OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative • Hacker News Board

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#81

Post by InclinedPlane » Fri, May 30, 2014, 10:57 AM UTC

tptacek wrote: post #26

kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with w…

I get what you're saying. But I think this is a case where simplification and rewrites is going to greatly enhance the ability to effectively audit the code. I will trust LibreSSL audits about a hojillion times more than OpenSSL audits at this point, just down to code complexity and surface area alone.

And there is no question about it they absolutely will introduce new bugs. But hopefully the increased scrutiny and easier to read code means that they are less likely to have extremely bad bugs latent in the codebase for years without anyone noticing, as has been the case with OpenSSL.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#82

Post by InclinedPlane » Fri, May 30, 2014, 11:03 AM UTC

tptacek wrote: post #53

marcosdumay wrote: post #46

Earlier quoted context omitted.

A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs. A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography. Anyway, they should send money to both. Both are important, and those companies make so much money using free soft…

Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL, which isn't even complete, the virtues of auditing the OpenSSL codebase seem pretty straightforward to me. How much have you donated to open audit projects? I've donated a bit, and I would be pissed to find out that my money was redirected from an audit to a rewrite. I am not in the least bit interested in the Theo vs. Whoever dra…

> Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL

You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago?

Moreover, the biggest problem sits with the biggest, and often most capable, internet companies. So having a reasonable path for them to a more secure TLS implementation, even if it meant hand rolling their own packages or building from source, is potentially a big win for the internet in general.

And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager.

The fact is that this industry has a track record of keeping up to date technologically. This isn't some corporate IT in the industry gulag saddled with bullshit LoB apps that depend on IE6 in perpetuity. We're talking about the most capable and savvy tech companies in the world. If there's a better option to be had, it'll see high adoption rates.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#83

Post by Xylakant » Fri, May 30, 2014, 11:42 AM UTC

InclinedPlane wrote: post #82

tptacek wrote: post #53

Earlier quoted context omitted.

Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL, which isn't even complete, the virtues of auditing the OpenSSL codebase seem pretty straightforward to me. How much have you donated to open audit projects? I've donated a bit, and I would be pissed to find out that my money was redirected from an audit to a rewrite. I am not in the least bit interested in the Theo vs. Whoever dra…

> Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago? Moreover, the biggest problem sits with the biggest, and often most capable, internet companies. So having a reasonable path for them to a more secure TLS implementation, even if it meant h…

> You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago?

How many years did it take to get there? How many servers are still running apache?

> And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager.

Eventually, maybe. That's no reason not to audit openssl right now, that people cannot switch - especially the ones that use platforms that the OpenBSD team decided to remove support for.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#84

Post by krunaldo » Fri, May 30, 2014, 12:14 PM UTC

Alupis wrote: post #47

chrismonsanto wrote: post #30

Earlier quoted context omitted.

> Yes, you can. It's called contributing to a project. If the "half million lines of diffs" were actually things needing fixing, then the upstream team would accept them. If they are not necessary changes (such as ripping out all windows compatibility), then no, they would reject such changes. I take it you've never dealt with an inactive/apathetic upstream before? Just because someone is the steward of a project doe…

Then you become the steward of the project and continue forward. Forking will introduce an untold number of new bugs, some of which may be worse than imagined. Right now, native libressl only works on bsd's, when openssl codebase works on many os's. There are ports being made, which will introduce more bugs. Bugs being in a tracker for years is not uncommon. Here's OpenSSH's tracker: https://bugzilla.mindrot.org/bugl…

Most of these are related to portable openssh and not openssh. These are two very different teams.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#85

Post by vidarh » Fri, May 30, 2014, 1:05 PM UTC

pessimizer wrote: post #13

Touche wrote: post #8

Earlier quoted context omitted.

Actually if I'm giving someone a donation, charity, then whether they are or are not a dick is a perfectly valid part of the decision. And to me how you run a project is as important as the quality of the final result.

You don't have to have a reason to not donate to something, so the color of their shoes is also a perfectly valid part of the decision. The important question is whether it's a good reason. If you rank the style of his speech as a more important issue than having secure software (unless you think that the style of speech will negatively effect the software), I'd wonder how a single person's personality got so high on…

If you think that Theo's abrasiveness will affect the success of LibreSSL as a project, then it is is relevant.

It is naive and shortsighted to dismiss non-technical reasons. Often they can be as important as the technical reasons, or even more.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#86

Post by vidarh » Fri, May 30, 2014, 1:07 PM UTC

tux wrote: post #60

Having "Huawei" as one of the backers does not create confidance. Recent news shows that they had there hardware backdoored. https://duckduckgo.com/?kh=1&q=Huawei&sites=www.schneier.com...

How is the NSA's ability to backdoor Huawei hardware relevant for Huawei's ability to provide money to help fund audits?

Presumably, the NSA hacking is a reason for Huawei to start caring a great deal more about investing in security.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#87

Post by protomyth » Fri, May 30, 2014, 2:17 PM UTC

gonzo wrote: post #75

protomyth wrote: post #54

Earlier quoted context omitted.

Its one and the same, plus if you care about LibreSSL and OpenSSH than you need to care about OpenBSD because of the assumptions that code makes and what needs to added to the ported code to make it safe on other platforms.

Horse feathers. Consider that ntp.org is being funded, not OpenBSD (and their inferior OpenNTP). NTP is infrastructure. OpenBSD is not. Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project). OpenSSL is infrastructure. OpenSSH got some funding, because it is widely used. It is infrastructure , not 3-5 people scratching an itch in a project.

> Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project).

> OpenSSH got some funding, because it is widely used. It is infrastructure, not 3-5 people scratching an itch in a project.

I'm not sure what to say as I think you missed my point by a mile. Giving money to OpenSSH or LibreSSL is giving money to OpenBSD, it is the same people and same foundation.

OpenSSH and, now, LibreSSL are project written to OpenBSD first and then ported. Ported platforms that don't have the libraries these projects expect (which are developed for OpenBSD) have those functions ported[1]. They are the same project with parts ported to other platforms.

I have no clue what the 3-5 people comment is even about.

1) with some exceptions such as generation of entropy since only the OS can do that well.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#88

Post by throwaway7767 » Fri, May 30, 2014, 2:30 PM UTC

davidgerard wrote: post #57

Florin_Andrei wrote: post #9

Earlier quoted context omitted.

> And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. Yeah, but people who give money usually tend to see that as a valid reason.

I think you mean "excuse". Anyone who's ever attempted to sell anything will tell you of customers who say "I would buy it if only you turned it upside-down and painted it blue" but don't cough up when you do. Similarly, every single person reading this uses SSH daily but will go "ah, uh, but Theo's a dick!" as their excuse not to cough up.

The reason I don't contribute to OpenSSH is because it is impossible to do so directly. I have no way to know how much, if any, of my contribution goes to OpenSSH when I have to donate to "the OpenBSD foundation".

If you feel better convincing yourself that this is not the case, feel free. But it is still a fact, and I do contribute financially to a lot of other projects.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#89

Post by talideon » Fri, May 30, 2014, 3:00 PM UTC

tptacek wrote: post #26

kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with w…

True, but many of the things OpenBSD are doing to their fork are making automated capture of errors easier. Their work getting rid of the layers of crud around the OS memory allocator alone mean that tools like valgrind and other profilers now have a fighting chance of actually being useful.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#90

Post by danudey » Fri, May 30, 2014, 6:04 PM UTC

gonzo wrote: post #74

tptacek wrote: post #72

Earlier quoted context omitted.

In the context of a funded audit, this is about as meaningful to me as the complaint that OpenSSL is insecure because it's written in C --- which is also true.

Consider that OpenSSL is able to look at libressl and choose the good parts, preserving interoperability (.vs openbsd only). The reasons to fund the audit, and two full time devs, are clear.

Except that the 'good parts' of LibreSSL consist largely of two things:

1. Removing a ton of broken, obsolete, or poorly-designed code 2. Fixing bugs and incorporating fixes from the official OpenSSL bug tracker

In short, the 'good parts' of LibreSSL are a team of people willing to devote significant time and effort to making the OpenSSL codebase secure, clean, portable, and trustworthy. That's something that the OpenSSL devs either didn't have the time or energy to do.

As for interoperability: OpenBSD's process has always been to write a single core with a single target (OpenBSD) and then to have a separate team take care of platform-specific issues. This allows the team doing security work on LibreSSL/OpenSSH to focus on the results by writing a single implementation, and the porting team can spend their time porting that implementation to other platforms (rather than having someone implement functionality while trying to be aware of how each platform handles things).

It's worked well for OpenSSH so far, so I don't see a problem with using the same pattern for LibreSSL.