How compatible is LibreSSL? • Hacker News Board

Re: How compatible is LibreSSL?

#21

Post by anaphor » Sat, Jul 12, 2014, 5:21 PM UTC

keeperofdakeys wrote: post #18

anaphor wrote: post #16

Earlier quoted context omitted.

I still don't see the problem, warnings usually indicate problems with the code, even if that particular sort of warning was added in a new version of the cc. If they don't indicate actual problems then the compiler is broken, but I still don't think that's a problem since they can usually be silenced in some non-intrusive way. Also you shouldn't be trying to build software if you don't know how to report a bug or ha…

Compiler warnings can come down to things that are purely style, like unused variables. It's more than likely that an unused variable could sneak itself into a program, not be found for a few years, then suddenly trigger a warning when a compiler added the check (of course, compilers have been checking for this for a long time, but this is just an example). In the case of Gentoo, this would manifest itself as package…

Sorry, I still don't believe that's a problem. Unused variable warnings can be silenced easily if they aren't real bugs (for example an unused parameter in a callback). Most people don't have to deal with this stuff because they use precompiled binaries. The people that do deal with this should know how to fix it properly.

Re: How compatible is LibreSSL?

#22

Post by currysausage » Sat, Jul 12, 2014, 5:22 PM UTC

ayrx wrote: post #19

currysausage wrote: post #17

I'm more than surprised about the hostile tone some contributors seem to use when they talk about LibreSSL lately. LibreSSL is an OpenSSL fork done by the OpenBSD team primarily because they don't think OpenSSL is the right software to include in their OS. That's their decision, if you don't use OpenBSD, you don't have to care. They have done an insane amout of work in pretty short time, and since that work might ben…

So in your view people with valid criticisms should just shut up and be thankful? All the points in the blog posts are real problems. Pointing them out just means that fixes can be made and software can be improved.

> So in your view people with valid criticisms should just shut up and be thankful?

No, sober problem reports (preferably sent to bugs@openbsd.org or openbsd-tech) are obviously exactly what the preview release is meant for.

As I wrote, I am surprised about the tone. Not of any particular comment or blogpost, but there's a tendency that I perceive lately.

Re: How compatible is LibreSSL?

#23

Post by pygy_ » Sat, Jul 12, 2014, 5:25 PM UTC

currysausage wrote: post #17

I'm more than surprised about the hostile tone some contributors seem to use when they talk about LibreSSL lately. LibreSSL is an OpenSSL fork done by the OpenBSD team primarily because they don't think OpenSSL is the right software to include in their OS. That's their decision, if you don't use OpenBSD, you don't have to care. They have done an insane amout of work in pretty short time, and since that work might ben…

The OpenBSD folks have set the tone. They are arrogant and dismissive, it's not surprising other people respond in kind.

Re: How compatible is LibreSSL?

#24

Post by joshbaptiste » Sat, Jul 12, 2014, 5:31 PM UTC

currysausage wrote: post #22

ayrx wrote: post #19

Earlier quoted context omitted.

So in your view people with valid criticisms should just shut up and be thankful? All the points in the blog posts are real problems. Pointing them out just means that fixes can be made and software can be improved.

> So in your view people with valid criticisms should just shut up and be thankful? No, sober problem reports (preferably sent to bugs@openbsd.org or openbsd-tech) are obviously exactly what the preview release is meant for. As I wrote, I am surprised about the tone. Not of any particular comment or blogpost, but there's a tendency that I perceive lately.

I didn't take the tone as condescending at all. It really was (as I read it) constructive criticism for the portability maintainers.

Re: How compatible is LibreSSL?

#25

Post by anon1385 » Sat, Jul 12, 2014, 5:32 PM UTC

currysausage wrote: post #22

ayrx wrote: post #19

Earlier quoted context omitted.

So in your view people with valid criticisms should just shut up and be thankful? All the points in the blog posts are real problems. Pointing them out just means that fixes can be made and software can be improved.

> So in your view people with valid criticisms should just shut up and be thankful? No, sober problem reports (preferably sent to bugs@openbsd.org or openbsd-tech) are obviously exactly what the preview release is meant for. As I wrote, I am surprised about the tone. Not of any particular comment or blogpost, but there's a tendency that I perceive lately.

You are upset that people are using the wrong tone to make criticisms of OpenBSD? The same OpenBSD run by Theo de Raadt?

You reap what you sow, as they say.

Re: How compatible is LibreSSL?

#26

Post by comex » Sat, Jul 12, 2014, 5:38 PM UTC

anaphor wrote: post #21

keeperofdakeys wrote: post #18

Earlier quoted context omitted.

Compiler warnings can come down to things that are purely style, like unused variables. It's more than likely that an unused variable could sneak itself into a program, not be found for a few years, then suddenly trigger a warning when a compiler added the check (of course, compilers have been checking for this for a long time, but this is just an example). In the case of Gentoo, this would manifest itself as package…

Sorry, I still don't believe that's a problem. Unused variable warnings can be silenced easily if they aren't real bugs (for example an unused parameter in a callback). Most people don't have to deal with this stuff because they use precompiled binaries. The people that do deal with this should know how to fix it properly.

It's already necessary far too much of the time to manually back and slash C code to get it to build in an untested or newer environment, without adding additional cases over purely stylistic compiler complaints. Precompiled binaries aren't available for every system for which one might want to use portable software.

Re: How compatible is LibreSSL?

#27

Post by clarry » Sat, Jul 12, 2014, 5:40 PM UTC

throwaway2048 wrote: post #10

tedunangst wrote: post #3

so if the libressl developers rip out all their dubious entropy generation methods in favor of /dev/urandom on linux it might be well worth switching to it. /dev/urandom is the favored entropy gathering method. But if you can't open it (not there, rlimit restriction, etc.) it falls back to the bobo code. If the linux kernel provided a random number source that was reliable and could not fail, this wouldn't be an issu…

Was this not one of the things you critisized openssl for? ie falling back on braindead methods when sane ones failed.

If you don't try to cope with the lack of a /dev/random, you get shit from people. If you try to cope with it, you get shit from people. While I would agree that the fallback entropy gathering is very very hacky and ugly, the difference is that it sure as hell tries harder than OpenSSL ever did. I'm not qualified to say whether the things it uses for entropy are truly any good for it, but it sure looks like it wouldn't be terribly easy to predict all these bits without having compromised the system.

Re: How compatible is LibreSSL?

#28

Post by two_cents_4u » Sat, Jul 12, 2014, 5:41 PM UTC

pygy_ wrote: post #23

currysausage wrote: post #17

I'm more than surprised about the hostile tone some contributors seem to use when they talk about LibreSSL lately. LibreSSL is an OpenSSL fork done by the OpenBSD team primarily because they don't think OpenSSL is the right software to include in their OS. That's their decision, if you don't use OpenBSD, you don't have to care. They have done an insane amout of work in pretty short time, and since that work might ben…

The OpenBSD folks have set the tone. They are arrogant and dismissive, it's not surprising other people respond in kind.

Here's ten cents - call someone who cares!

Re: How compatible is LibreSSL?

#29

Post by [deleted] » Sat, Jul 12, 2014, 5:44 PM UTC

ploxiln wrote: post #20

gnuvince wrote: post #2

> -Werror is hardcoded in the configure script, which is a very bad idea, and the opposite of portable. using -Werror is a guarantueed build break whenever the build is tried on a system the original developer had no access to. I think that is exactly the point; if the thing does not build, people are going to complain loudly and things are going to get fixed. Warnings are usually just run-time problems waiting to ha…

C is not the same as other languages. Many possible errors reported by the compiler really are not bugs. You've probably heard of "-Wall" and "-Wextra". Why does -Wextra include even more warnings than -Wall? Because they're more likely to include truly spurious warnings. C is both more simple and more flexible than other languages, and it's very hard for the compiler to tell when the code does something the writer d…

[deleted]

Re: How compatible is LibreSSL?

#30

Post by two_cents_4u » Sat, Jul 12, 2014, 5:44 PM UTC

ayrx wrote: post #19

currysausage wrote: post #17

I'm more than surprised about the hostile tone some contributors seem to use when they talk about LibreSSL lately. LibreSSL is an OpenSSL fork done by the OpenBSD team primarily because they don't think OpenSSL is the right software to include in their OS. That's their decision, if you don't use OpenBSD, you don't have to care. They have done an insane amout of work in pretty short time, and since that work might ben…

So in your view people with valid criticisms should just shut up and be thankful? All the points in the blog posts are real problems. Pointing them out just means that fixes can be made and software can be improved.

Don't think anyone said that. Detailed, constructive feedback is always appreciated.

On the other hand, when using free software from other people, it does seem a little rude to demand anything from them. Kind of like "gee, thanks for the free cake, but I prefer my icing on the side, waahhhh sob sob sob [ throws toys from the pram ]"