Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL is written by monkeys (2009)

peereboom.us

Post reply on HN
Print view View original

181–188 of 188 posts

Re: OpenSSL is written by monkeys (2009)

#181

Post by astrodust »

stevehawk wrote: post #176
derefr wrote: post #127

Earlier quoted context omitted.

> how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library? You split your project into two components: 1. a new, clean, minimal core with a nice, shiny, new API; and 2. an "OpenSSL emulation layer" that loads your core library, and wraps it in OpenSSL-compatible cruft. It'd be very similar to, say, replacing Direct3D with OpenGL, and then writing a…

it sounds so easy when you break it out like that but it is a considerable investment of time and money. Convincing people to spend either of those on refactoring vs adding new features is a constant battle. No one ever really understands it and typically responds with "you want to go back and do what you already did, just differently?"

Projects like this where it needs urgent attention but it's so horrendously complicated and virtually impossible to get implemented correctly are very hard to commit to. You're going to be in for a world of hurt no matter what you do.

Unless there's an actual federation behind the project that can fund it and keep it stocked with talent and oversight, something Mozilla or Apache could do, it will continue to be an unmitigated disaster.

Re: OpenSSL is written by monkeys (2009)

#182

Post by cratermoon »

OpenSSL is a monoculture. Refactoring it or trying to prettify it would be a waste of time. The right response is to create a completely separate open source project that implements SSL/TLS. The biggest problem that comes to mind is that there are only so many people expert enough to do it right and lots of those people are already on OpenSSL, and produced the mess there. Then there's the adoption curve -- while there are probably quite a few people who'd jump on a better library, there is lots of inertia in the big and important projects.

Re: OpenSSL is written by monkeys (2009)

#183

Post by tinco »

mcv wrote: post #160
tinco wrote: post #155

Earlier quoted context omitted.

So why didn't you?

It's not something I work on. But clearly a lot of other people do. And I have some trouble believing that all those people building stuff on top of OpenSSL don't care about security. Look, if this was about something fairly inconsequential, like a library for a game or a blog or something, sure, use some badly maintained, badly documented, inconsistent library. But when you care enough about security to use SSL, sur…

Why do you not include yourself in the list of people that work on it? Who are these other people that should be working on it? There's only 2 people on the OpenSSL team apparently.

Re: OpenSSL is written by monkeys (2009)

#184

Post by stevehawk »

astrodust wrote: post #181
stevehawk wrote: post #176

Earlier quoted context omitted.

it sounds so easy when you break it out like that but it is a considerable investment of time and money. Convincing people to spend either of those on refactoring vs adding new features is a constant battle. No one ever really understands it and typically responds with "you want to go back and do what you already did, just differently?"

Projects like this where it needs urgent attention but it's so horrendously complicated and virtually impossible to get implemented correctly are very hard to commit to. You're going to be in for a world of hurt no matter what you do. Unless there's an actual federation behind the project that can fund it and keep it stocked with talent and oversight, something Mozilla or Apache could do, it will continue to be an un…

Agreed. In fact, a lot of people are raging on OpenSSL and the OSS community not ever fixing this stuff but.. no one really raged on Apple over their SSL issue. They came out and showed the code and showed the missing curly brace and gave the "accidents happen" excuse but.. why wasn't that caught in unit testing?

The only reason it wouldn't have been caught in unit testing is because Apple isn't unit testing their own SSL code. If Apple doesn't commit to doing security well why do people expect OSS to?

Re: OpenSSL is written by monkeys (2009)

#185

Post by stygiansonic »

agwa wrote: post #19

I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…

Seems like GnuTLS suffers from the same inconsistent error reporting:

http://blog.existentialize.com/the-story-of-the-gnutls-bug.h...

Re: OpenSSL is written by monkeys (2009)

#186

Post by astrodust »

stevehawk wrote: post #184
astrodust wrote: post #181

Earlier quoted context omitted.

Projects like this where it needs urgent attention but it's so horrendously complicated and virtually impossible to get implemented correctly are very hard to commit to. You're going to be in for a world of hurt no matter what you do. Unless there's an actual federation behind the project that can fund it and keep it stocked with talent and oversight, something Mozilla or Apache could do, it will continue to be an un…

Agreed. In fact, a lot of people are raging on OpenSSL and the OSS community not ever fixing this stuff but.. no one really raged on Apple over their SSL issue. They came out and showed the code and showed the missing curly brace and gave the "accidents happen" excuse but.. why wasn't that caught in unit testing? The only reason it wouldn't have been caught in unit testing is because Apple isn't unit testing their ow…

It's because open-source software doesn't have a profit motive. It doesn't have an excuse not to.

People did rage over Apple's SSL issue, but Apple handled it swiftly, pushing out updates to all affected devices as quickly as practical. It's also worth noting it was a validation bug, not something that could leech arbitrary bits of data from a device.

I have no idea how some open-source projects get anything done, their development process is insane, but they manage to hobble along. Something as significant as OpenSSL needs to be held to a higher standard.

If the OpenSSL team can't get their act together, it would be worth it if a larger non-profit organization took the initiative and made a tested, rock-solid implementation of same with an optional compatibility layer.

I've had to integrate with OpenSSL before and the code in there is truly mad. Well written code should be boring and obvious, but OpenSSL is the polar opposite.

Re: OpenSSL is written by monkeys (2009)

#187

Post by betterunix »

bad_user wrote: post #175
betterunix wrote: post #68

Earlier quoted context omitted.

1. Other libraries do exist -- NSS, GnuTLS, etc. 2. Do you have time for a rewrite? What makes you think anyone else would? 3. The (generally correct) mindset is don't implement your own crypto . This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewr…

> The (generally correct) mindset is don't implement your own crypto That sounds like bad advice. The huge impact of Heartbleed is precisely because of the monoculture in SSL/TLS implementations. Shit happens but this vulnerability is such a catastrophe because an estimated half a million of the top Internet websites have been vulnerable since 2012, including popular services that everybody is using and the vulnerabi…

The reason we tell people not to implement their own crypto is that no matter how skilled someone is, no matter what language they program in, it is nearly certain that self-rolled crypto code will have security flaws. Cryptographic security hinges on key, subtle assumptions that are very easy to screw up. World famous cryptographers do not roll their own crypto (except for research code).

When people do implement cryptography they rely on having large numbers of other people review it. That is not a model that scales to having a large number (more than a couple dozen) of competing implementations.

Re: OpenSSL is written by monkeys (2009)

#188

Post by lkd »

ScottWhigham wrote: post #26
hadoukenio wrote: post #10

Earlier quoted context omitted.

There is nothing wrong with self-signed certificates. If you need to trust a website that uses self-signed certificates, just make sure to verify out-of-band.

Yes, I trust my own self-signed certs and I might trust the self-signed certs of certain sites. However, telling me that "There is nothing wrong with self-signed certificates." is irresponsible IMO. Who runs "peereboom.us"? #### if I know. I'm going to tell FF "It's okay - I'm good" this time b/c I'm not doing anything that matters but, as a rule, self-signed certs for unknown sites is not okay.

Self-signed certs are OK in every scenario that HTTP would be OK, and then some.
Post reply on HN