Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

article.gmane.org

Post reply on HN
Print view View original

161–170 of 245 posts

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#161

Post by jameshart »

stiff wrote: post #54

It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github…

There are certainly large commercial entities who have sufficient incentive to keep OpenSSL secure that they really ought to be contributing actively to the project; I wonder whether Amazon might step up given how badly (and publicly - witness Mojang's taking minecraft services offline and pointing the finger at Amazon as the vendor they were waiting on to fix things - https://twitter.com/notch/status/453529143121309696) they got bitten by this vulnerability. Cloud hosting companies clearly have a responsibility to deliver trustworthy services, and that means they need to be deploying software stacks they can rely on not to screw them; either they will need to step up and support OpenSSL or switch to different SSL solutions that have stronger guarantees. Network appliance vendors like F5 and Cisco also have a clear interest in fixing this stuff. Question is, will they?

(disclosure - I work for IBM, though not in cloud infrastructure. What I say for Amazon applies to our cloud services guys too.)

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#162

Post by tomphoolery »

stiff wrote: post #54

It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github…

> I also wonder how much in the end the big institutions care about this stuff.

Well, if they did care more, you'd see engineers from Intel, IBM, et. al., contributing to the project in droves like they do with the Linux kernel.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#164

Post by sp332 »

reidrac wrote: post #8
antocv wrote: post #6

Earlier quoted context omitted.

GnuTLS exists. And NSS in mozilla. Probably others too.

cURL makes a nice comparison: http://curl.haxx.se/docs/ssl-compared.html GnuTLS had its own problems recently (see: http://www.gnutls.org/security.html ), and regarding NSS... I couldn't find a proper public "security" page for it (eg, release notes for 3.16 point to CVE-2014-1492; but the link to the bugzilla issue is not public), so I don't know. Obviously a good security record doesn't imply things like a good cod…

That chart is out of date. For example, NSS now supports TLS 1.2 https://en.wikipedia.org/wiki/Comparison_of_TLS_implementati...

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#165

Post by computer »

bhouston wrote: post #57
kryptiskt wrote: post #53

Earlier quoted context omitted.

On the other hand, if the NSA pwned OpenSSL, shouldn't such a big thing have been in Snowden's docs?

The NSA, according to the Snowden docs, can break SSL. No details though: http://blog.cryptographyengineering.com/2013/12/how-does-nsa...

Those documents do not say they can break SSL. They say they focus on SSL, and can break some specific SSL-using services.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#166

Post by canvia »

kryptiskt wrote: post #53
bhouston wrote: post #26

Earlier quoted context omitted.

> no need for tinfoil hat theories Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet security. OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA. For example of NSA efforts in related areas (which I figured you would already know): http://www.cnbc.com/id/101301261 htt…

On the other hand, if the NSA pwned OpenSSL, shouldn't such a big thing have been in Snowden's docs?

In Snowden's TED talk he said that the best reporting is yet to come.

http://www.ted.com/talks/edward_snowden_here_s_how_we_take_b...

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#167

Post by groovy2shoes »

SixSigma wrote: post #101
simias wrote: post #5

Earlier quoted context omitted.

Could have done without the final line though, but I guess it's his equivalent of a signature...

Theo is such a "character" that his "work" has been incorproated into the plan9 spin-off 9front as a theo (1) specific fortune file. http://man.cat-v.org/9front/1/fortune

And here's the theo fortune file: https://plan9front.googlecode.com/hg/lib/theo

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#168

Post by belorn »

oddevan wrote: post #159
boolt wrote: post #141

Earlier quoted context omitted.

I would actually be interested in hearing some of the issues related to LPGL in video games and other projects. Are there stories / write ups on this that you could link to or would you mind explaining it some?

Based on some informal research I did ~10 years ago (i.e. I ready the LGPL as a high school student), the LGPL requires, among other things, an end-user license allowing reverse engineering. The LGPL isn't just "my code is GPL, the rest of the program is whatever"; it puts forth some requirements for the entire finished product that are either impractical (must include source code) or illegal (would violate NDA or ot…

Only reverse engineering for debugging modifications of the LGPL code in derivative works.

if you try to reverse engineer the protocol starcraft 2 uses with battlenet, you will have a hard time arguing in court that the LGPL license gives you permission to do so. If I recall right, starcarft 2 has some heavy restrictions on reverse engineering for this specific purpose, and I trust their lawyers to actually understand this difference.

For console games (which starcraft 2 is not), the console environment is incompatible with LGPL. If adaption of a security library depend on the console market, then such adaption won't happen.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#170

Post by tankenmate »

tomphoolery wrote: post #162
stiff wrote: post #54

It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github…

> I also wonder how much in the end the big institutions care about this stuff. Well, if they did care more, you'd see engineers from Intel, IBM, et. al., contributing to the project in droves like they do with the Linux kernel.

Or maybe not after the current maintainers roll our their not so welcome mat.
Post reply on HN