Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

article.gmane.org

Post reply on HN
Print view View original

71–80 of 245 posts

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#71

Post by icebraining »

zmguy wrote: post #61
stiff wrote: post #54

It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github…

Stiff, I think you answered your own question. Intel HIRES them, open source projects don't generally hire people. They sit around and wait for someone to contribute. Are you truly surprised that a volunteer created software is not as rigorously tested as software created by Intel?

Being FOSS doesn't have to mean relying on volunteers. Linux is mostly written by paid developers; why isn't OpenSSL, considering its reach in the commercial world?

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#72

Post by stiff »

zmguy wrote: post #61
stiff wrote: post #54

It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github…

Stiff, I think you answered your own question. Intel HIRES them, open source projects don't generally hire people. They sit around and wait for someone to contribute. Are you truly surprised that a volunteer created software is not as rigorously tested as software created by Intel?

I had some problems expressing what bothers me clearly and edited the comment heavily, perhaps it makes more sense now. You're right it is not that surprising, but it's still disappointing that even the most rudimentary best practices are not adopted. Have a look at sqllite for comparison, also an open source project, also in C, certainly less mission critical, and what a difference:

https://github.com/smparkes/sqlite/tree/master/test

https://github.com/smparkes/sqlite/blob/master/src/rowset.c

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#73

Post by lotsofcows »

kryptiskt wrote: post #53
bhouston wrote: post #26

Earlier quoted context omitted.

> no need for tinfoil hat theories Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet security. OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA. For example of NSA efforts in related areas (which I figured you would already know): http://www.cnbc.com/id/101301261 htt…

On the other hand, if the NSA pwned OpenSSL, shouldn't such a big thing have been in Snowden's docs?

It could be. Only a percentage of the documents have been analysed so far.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#75

Post by rmc »

kryptiskt wrote: post #53
bhouston wrote: post #26

Earlier quoted context omitted.

> no need for tinfoil hat theories Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet security. OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA. For example of NSA efforts in related areas (which I figured you would already know): http://www.cnbc.com/id/101301261 htt…

On the other hand, if the NSA pwned OpenSSL, shouldn't such a big thing have been in Snowden's docs?

Snowdon might not have known every implementation detail.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#76

Post by jafaku »

dlitz wrote: post #67
simias wrote: post #23

Earlier quoted context omitted.

Or maybe it's just a bug. There's really no need for tinfoil hat theories unless you have any evidence for a possible conspiracy. That being said I agree that OpenSSL could do with a good code cleaning, but that's a massive undertaking, especially for such a popular library. You have to be backwards compatible. Maybe a big name in software could go and write a modern crypto library without all the cruft of OpenSSL bu…

> Maybe a big name in software could go and write a modern crypto library without all the cruft of OpenSSL but for now we have to deal with it. https://xkcd.com/927/ There are very few competent FOSS crypto implementers, and unfortunately, they're spread very thinly. I'm not sure that having yet one another crypto library is going to be helpful unless we actively move our users to the new library and kill the old pro…

Another irrelevant xkcd comment...

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#77

Post by Allower »

simias wrote: post #23
bhouston wrote: post #21

Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes? The convoluted code of OpenSSL alone (from yesterday's Hackernews post) seems like a great way to add all sorts of "bugs" inadvertent or not. Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet se…

Or maybe it's just a bug. There's really no need for tinfoil hat theories unless you have any evidence for a possible conspiracy. That being said I agree that OpenSSL could do with a good code cleaning, but that's a massive undertaking, especially for such a popular library. You have to be backwards compatible. Maybe a big name in software could go and write a modern crypto library without all the cruft of OpenSSL bu…

What would evidence of conspiracy look like? Do we need comments in the code, "this is an NSA back door...", seriously?

>You have to be backwords compatible

we have been making this trade off for years and it wont get any easier in the future, its about time we started a fresh initiative that doesn't make backwords compatibility a priority, except of course in the sense of maintainability moving forward.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#78

Post by glomph »

TacticalCoder wrote: post #63
bhouston wrote: post #21

Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes? The convoluted code of OpenSSL alone (from yesterday's Hackernews post) seems like a great way to add all sorts of "bugs" inadvertent or not. Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet se…

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software: http://www.youtube.com/watch?v=fwcl17Q0bpk He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees). The entire…

Too be fair it is obviously intended to be a talk on what could be happening and not what certainly is.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#79

Post by icebraining »

davidw wrote: post #39
maxbucknell wrote: post #32

If there are so many problems with OpenSSL, why are there no alternatives that are readily available and anywhere near as functional? The whole internet runs OpenSSL, but why hasn't anyone tried to do something different? I know it's complicated, but if a few big companies really chose to put some muscle behind it, it could happen, right?

This sums up some of the difficulties with the production of open source software: https://en.wikipedia.org/wiki/Public_good

If this is a consequence of the difficulties with the production of open source software, does that mean there are much more secure proprietary implementations of SSL/TLS? Which ones?

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#80

Post by bhouston »

mappu wrote: post #60
madaxe_again wrote: post #35

Earlier quoted context omitted.

You have kept up to date with the news, right? Truecrypt, RSA... OpenSSL is low-hanging fruit by comparison. Of course it's back doored - probably more than once. You're right that it needs cleaning - it needs a full audit. I'm surprised in the light of the Snowden revelations that none of us have suggested this sooner, but hindsight is a bitch and all that.

Was there an issue with truecrypt?

http://www.computerworld.com/s/article/9243873/NSA_spying_pr...
Post reply on HN