Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

linuxfoundation.org

Post reply on HN
Print view View original

41–50 of 94 posts

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#41

Post by gaadd33 »

tptacek wrote: post #26
kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with w…

Isn't there two sets of money going towards OpenSSL? One set is for hiring 2 full time developers (which seems like the money that should go towards OpenBSD) and then the other set is going to OCAP for a security audit.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#42

Post by sigzero »

tptacek wrote: post #26
kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with w…

I would trust Theo's team over the OpenSSL team any day of the week.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#43

Post by sigzero »

Alupis wrote: post #28
lomnakkus wrote: post #23

Earlier quoted context omitted.

"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: https://www.youtube.com/watch?v=GnBbhXBDmwU

There is no doubt that is the intention. The doubt is whether or not it is a good call to fork openssl instead of attempting to get changes into upstream that fix it and make it better, safer, more reliable.

Are we talking about OpenSSL that had bugs languishing for years? Yeah, good luck with that one. LibreSSL was the way to go and the OpenBSD folks are the ones I trust to do it.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#46

Post by marcosdumay »

tptacek wrote: post #26
kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with w…

A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs.

A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography.

Anyway, they should send money to both. Both are important, and those companies make so much money using free software, they shouldn't be choosing the projects with that fine granularity. The problem is that they won't, and as much as kyledrake does not like the answer, it's because of Theo. Yes, it's a stupid decision, but it does not make it less real.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#47

Post by Alupis »

chrismonsanto wrote: post #30
Alupis wrote: post #27

Earlier quoted context omitted.

> You can't start fixing things in other peoples' source tree just like that. Yes, you can. It's called contributing to a project. If the "half million lines of diffs" were actually things needing fixing, then the upstream team would accept them. If they are not necessary changes (such as ripping out all windows compatibility), then no, they would reject such changes. It will take years, maybe a decade before a new s…

> Yes, you can. It's called contributing to a project. If the "half million lines of diffs" were actually things needing fixing, then the upstream team would accept them. If they are not necessary changes (such as ripping out all windows compatibility), then no, they would reject such changes. I take it you've never dealt with an inactive/apathetic upstream before? Just because someone is the steward of a project doe…

Then you become the steward of the project and continue forward. Forking will introduce an untold number of new bugs, some of which may be worse than imagined. Right now, native libressl only works on bsd's, when openssl codebase works on many os's. There are ports being made, which will introduce more bugs.

Bugs being in a tracker for years is not uncommon.

Here's OpenSSH's tracker:

https://bugzilla.mindrot.org/buglist.cgi?bug_status=__open__...

331 bugs, a large majority of which are pre 2012.

This is not a sign of inactive/apathetic developers. It's a sign of big and old projects.

I have no doubt the OpenBSD folk are excited about this now... but 5 years from now? More? What's the long term viability of this project? Will they eventually put all OS's on an equal footing instead of *BSD's first and port to other OS's?

Forking was not the answer. The answer was to fix the perceived problems in OpenSSL and make it as solid as it can be. It's splitting talent and resources unnecessarily. Especially when the two projects are under the same umbrella (OpenBSD Foundation).

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#48

Post by Hoff »

jimktrains2 wrote: post #18
wmf wrote: post #17

Earlier quoted context omitted.

Is the OpenSSL developers willing to drop support for 16 bit Windows or OpenVMS? They either need to properly maintain it or drop it, and they don't have enough money to maintain it.

I just want to know who's still compiling against 16bit windows or OpenVMS. I know my world view isn't infinite, but those systems seem a bit out there.

Yes, there are OpenVMS servers still around. I work with a number of them, and with various folks that are still using them in production.

There are recent builds of OpenSSL for OpenVMS:

http://polarhome.com/openssl/ http://www.openvms.org/stories.php?story=14/04/11/6422157

HP's version is a bit older:

http://h71000.www7.hp.com/openvms/products/ssl/ssl.html

Free OpenVMS accounts:

http://deathrow.vistech.net http://decuserve.org

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#49

Post by mprovost »

joealba wrote: post #15

What about BIND for DNS?

The DNS ecosystem is much more diverse. djbdns is considered to be the most secure, and there are a few other quality implementations. The root servers, for example, run a mixture of BIND and NSD, so no single bug can affect all of them.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#50

Post by Already__Taken »

dfc wrote: post #32
Florin_Andrei wrote: post #9

Earlier quoted context omitted.

> And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. Yeah, but people who give money usually tend to see that as a valid reason.

Theo's "outspokeness" is believed to be the reason that DARPA canceled a million dollar development grant. https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_ca...

That reads less like Theo being a dick and more like the US making a farce of free speech in that instance.
Post reply on HN