009)
#73Earlier quoted context omitted.
It's not mortal terror, it's declining to enable someone who uses racially-charged language to attack their fellow human beings while configuring their server in a way that anyone competent to evaluate OpenSSL's merits in the first place would know was no better than not having SSL at all, and in fact much worse, since it trains people to ignore certificate warnings.
Woah - have you never heard the phrase "pay peanuts, get monkeys"? Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? It's a little sinister to bring race into this at all - I don't think anyone else went remotely near that connotation until you brought it up.
> have you never heard the phrase "pay peanuts, get monkeys"?
No. I'm familiar with the idiom of "peanuts" meaning little money, monkeys have never been mentioned. In the modern American cultural context, monkeys are associated with bananas. Peanuts are associated with elephants.
> Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way?
I don't care what people call themselves, nor do I care what members of a community call one another in jest. I care what people call others as an insult.
Re: OpenSSL is written by monkeys (2009)
#74put the text up in a gist, to get around the dodgy cert. https://gist.github.com/anonymous/10204608
Heck, it also gets rid of the white on black, thanks.
Re: OpenSSL is written by monkeys (2009)
#75Earlier quoted context omitted.
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…
[deleted]
Re: OpenSSL is written by monkeys (2009)
#76Earlier quoted context omitted.
I guess you don't agree with Poul-Henning Kamp in his FOSDEM keynote this year: https://www.youtube.com/watch?v=fwcl17Q0bpk (around 15:00) His claim is that browsers treating websites with self-signed certificates as less secure than non-encrypted websites by displaying big fat warnings is just about the greatest gift we can give to organisations like the NSA. It's not true that there is no material distinction betwe…
PHK says many things I disagree with. You can't make browsers simply treat self-signed certificates the same as plain HTTP. You still have to warn the user that their desire for a secure connection (conveyed by their request to retrieve an https URL) cannot be fulfilled, and do so in a way that assures all users will notice before they do something like, say, type in their password. There is very little self-signed H…
There is very little self-signed https traffic out there because browsers have chosen to treat it as somehow less secure than unencrypted http. (I do realise it's rather problematic to mess with the security expectations of https at this point, but you could imagine an http variant that allows encryption without authentication, without giving dire warnings to users.)
If all http traffic instead used self-signed https, then the NSA assuredly would not have the resources to MITM all of it. So because of the reflexive "self-signed certificates are worse than no encryption!" dogma, we have an Internet where most traffic is unencrypted and therefore trivial for governments and criminals to intercept.
Regarding certificate warnings: even if self-signed certificates were accepted, browsers could still put up a warning if the certificate changes between visits, similar to ssh's treatment of host keys (being relatively unsuspicious of unknown hosts, but putting up a big fat warning if the host key has changed).
Re: OpenSSL is written by monkeys (2009)
#77Earlier quoted context omitted.
You're the only one bringing race into this. All that is meant is that the author views OpenSSL as approximately what you would get if you flung poo around for a while.
The author brought race into it by comparing human beings to monkeys, a common racist trope. If your only defense for someone calling people sub-humans is "but it might not be racist!", you need to think hard about what you're defending.
April 8th, the day we learned that nknighthb doesn't know he's a racist.
Re: OpenSSL is written by monkeys (2009)
#78I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
It is really difficult to refactor such things at the public API layer once they are widely adopted by 3rd party projects.
Take the aforementioned error return inconsistencies -- how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library? You're trading one big problem (new clients are likely to get error return handling wrong) with another (if you modify all the returns for consistency, existing clients are now expecting the wrong return codes or, if you're smart and rename the functions to avoid that, at the very least the 3rd party consumers now need to do a lot of rewriting and deal with a painful crossover phase supporting both the old and new APIs).
Re: OpenSSL is written by monkeys (2009)
#79Earlier quoted context omitted.
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…
If there's alternatives then why do so many pieces of software (nginx, Apache, etc.) use OpenSSL as opposed one of these alternatives?
Re: OpenSSL is written by monkeys (2009)
#80Earlier quoted context omitted.
If your only justification for calling someone a racist is "but sometimes racists use that word!", you need to spend less time on Tumblr.
I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would. People raised not to call others monkeys are not somehow the result of the l…
It's because you sound like the "check your privilege" crew that tends to congregate on Tumblr. (http://knowyourmeme.com/memes/check-your-privilege)
By the way, the key line from the article you didn't read (yet presume to understand its author's intent): "I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall."