> And stop forking OpenSSL; you’re just making things worse.
Yeah no. OpenBSD developers did a really good job by improving the codebase of OpenSSL. See also some of their presentations: https://www.libressl.org/papers.html
The sorry state of OpenSSL usability (2017)
11–20 of 84 posts
Re: The sorry state of OpenSSL usability (2017)
#12libressl has documentation. it's an OpenBSD project so you use the man pages.
Re: The sorry state of OpenSSL usability (2017)
#13I think this should be retitled to "The sorry state of OpenSSL usability [on macOS]", because the author is using the built-in OpenSSL on macOS (which, as is eventually discovered, isn't actually OpenSSL). If you want to use OpenSSL on macOS, I suggest using the OpenSSL provided either in Brew or in MacPorts. That will give you a fully-functional setup (including help and man pages).
Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.
> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse.
1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all.
2. help text not available because its an apple supplied fork. openssl does tell you to use 'help'
3. man pages do exist. Just not installed by apple like author expected
4. and stop forking OpenSSL; BSD project forked it and Apple wants BSD over anything else because they can put the software in their closed platforms. Even if libressl were on the up and up, Apple's still got a version from 2016 installed.
Those are all Apple problems, not openssl problems.
Re: The sorry state of OpenSSL usability (2017)
#14> And stop forking OpenSSL; you’re just making things worse. Yeah no. OpenBSD developers did a really good job by improving the codebase of OpenSSL. See also some of their presentations: https://www.libressl.org/papers.html
> by improving the codebase of OpenSSL
Just to clarify: LibreSSL forked OpenSSL [1]. By definition they did not improve the codebase of OpenSSL.
Re: The sorry state of OpenSSL usability (2017)
#15Earlier quoted context omitted.
Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.
> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…
5. Follow the code commits of the LibreSSL fork and if you continue to use OpenSSL and not LibreSSL at least you will know the various issues you are going to have.
Re: The sorry state of OpenSSL usability (2017)
#16Earlier quoted context omitted.
Outside of the man page issue all of the complaints from the author apply to all platforms that have openssl.
> Users matter: try doing some usability testing. Try adding some help text and man pages, instead of hijacking the wiki webpage of a different SSL project. And stop forking OpenSSL; you’re just making things worse. 1. Apple is not usability testing this 3 year old version of a fork of openssl, because they're not supporting it at all. 2. help text not available because its an apple supplied fork. openssl does tell y…
1. The OpenSSL API hasn't changed, and if Apple changed it on their own that would break more things
2. The issue the author complained about was `openssl --help` not working, and it doesn't work on any platform (because he got the command wrong). `openssl help` does work on OSX (I literally just tested it).
3. Yeah, that's the one issue we agree is an Apple issue.
4. Apple didn't make LibreSSL. Other systems besides Apple use LibreSSL, and the authors complaints about their lack of documentation are relevant regardless of what Apple does.
Re: The sorry state of OpenSSL usability (2017)
#17libressl has documentation. it's an OpenBSD project so you use the man pages. http://man.openbsd.org/openssl
Unfortunately, libressl is not FIPS 140-2 compliant, so you can't leverage it for open source development of secure applications for the US government (though this is more to do with the certification headache than a fault of libressl itself)
Re: The sorry state of OpenSSL usability (2017)
#18A lot of comments here about LibreSSL and Apple vs OpenSSL. Which is fine, that was my immediate reaction. But do the criticisms re:weak defaults, unlabeled deprecated commands, and uninformative output apply? Because I'll admit - every time I have to use (some version of) openSSL I google for the command I need and blindly use it. The commands are cryptic and meaningless.
If this is true outside of LibreSSL, that definitely sounds like Apple is NOT the problem in this case (though certainly not helping)
Re: The sorry state of OpenSSL usability (2017)
#19> OpenSSL decided to use a “512 bit long modulus”, the default. We’re told: “don’t roll your own crypto; instead trust standard tools like OpenSSL”. The modulus length is a good example of why: a wrong value results in a trivially breakable key, and you the user shouldn’t need to know what the right value is. So OpenSSL chooses a sensible modulus length for you.
Checking the OpenBSD man page for the LibreSSL genrsa, it does seem to generate 2048-bit RSA keys by default[1].
Perhaps Apple just stuck with an older default (for backwards compat) or perhaps this wasn't changed yet in the old version of LibreSSL that Apple uses?
Re: The sorry state of OpenSSL usability (2017)
#20> Unfortunately, http://www.libressl.org/ won’t help you either, because there literally isn’t any documentation of LibreSSL.
This is untrue. The front page contains links to the documentation inline, OpenBSD/LibreSSL converted all of OpenSSL's awful perlpod documentation to semantic mdoc(5) markup, and even wrote new man pages for functions completely undocumented by OpenSSL.
See Ingo Schwarze' EuroBSDCon 2018 talk "Better documentation - on the web and for LibreSSL"
https://www.openbsd.org/papers/eurobsdcon2018-mandoc.pdf
And earlier writeups from 2016.
https://undeadly.org/cgi?action=article;sid=20161215221715
It's been a long road to improve the documentation, and it's substantially better than OpenSSL.