Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL Project Roadmap

openssl.org

Post reply on HN
Print view View original

21–30 of 31 posts

Re: OpenSSL Project Roadmap

#21

Post by yellowapple »

maximumoverload wrote: post #16
snvzz wrote: post #8

I don't expect much to come from rewarding failure. Throwing money away at OpenSSL isn't suddenly gonna make its developers good. I'll be running LibReSSL, and I expect most Linux distributions to do the same by default once the Linux port is released.

LibreSSL is yet very experimental and OpenBSD-focused. Which is not wrong, but I wouldn't say it's right now well-baked for inclusion in major Linux distributions.

It's also a couple of months old. Give it a year's time (or half that, even) and that possibility of a proper non-OpenBSD *nix port will be that much more likely.

Re: OpenSSL Project Roadmap

#22

Post by erichurkman »

I don't understand why a code review system has to take 3 to 6 months. That seems backwards to me: it should be the first step to improving the project. Every one of the changes listed in the roadmap should be reviewed and signed off by at least one other peer in the project.

Re: OpenSSL Project Roadmap

#23

Post by tedunangst »

Sounds good to me. If followed through, OpenSSL and libressl portable could possibly converge on practically identical code bases.

It is a little weird though that it's almost the libressl game plan, verbatim. It could literally just say "do whatever libressl" does.

Some of the specifics, like memory management is dangerous, fips code is tangly, win16 support is obsolete, seem a little too familiar. We haven't really tried to make an exhaustive list of issues to fix in libressl. I know there are things we haven't looked at yet. But for the OpenSSL roadmap to match 100% our public work is weird. They haven't found anything to fix that we've overlooked?

Also, there are definitely some problems in OpenSSL that we've identified, but haven't talked about. I'd expect any independent review/roadmap planning to identify them. They're missing from this list.

Re: OpenSSL Project Roadmap

#24

Post by lockes5hadow »

erichurkman wrote: post #22

I don't understand why a code review system has to take 3 to 6 months. That seems backwards to me: it should be the first step to improving the project. Every one of the changes listed in the roadmap should be reviewed and signed off by at least one other peer in the project.

They need to recruit more people to make it possible i guess? I don't know I agree with you. Its absurd to have a project of this scale without code review.

Re: OpenSSL Project Roadmap

#25

Post by akjj »

tedunangst wrote: post #23

Sounds good to me. If followed through, OpenSSL and libressl portable could possibly converge on practically identical code bases. It is a little weird though that it's almost the libressl game plan, verbatim. It could literally just say "do whatever libressl" does. Some of the specifics, like memory management is dangerous, fips code is tangly, win16 support is obsolete, seem a little too familiar. We haven't really…

Sounds like OpenSSL is keeping FIPS in a refactored form and LibreSSL is getting rid of it.

Re: OpenSSL Project Roadmap

#26

Post by lttlrck »

leccine wrote: post #20
wfjackson wrote: post #13

Earlier quoted context omitted.

There are different degrees of failure. Expecting someone to work for free for you(you as in all the big and small companies making a ton of money) while not inspecting the code for bugs is one of them. Blaming the resource constrained developers accomplishes nothing.

I never asked any OpenSSL guys to work for free for me. Btw. I am contributing to FOSS projects before you are accusing me that I never done anything to the community. I totally understand the responsibilities of open source developers. Having software that supposed to provide security is a huge responsibility and in those projects following best practices (not re-implementing malloc badly, etc.) is insanely importan…

Where did he accuse you?

Re: OpenSSL Project Roadmap

#27

Post by hsivonen »

snvzz wrote: post #8

I don't expect much to come from rewarding failure. Throwing money away at OpenSSL isn't suddenly gonna make its developers good. I'll be running LibReSSL, and I expect most Linux distributions to do the same by default once the Linux port is released.

I expect Debian and its derivatives to offer LibreSSL eventually. There is interest and no good reason not to.

However, I expect Fedora and its derivatives to stick with openssl-fips. Red Hat makes a big deal of FIPS due to selling to customers who are subject to the FIPS bureaucracy. :-(

Re: OpenSSL Project Roadmap

#28

Post by pdw »

anaphor wrote: post #17
maximumoverload wrote: post #16

Earlier quoted context omitted.

LibreSSL is yet very experimental and OpenBSD-focused. Which is not wrong, but I wouldn't say it's right now well-baked for inclusion in major Linux distributions.

You're vastly overstating the difficulty in porting LibreSSL. It's 99% POSIX standard use of APIs and modern portable C except for a few security related functions they use that are non-standard such as explicit_bzero, reallocarray, and strlcpy.

Not everything is as easy to port as strlcpy... Implementing a correct arc4random on Linux is quite non-trivial

Re: OpenSSL Project Roadmap

#29

Post by cnst »

viraptor wrote: post #15
cnst wrote: post #9

Earlier quoted context omitted.

Yes. It's also funny that if you look at each of the 8 points identified in the posted link, they're like all have already been identified and many have already been fixed in LibReSSL. Why use OpenSSL, if LibReSSL already has had a head start on each issue? And OpenSSL probably doesn't even intend to address some of these, like removal of FIPS support.

Can they remove FIPS at all? Big distributions will certainly want to (have to) offer the FIPS-capable version to some of their customers. I imagine it would cause some serious overtime at RedHat for a number of weeks (months?) if OpenSSL decided to drop FIPS completely.

If RedHat or Oracle needs FIPS, they should be the ones who are supporting it, not the rest of the unpaid open-source volunteers.

I'm pretty sure that OpenBSD, Debian, Slackware, Arch Linux and many others don't care about supporting some insecure and obscure government standards.

In fact, FIPS was removed from LibReSSL in OpenBSD due to being unmaintained and insecure.

Re: OpenSSL Project Roadmap

#30

Post by leccine »

lttlrck wrote: post #26
leccine wrote: post #20

Earlier quoted context omitted.

I never asked any OpenSSL guys to work for free for me. Btw. I am contributing to FOSS projects before you are accusing me that I never done anything to the community. I totally understand the responsibilities of open source developers. Having software that supposed to provide security is a huge responsibility and in those projects following best practices (not re-implementing malloc badly, etc.) is insanely importan…

Where did he accuse you?

"before you are accusing"

English is hard man, I know.

Post reply on HN