Ask HN: Negative OpenSSL sentiments

#1

Post by aggresswift » Sat, Apr 12, 2014, 10:41 AM UTC

While I admit that the recent Heartbleed security issue is a critical issue, I am getting perpetually flummoxed by the 'I have the moral high ground' negative comments being thrown at the OpenSSL project & developers. Innumerable blogs and HN threads are taking the stand of 'how could they commit something like that', 'How idiotic was the committer', 'OpenSSL should not use a custom wrapper around malloc' and even taking personal shots at the two gentlemen who were referenced in the code.

Mistakes were made in code and processes, mistakes will continue to be made in code. What we need is: * A formal code review tool. I don't know whether there's something like review-board for OpenSSL commits. * Donations to the OpenSSL foundation. C'mon folks, practically all your online security depends on OpenSSL (Cisco, Juniper, Extreme, Huawei, Google, Yahoo, Wikipedia: I am looking at you). A bit of money back to OpenSSL (and OpenSSH + friends) would go a long way. Personally, I think these tools ought to be getting way more than Wikimedia (Just my two cents) * More eyes on the code. Whether it's refactoring the code, formal code audits or full time employees from the fortune 500 companies. * You to commit. This is an open project. 20/20 retrospective bashing does no one favours[1]. If you really feel strongly about something, get a patch out then start yammering about it. * A security mailing list. Something similar to xen-security-announce. That way, major vendors, cloud providers, OS & distributions can get fixes baked by the time the general alarm is sent.

1.http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse

Re: Ask HN: Negative OpenSSL sentiments

#2

Post by aggresswift » Sat, Apr 12, 2014, 10:46 AM UTC

And here's a list of high profile web services hist by the bug: http://hackingnews.com/vulnerability/heartbleed-hit-list-aff...

Re: Ask HN: Negative OpenSSL sentiments

#3

Post by mariuolo » Sat, Apr 12, 2014, 11:49 AM UTC

If anything I'm pissed at large companies relying on a piece of software that's barely funded.

Re: Ask HN: Negative OpenSSL sentiments

#4

Post by abhn » Sat, Apr 12, 2014, 12:37 PM UTC

Crypto is complicated and very hard to do well. Hell, any complex software is hard to do well. There will always, always be bugs. While I am pissed off with so much moaning, and do agree they should be better funded, I think it is more the case of sensationalist blogging taking control of the narrative. Rather than "Booo OpenSSL" we should focus on recovering and raising awareness of the projects we all rely on every day.

Re: Ask HN: Negative OpenSSL sentiments

#5

Post by amalag » Sat, Apr 12, 2014, 12:37 PM UTC

mariuolo wrote: post #3

If anything I'm pissed at large companies relying on a piece of software that's barely funded.

Especially large networking gear whose business is dependent on it. I am less pissed at a website using OpenSSL. Funding from the hardware companies would probably have prevented this issue.

Re: Ask HN: Negative OpenSSL sentiments

#6

Post by octatone2 » Sat, Apr 12, 2014, 12:37 PM UTC

aggresswift wrote: post #2

And here's a list of high profile web services hist by the bug: http://hackingnews.com/vulnerability/heartbleed-hit-list-aff...

That's a very, very limited list of websites. It would be safer to assume that you need to reset your passwords, revoke access keys, for ALL websites you have credentials or keys on. However you should not do so until those websites have made a statement verifying that they have both patched, AND revoked their SSL certs.

Re: Ask HN: Negative OpenSSL sentiments

#7

Post by oskarth » Sat, Apr 12, 2014, 12:41 PM UTC

Couldn't agree more. Heuristic to use when someone is bashing someone else's code:

Have you contributed (money, code, docs) to the project?

If the answer is no: person lacking skin in the game - irrelevant (even harmful) armchair comment.

Re: Ask HN: Negative OpenSSL sentiments

#8

Post by notacoward » Sat, Apr 12, 2014, 12:48 PM UTC

I've tried not to be too critical of the developers, but I do understand where some of the negativity comes from. Have you ever tried to use OpenSSL, as a developer? It's kind of a crufty mess.

* Initialization is even more complicated than the security needs dictate, and so is everything afterward.

* The internal abstractions are leaky, e.g. requiring a poll for read before you can write (and vice versa), because of the way handshakes are implemented.

* The normal error reporting is awful, so you must add extra code to get useful information.

* The documentation is terrible. It's hard to find what you need to know just to write your code, then hard to find information about the "idiosyncratic" command-line tools to test it. Want to know if your certificate code actually works? Have fun fighting theirs to find out.

A lot of people have felt forced to use OpenSSL because it was the de facto standard, or because NSS and GnuTLS were even worse (especially in terms of documentation). That leads to resentment, which has been just waiting for an outlet like this. I'm not saying it's right. I completely empathize with the plight of an under-resourced development team who could use some more help in some difficult areas. All I'm saying is that it's understandable.

Re: Ask HN: Negative OpenSSL sentiments

#9

Post by aggresswift » Sat, Apr 12, 2014, 12:55 PM UTC

abhn wrote: post #4

Crypto is complicated and very hard to do well. Hell, any complex software is hard to do well. There will always, always be bugs. While I am pissed off with so much moaning, and do agree they should be better funded, I think it is more the case of sensationalist blogging taking control of the narrative. Rather than "Booo OpenSSL" we should focus on recovering and raising awareness of the projects we all rely on every…

Precisely!

One large company I know has a technical review system which we use frequently to root cause failure and more importantly to update systems and workflows that will avoid the cockup being discussed in future. Blaming a team or oneself is not entertained (we don't care about the who), the important question is why and what can we do to fix it.

In my opinion, I think the OpenSSL team should come up with such a document and a list of corrective countermeasures.

Re: Ask HN: Negative OpenSSL sentiments

#10

Post by aggresswift » Sat, Apr 12, 2014, 12:59 PM UTC

octatone2 wrote: post #6

aggresswift wrote: post #2

And here's a list of high profile web services hist by the bug: http://hackingnews.com/vulnerability/heartbleed-hit-list-aff...

That's a very, very limited list of websites. It would be safer to assume that you need to reset your passwords, revoke access keys, for ALL websites you have credentials or keys on. However you should not do so until those websites have made a statement verifying that they have both patched, AND revoked their SSL certs.

True, the list was just referenced to show that everyone uses OpenSSL and that the large companies (practically every company in that list) should contribute to OpenSSL in some way.

It's pointless for Google, Yahoo et al, to enable inter-datacenter encryption if the front-end (TLS/SSL) is left wide open.