Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD forks, prunes, fixes OpenSSL

zdnet.com

Post reply on HN
Print view View original

31–40 of 58 posts

Re: OpenBSD forks, prunes, fixes OpenSSL

#31

Post by nathanvanfleet »

Eyas wrote: post #19

A quote in there says that customers don't care for FIPS support. I hope OpenBSD is not planning on dropping FIPS support from LibreSSL -- it seems like that would be a huge mistake. Government agencies are among the many that are open to SSL vulnerabilities. Our tax, financial, SSN, and healthcare information are all open to vulnerabilities in buggy code. Dropping FIPS support means that government agencies whose se…

I wonder about if the NSA, who was supposedly aware of the bugs (and likely others), had to leave other US gov agencies open to the exploits because they would otherwise blow their cover? Or might they have had internal custom OpenSSL (or just didn't use OpenSSL)?

Re: OpenBSD forks, prunes, fixes OpenSSL

#32

Post by ahknight »

jmspring wrote: post #26

Somehow, I don't see removing FIPS or Windows support being in the best interest of the community as a whole. For startups wanting to have a product that requires some level of FIPS support, starting with a decent base makes things easier. Windows support? There are more than a couple of applications out there running on Windows that make use of OpenSSL. Theo's quote -- "99.99% of the community does not care for VMS…

He does.

Re: OpenBSD forks, prunes, fixes OpenSSL

#33

Post by uuid_to_string »

AceJohnny2 wrote: post #12
leccine wrote: post #9

OpenSSL is beyond repair. We need a new clean start, sane design and rock solid implementation with principles and following best practices.

Like NaCl? http://nacl.cr.yp.to/

For per packet encryption.

For authentication, there is CurveCP.

People seem confident with OpenSSH's authentication mechanism. Why not use that?

At some point one has to trust that the IP address one is sending/retrieving data to/from is the correct one. That's easier said than done if some host wants to keep changing its IP address every few days.

The SSL PKI scheme (the SSL approach to authentication), as implemented for public websites, is not much of a confidence-builder, IMO. Opinions may differ.

If websites maintained consistent IP addresses and we could authenticate these machines using OpenSSH keys, I would be more willing to believe we could verify their "authenticity".

Re: OpenBSD forks, prunes, fixes OpenSSL

#34

Post by ahknight »

jmspring wrote: post #28
tedivm wrote: post #18

> Some of that is indentation, because we are trying to make the code more comprehensible. 99.99% of the community does not care for VMS support, and 98% do not care for Windows support. They care for POSIX support, so that the Unix and Unix derivatives can run. Do they not realize that clients also need SSL support? Servers that don't have anyone to talk to them are kind of useless, so at best this is half of soluti…

Ack - looks like I posted something quite similar. Maybe Theo is thinking only about the "OpenBSD community".

Yes. This is an OpenBSD fork. It will run on OpenBSD.

That said, later on folks can create compatibility layers (like OpenSSH) to make it work elsewhere. It's better to keep that code outside the core anyway.

Re: OpenBSD forks, prunes, fixes OpenSSL

#35

Post by jeffdavis »

Touche wrote: post #23
bla2 wrote: post #10

It's cool they're doing this cleanup, but overly self-righteous commit messages ( http://opensslrampage.org/ ) on patches like http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/cry... rub me the wrong way (I'm sure comparing a string pointer to '5' / decimal 53 is _exactly_ what the old, ridiculed code meant to do…)

This is why I would never use OpenBSD (but yeah, I use OpenSSH). Can't use an OS for people with this type of attitude.

Linus is generally not gentle when rejecting an idea either. You might run out of OSes pretty soon ;-)

Re: OpenBSD forks, prunes, fixes OpenSSL

#36

Post by maaku »

jmspring wrote: post #26

Somehow, I don't see removing FIPS or Windows support being in the best interest of the community as a whole. For startups wanting to have a product that requires some level of FIPS support, starting with a decent base makes things easier. Windows support? There are more than a couple of applications out there running on Windows that make use of OpenSSL. Theo's quote -- "99.99% of the community does not care for VMS…

Except, for example, FIPS support mandates availability of operating modes which are broken by design.

Re: OpenBSD forks, prunes, fixes OpenSSL

#37

Post by djmdjm »

leccine wrote: post #9

OpenSSL is beyond repair. We need a new clean start, sane design and rock solid implementation with principles and following best practices.

So far, two of the clean starts (Apple's and GnuTLS) are known for the critical "goto fail" bugs. How would your clean start be different?

Re: OpenBSD forks, prunes, fixes OpenSSL

#38

Post by jmspring »

maaku wrote: post #36
jmspring wrote: post #26

Somehow, I don't see removing FIPS or Windows support being in the best interest of the community as a whole. For startups wanting to have a product that requires some level of FIPS support, starting with a decent base makes things easier. Windows support? There are more than a couple of applications out there running on Windows that make use of OpenSSL. Theo's quote -- "99.99% of the community does not care for VMS…

Except, for example, FIPS support mandates availability of operating modes which are broken by design.

There are ways of crafting the software that could make sure the broken operating modes aren't necessarily part of the FIPS build profile.

More than one company I have worked at built on top of OpenSSL and went for FIPS compliance. Sometimes, if you want to be able to qualify for contracts that require things like FIPS, building off a base is better than starting from complete scratch.

Re: OpenBSD forks, prunes, fixes OpenSSL

#39

Post by jmspring »

ahknight wrote: post #34
jmspring wrote: post #28

Earlier quoted context omitted.

Ack - looks like I posted something quite similar. Maybe Theo is thinking only about the "OpenBSD community".

Yes. This is an OpenBSD fork. It will run on OpenBSD. That said, later on folks can create compatibility layers (like OpenSSH) to make it work elsewhere. It's better to keep that code outside the core anyway.

I don't necessarily disagree with the changes, overall. I think there would be a benefit from both companies and projects that leverage OpenSSL to have contributed back to it both in terms of $ as well as change sets to make it better instead of another fork of a library.

(I realize the issues previously expressed about the state of change within the OpenSSL project, as well as the lack of general give back from the many people that use it).

Re: OpenBSD forks, prunes, fixes OpenSSL

#40

Post by tobiasu »

Eyas wrote: post #19

A quote in there says that customers don't care for FIPS support. I hope OpenBSD is not planning on dropping FIPS support from LibreSSL -- it seems like that would be a huge mistake. Government agencies are among the many that are open to SSL vulnerabilities. Our tax, financial, SSN, and healthcare information are all open to vulnerabilities in buggy code. Dropping FIPS support means that government agencies whose se…

Since when does OpenBSD (a Canadian project with a developer group all over the planet) need to care about some certification and standard bullshit by the government of the United States of America?

What have the USA done for us lately? Oh yes, fought a long battle against cryptography in the hands of world citizens, spied on everyone and their dog, canceled OpenBSD funding, started multiple illegal wars and threatened every single country into submission (except for the one with nukes pointed at the White House).

Does it get any more selfish? Bah.

Post reply on HN