Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

91–100 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#91

Post by betterunix »

mlieberman85 wrote: post #79
betterunix wrote: post #68

Earlier quoted context omitted.

1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…

If there's alternatives then why do so many pieces of software (nginx, Apache, etc.) use OpenSSL as opposed one of these alternatives?

Today there are alternatives. Once upon a time those alternatives were either not written, not stable, or not free. Now it is just a matter of convincing an enormous number of developers to carefully rewrite large parts of their systems to use a different library instead of new features (or ironically, security fixes).

Re: OpenSSL is written by monkeys (2009)

#92

Post by nknighthb »

jodrellblank wrote: post #87
nknighthb wrote: post #70

Earlier quoted context omitted.

I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would. People raised not to call others monkeys are not somehow the result of the l…

If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would. "This guy says something I associate with racism so he's racist. I say something you associate with Tumblr and there's NO REASON TO ASSUME I KNOW ANYTHING ABOUT TUMBLR". nknighthb, meet double standards. Double standards, nknighthb.

The trope is universal and deeply embedded in American society. It is not surprising that someone apparently from the UK would not realize this. It is surprising that a non-American is so eager to force their own cultural context onto an American issue. Isn't that a very American thing to do?

Re: OpenSSL is written by monkeys (2009)

#93

Post by fyrabanks »

nknighthb wrote: post #85
fyrabanks wrote: post #80

Earlier quoted context omitted.

It's because you sound like the "check your privilege" crew that tends to congregate on Tumblr. ( http://knowyourmeme.com/memes/check-your-privilege ) By the way, the key line from the article you didn't read (yet presume to understand its author's intent): "I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall."

I did read it, after it was helpfully posted elsewhere. I wish I hadn't. Not surprisingly, it wasn't worth my time.

"Not surprisingly, it wasn't worth my time," says the guy conducting multiple conversations in the comments section of an article on the internet that he didn't agree with.

Re: OpenSSL is written by monkeys (2009)

#94

Post by betterunix »

nly wrote: post #86

What's are the best alternatives? I've recently started looking, and PolarSSL[0] and Botan[1] are on my trial list. Mozilla NSS looks a little low level, and GnuTLS hasn't faired much better lately, despite having much better code hygiene than OpenSSL. [0] https://polarssl.org/ [1] http://botan.randombit.net/

I have some experience with NSS, and for simple things it is not terrible despite being a bit low level. With about an afternoon of work I was able to write a very simple TLS server using NSS -- in Lisp, using SBCL's FFI.

Re: OpenSSL is written by monkeys (2009)

#95

Post by nly »

ghshephard wrote: post #52
marssaxman wrote: post #42

Earlier quoted context omitted.

What is the alternative?

http://www.yassl.com/yaSSL/Home.html

It's GPL, and, according to Wikipedia, doesn't support Secure Renegotiation[0].

[0] https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...

Re: OpenSSL is written by monkeys (2009)

#96

Post by nknighthb »

fyrabanks wrote: post #93
nknighthb wrote: post #85

Earlier quoted context omitted.

I did read it, after it was helpfully posted elsewhere. I wish I hadn't. Not surprisingly, it wasn't worth my time.

"Not surprisingly, it wasn't worth my time," says the guy conducting multiple conversations in the comments section of an article on the internet that he didn't agree with.

Says the person arguing with said guy. Did you have a point other than that you think you're better-qualified to judge how I use my time than I am?

Re: OpenSSL is written by monkeys (2009)

#97

Post by aaronem »

penrod wrote: post #88
nknighthb wrote: post #73

Earlier quoted context omitted.

> have you never heard the phrase "pay peanuts, get monkeys"? No. I'm familiar with the idiom of "peanuts" meaning little money, monkeys have never been mentioned. In the modern American cultural context, monkeys are associated with bananas. Peanuts are associated with elephants. > Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? I don't care what people call…

> In the modern American cultural context, monkeys are associated with bananas. Actually, code monkeys are associated with Fritos.

And Tab, and Mountain Dew.

Re: OpenSSL is written by monkeys (2009)

#98

Post by lawl »

nknighthb wrote: post #84
antientropic wrote: post #76

Earlier quoted context omitted.

There is very little self-signed https traffic out there because browsers have chosen to treat it as somehow less secure than unencrypted http. (I do realise it's rather problematic to mess with the security expectations of https at this point, but you could imagine an http variant that allows encryption without authentication, without giving dire warnings to users.) If all http traffic instead used self-signed https…

This is why I disagree with many things PHK says. Like you, he pays a great deal of attention to how he wishes things had turned out, instead of figuring out how to make what we have better. Get browsers to act in the way you want, then we'll talk. Until then, people using self-signed certificates are causing active harm now .

Counter point: If you self sign your browser does cert pinning. With CA certs it accepts ANY valid certificate. Certificate pinning should be on by default for all certs. I use CertPatrol to accomplish this: https://addons.mozilla.org/en-us/firefox/addon/certificate-p...

Re: OpenSSL is written by monkeys (2009)

#99

Post by awda »

mlieberman85 wrote: post #79
betterunix wrote: post #68

Earlier quoted context omitted.

1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…

If there's alternatives then why do so many pieces of software (nginx, Apache, etc.) use OpenSSL as opposed one of these alternatives?

Historically, the alternatives are incomplete, solve only part of the problem, or are even worse (GnuTLS?).

Re: OpenSSL is written by monkeys (2009)

#100

Post by belorn »

cortesoft wrote: post #59
rodgerd wrote: post #45

Earlier quoted context omitted.

I'd trusts self-signed certs ahead of most CAs, frankly.

That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.

Trusting myself with out-of-band verification rather than trusting a third-party to do out-of-band verification is more trustworthy.

If you do not trust yourself to do it, why do you trust that the third-party would?

Post reply on HN