Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

121–130 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#121

Post by kedean »

jessaustin wrote: post #110
cortesoft wrote: post #59

Earlier quoted context omitted.

That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.

TOFU: don't most browsers tell you if you've been to the site before, and whether the cert has changed since your last visit? I seem to recall that at one time Firefox could be configured to not even complain when it saw a self-signed cert it recognized?

No. That is a capability provided by an extension called CertPatrol, at least in the Firefox ecosystem.

Re: OpenSSL is written by monkeys (2009)

#122

Post by greatsuccess »

nly wrote: post #86

What's are the best alternatives? I've recently started looking, and PolarSSL[0] and Botan[1] are on my trial list. Mozilla NSS looks a little low level, and GnuTLS hasn't faired much better lately, despite having much better code hygiene than OpenSSL. [0] https://polarssl.org/ [1] http://botan.randombit.net/

GNUTls? Code hygiene? You have to be joking...seriously...you must be joking

Re: OpenSSL is written by monkeys (2009)

#123

Post by kzrdude »

hadoukenio wrote: post #10
geuis wrote: post #9

Be security conscious folks. Don't click through to a site with a self-signed cert.

There is nothing wrong with self-signed certificates. If you need to trust a website that uses self-signed certificates, just make sure to verify out-of-band.

There are two problems in Firefox:

* The excepted site displays the exact same padlock icon as hacker news for example

* "Add exception permanently" is selected by default.

Re: OpenSSL is written by monkeys (2009)

#124

Post by a8000 »

betterunix wrote: post #68
mrtksn wrote: post #61

Earlier quoted context omitted.

O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?

1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…

What I don't understand is why there aren't companies around that have an interest in improving this software and pay ~1-5 people ~1 million to rewrite it in a year.

Re: OpenSSL is written by monkeys (2009)

#125

Post by grrowl »

sorbits wrote: post #105
mrtksn wrote: post #61

Earlier quoted context omitted.

O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?

Apple has deprecated OpenSSL as of Mac OS X 10.7 and they are not including it with iOS. Instead they provide their own APis. The semi-official reason though is that OpenSSL doesn’t offer API compatibility between versions.

In case anyone's curious, here's a link to the libsecurity_ssl source (albeit not totally up to date — latest version is pre-"goto fail;" fix):

http://opensource.apple.com/source/Security/Security-55471/l...

Re: OpenSSL is written by monkeys (2009)

#126

Post by thefreeman »

grrowl wrote: post #125
sorbits wrote: post #105

Earlier quoted context omitted.

Apple has deprecated OpenSSL as of Mac OS X 10.7 and they are not including it with iOS. Instead they provide their own APis. The semi-official reason though is that OpenSSL doesn’t offer API compatibility between versions.

In case anyone's curious, here's a link to the libsecurity_ssl source (albeit not totally up to date — latest version is pre-"goto fail;" fix): http://opensource.apple.com/source/Security/Security-55471/l...

I guess we see how well that worked out for them.

Re: OpenSSL is written by monkeys (2009)

#127

Post by derefr »

georgemcbay wrote: post #78
mrtksn wrote: post #61

Earlier quoted context omitted.

O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?

It is really difficult to refactor such things at the public API layer once they are widely adopted by 3rd party projects. Take the aforementioned error return inconsistencies -- how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library? You're trading one big problem (new clients are likely to get error return handling wrong) with another (if you mo…

> how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library?

You split your project into two components:

1. a new, clean, minimal core with a nice, shiny, new API; and

2. an "OpenSSL emulation layer" that loads your core library, and wraps it in OpenSSL-compatible cruft.

It'd be very similar to, say, replacing Direct3D with OpenGL, and then writing a Direct3D emulation layer that calls OpenGL.

Re: OpenSSL is written by monkeys (2009)

#128

Post by sarreph »

thefreeman wrote: post #126
grrowl wrote: post #125

Earlier quoted context omitted.

In case anyone's curious, here's a link to the libsecurity_ssl source (albeit not totally up to date — latest version is pre-"goto fail;" fix): http://opensource.apple.com/source/Security/Security-55471/l...

I guess we see how well that worked out for them.

Well... Certainly better right now.

Re: OpenSSL is written by monkeys (2009)

#129

Post by yp_master »

agwa wrote: post #19

I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…

Have you ever tried axssl or polarssl?

I am just curious; I make no endorsement of either.

Re: OpenSSL is written by monkeys (2009)

#130

Post by pritambaral »

amatix wrote: post #119
lawl wrote: post #104

Earlier quoted context omitted.

I use(d) free StartSSL for my hobby projects too. So I wanted to revoke my certificates today, post heartbleed and stuff. They charge $25 to do the right thing and revoke your cert. So I will not use them again. Edit: Btw. That's per fucking subdomain , as you don't get wildcard certs for free. Going back to self signed I guess...

I put the CVE id in my "reason" and it went through with no charge.

I just tried it. They mailed me asking for credit card / paypal details. Are you sure they didn't just bill a payment method you previously added?
Post reply on HN