The version at pastebin.
OpenSSL is written by monkeys (2009)
161–170 of 188 posts
Re: OpenSSL is written by monkeys (2009)
#162Earlier quoted context omitted.
1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…
If there's alternatives then why do so many pieces of software (nginx, Apache, etc.) use OpenSSL as opposed one of these alternatives?
It was among the first at the time. OpenSSL was probably the dopest shit on the interwebz of crypto (or came close to it) at the time. Furthermore, these days it's too widely used so, everyone is just "fuck it." OpenSSL is the PHP of the cryptography world.
Also, I've see a ton of code just invoke the OpenSSL tool instead of actually use OpenSSL library.
I tried to use the library and was down in spirit, much like the author of the blog post, but I was too disappointed to even care, and just gave in to calling the tool from my code.
An idea: create a fork, call it OpenSSL2 and clean it up, but maintain both codebases, and end support for OpenSSL1 in 2-5 years?
Re: OpenSSL is written by monkeys (2009)
#163Earlier quoted context omitted.
It is really difficult to refactor such things at the public API layer once they are widely adopted by 3rd party projects. Take the aforementioned error return inconsistencies -- how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library? You're trading one big problem (new clients are likely to get error return handling wrong) with another (if you mo…
> It is really difficult to refactor such things at the public API layer once they are widely adopted by 3rd party projects. But how did it ever get so widely adopted, if it's so hard to use? And even if it is widely adopted, that still shouldn't stop anyone from forking it and fixing all the problems.
"But how did it ever get so widely adopted, if it's so hard to use?"
Usefulness and lack of alternatives?
Re: OpenSSL is written by monkeys (2009)
#164I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
Because they say "don't roll your own crypto" so nobody does it anymore. There is some truth in it but it's getting to sound like nobody should touch crypto.
Re: OpenSSL is written by monkeys (2009)
#165Earlier quoted context omitted.
There is nothing wrong with self-signed certificates. If you need to trust a website that uses self-signed certificates, just make sure to verify out-of-band.
There are two problems in Firefox: * The excepted site displays the exact same padlock icon as hacker news for example * "Add exception permanently" is selected by default.
What does that have to do with self-signed certificates in general rather than an issue with your particular browser?
Re: OpenSSL is written by monkeys (2009)
#166Earlier quoted context omitted.
What I don't understand is why there aren't companies around that have an interest in improving this software and pay ~1-5 people ~1 million to rewrite it in a year.
Because companies are cheapskates nowadays. Back in the Linux bubble days (1997-early 2000s), lots of companies employed full time people to work on all kinds of stuff, not just profitable company project, but also needed infrastructure. Even front end projects, like Nautilus and Evolution were created by full paid teams.
I posted the 'public good' link elsewhere, and this goes to the very heart of the problem: why should I pay if someone else might, and then I get it for free?
There might be a bunch of companies willing to chip in a bit, but coordinating that is difficult. Something like kickstarter might be able to help, but that has its own problems: if you spend your time writing a commercial SSL thing, you can go out and sell it right now when it's ready. If some company has to wait around for the results.... it's not as nice for them.
Re: OpenSSL is written by monkeys (2009)
#167Earlier quoted context omitted.
i don't think the NSA works like that :) remember "national security" equates to "we will watch you all the time and steal all your dataz". it would obviously be great if "national security" meant what it was supposed to...
The NSA wrote SELinux.
Has that been audited independently? A quick Google search didn't cough up anything.
Re: OpenSSL is written by monkeys (2009)
#168Last year I took part in a similar project in which I had to issue both server and client certificates, signed by another certificate, for a company's sales site. I'm not by all means an expert in cryptography (not even close), and after googling around a bit I found "The Legion of The Bouncy Castle"[1] crypto library, which was relatively easy to work with, and enabled me to solve my problem quick enough. I just wonder what more experienced programmers have to say about this crypto library.
[1] http://en.wikipedia.org/wiki/Bouncy_Castle_(cryptography)
Re: OpenSSL is written by monkeys (2009)
#169Adobe's Flash Player used OpenSSL on Linux for a long time, but eventually switched to NSS because the OpenSSL project would repeatedly break their library ABI without changing version numbers. The OpenSSL developers said that a stable ABI was a non-goal of theirs. (Disclosure: I was an engineer on Adobe's Flash Player team.)
OpenSSL's thread safety policies is undocumented and unintelligible. We gave up and just put a single mutex around any call to OpenSSL within the process.
That's actually something openssl does okay. See http://www.openssl.org/docs/crypto/threads.html it's actually one of the few things that are properly documented.
Re: OpenSSL is written by monkeys (2009)
#170Earlier quoted context omitted.
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
Did you ever noticed, that not always the best Code/Tools are used in projects ? Its a pattern that you can watch on many IT-Projects. Some "Key-People" like a project (for whatever reason) and a mass of developer follow them. And than a thing get "standard" and more and more people use it.
It's because the people who know the least are usually the loudest, most "arrogtant" and most opinionated people in a set.
It's just humanity; it doesn't just plague the IT community. :-)