Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

81–90 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#81

Post by nhaehnle »

tptacek wrote: post #47
dkarapetyan wrote: post #36

Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?

It's not just number theory; it's a web of interlocking state machines implementing the TLS protocol, which itself depends on a variety of different marshalling formats for the number theoretic parameters, built on the shifting sands of optimizations for different machines, all evolved over the the course of ~15 years, starting from a package that was, literally, Eric Young's "teach myself C" project.

That's kind of missing the point though. It would be relatively easy to define an interface that is simple to use and allows implementing 90% of the use cases with rather low danger of shooting yourself in the foot. We know that this is possible because there are libraries out there that do it.

This whole thread is about OpenSSL somehow failing to do that, despite being called out on it for years.

Re: OpenSSL is written by monkeys (2009)

#83

Post by jodrellblank »

nknighthb wrote: post #41
koenigdavidmj wrote: post #29

Earlier quoted context omitted.

You're the only one bringing race into this. All that is meant is that the author views OpenSSL as approximately what you would get if you flung poo around for a while.

The author brought race into it by comparing human beings to monkeys, a common racist trope. If your only defense for someone calling people sub-humans is "but it might not be racist!", you need to think hard about what you're defending.

You are wrong, racists are wrong, therefore you are a racist.

QED.

(The classic racist comparison is "black people are monkeys". This comparison is "the code is awful, as if it were written by non-sentient animals bashing on keyboards". This comparison has nothing to do with race, it's not suggesting any particular race wrote OpenSSL or that any particular race cannot write good code or good cryptography systems. It is not making any distinction by race at all.

If they described it as "OpenSSL was written by crashing ink tankers into alphabeti-spaghetti lorries" would that be racially comparing people with vehicles?)

Re: OpenSSL is written by monkeys (2009)

#84

Post by nknighthb »

antientropic wrote: post #76
nknighthb wrote: post #66

Earlier quoted context omitted.

PHK says many things I disagree with. You can't make browsers simply treat self-signed certificates the same as plain HTTP. You still have to warn the user that their desire for a secure connection (conveyed by their request to retrieve an https URL) cannot be fulfilled, and do so in a way that assures all users will notice before they do something like, say, type in their password. There is very little self-signed H…

There is very little self-signed https traffic out there because browsers have chosen to treat it as somehow less secure than unencrypted http. (I do realise it's rather problematic to mess with the security expectations of https at this point, but you could imagine an http variant that allows encryption without authentication, without giving dire warnings to users.) If all http traffic instead used self-signed https…

This is why I disagree with many things PHK says. Like you, he pays a great deal of attention to how he wishes things had turned out, instead of figuring out how to make what we have better.

Get browsers to act in the way you want, then we'll talk. Until then, people using self-signed certificates are causing active harm now.

Re: OpenSSL is written by monkeys (2009)

#85

Post by nknighthb »

fyrabanks wrote: post #80
nknighthb wrote: post #70

Earlier quoted context omitted.

I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would. People raised not to call others monkeys are not somehow the result of the l…

It's because you sound like the "check your privilege" crew that tends to congregate on Tumblr. ( http://knowyourmeme.com/memes/check-your-privilege ) By the way, the key line from the article you didn't read (yet presume to understand its author's intent): "I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall."

I did read it, after it was helpfully posted elsewhere. I wish I hadn't. Not surprisingly, it wasn't worth my time.

Re: OpenSSL is written by monkeys (2009)

#86

Post by nly »

What's are the best alternatives?

I've recently started looking, and PolarSSL[0] and Botan[1] are on my trial list. Mozilla NSS looks a little low level, and GnuTLS hasn't faired much better lately, despite having much better code hygiene than OpenSSL.

[0] https://polarssl.org/ [1] http://botan.randombit.net/

Re: OpenSSL is written by monkeys (2009)

#87

Post by jodrellblank »

nknighthb wrote: post #70
aaronem wrote: post #53

Earlier quoted context omitted.

If your only justification for calling someone a racist is "but sometimes racists use that word!", you need to spend less time on Tumblr.

I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would. People raised not to call others monkeys are not somehow the result of the l…

If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would.

"This guy says something I associate with racism so he's racist. I say something you associate with Tumblr and there's NO REASON TO ASSUME I KNOW ANYTHING ABOUT TUMBLR".

nknighthb, meet double standards. Double standards, nknighthb.

Re: OpenSSL is written by monkeys (2009)

#88

Post by penrod »

nknighthb wrote: post #73
oneeyedpigeon wrote: post #62

Earlier quoted context omitted.

Woah - have you never heard the phrase "pay peanuts, get monkeys"? Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? It's a little sinister to bring race into this at all - I don't think anyone else went remotely near that connotation until you brought it up.

> have you never heard the phrase "pay peanuts, get monkeys"? No. I'm familiar with the idiom of "peanuts" meaning little money, monkeys have never been mentioned. In the modern American cultural context, monkeys are associated with bananas. Peanuts are associated with elephants. > Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? I don't care what people call…

> In the modern American cultural context, monkeys are associated with bananas.

Actually, code monkeys are associated with Fritos.

Re: OpenSSL is written by monkeys (2009)

#89

Post by tptacek »

nhaehnle wrote: post #81
tptacek wrote: post #47

Earlier quoted context omitted.

It's not just number theory; it's a web of interlocking state machines implementing the TLS protocol, which itself depends on a variety of different marshalling formats for the number theoretic parameters, built on the shifting sands of optimizations for different machines, all evolved over the the course of ~15 years, starting from a package that was, literally, Eric Young's "teach myself C" project.

That's kind of missing the point though. It would be relatively easy to define an interface that is simple to use and allows implementing 90% of the use cases with rather low danger of shooting yourself in the foot. We know that this is possible because there are libraries out there that do it. This whole thread is about OpenSSL somehow failing to do that, despite being called out on it for years.

I don't understand. What part of TLS are you calling "simple"?

Re: OpenSSL is written by monkeys (2009)

#90

Post by cpeterso »

Adobe's Flash Player used OpenSSL on Linux for a long time, but eventually switched to NSS because the OpenSSL project would repeatedly break their library ABI without changing version numbers. The OpenSSL developers said that a stable ABI was a non-goal of theirs. (Disclosure: I was an engineer on Adobe's Flash Player team.)
Post reply on HN