Ask HN: Negative OpenSSL sentiments

It sounds to me like the way to solve this problem is to turn OpenSSL into a benevolent for profit company with an actual business model.

Why not give the software away as is current practice but then charge top-dollar to MSFT, Google, et al. for professional consulting? This way they could actually devote real resources to the project and implement some of the obvious process reforms that OP and others are suggesting.

The OpenSSL mission could & would be executed better if it was pursued as a business rather than a hobby. Capitalism doesn't cure all ills, but it might be able to cure this one.

Thoughts? Am I missing something?

> Crypto is complicated and very hard to do well. Hell, any complex software is hard to do well. There will always, always be bugs.

There will always be bugs, sure, but differences in the engineering approach can result in orders-of-magnitude differences in the frequency of bugs.

For example, see "Some thoughts on security after ten years of qmail 1.0," where the qmail author explained why he thought qmail had a dramatically different security track record than sendmail: http://cr.yp.to/qmail/qmailsec-20071101.pdf

The kind of things he's talking about can't just happen on the level of "more people submitting patches" and "more financial contributions." You need a top-down approach that's designed to produce secure code.

Part of the reason people are annoyed it that this wasn't a complicated "crypto is hard" bug!

It was a stupid, "really? again?" type bug that is typical of low-level badly written C programs and a common cause of security vulnerabilities.

You two are talking about different things.

Analyzing something and making a judgment is fine. But what happens after you do that? If you just file it away, fine. But if you go out and publicly bash somebody with little thought for the circumstances, it makes you look like an asshole, and it is generally, as Oskarth says, and irrelevant and possibly harmful comment.

Open source software is a gift to the world. If somebody does a lot of work to give you something and the first thing out of your mouth is, "This sucks! What's wrong with you for giving me an imperfect gift?" then it comes across as ungrateful. Because it is. Worse, it makes the gift-giver less likely to keep giving.

If you want to offer feedback to an open-source project, first ask yourself, "Am I telling them anything they don't know?" If you think you are, then offer it in a spirit of gratitude and constructive criticism. And think hard about going beyond offering opinions to offering money or labor.

I'm with you when you say the hate on the developers (especially voluntary devs) is completely undeserved. What really baffles me about the whole debacle is how it's possible that software so widely used and of this importance is left mostly in the few hands of people who want to contribute. I get it that crypto is hard as hell and especially SSL/TLS requires skilled workers, but what I can't understand is why in all these years nobody stepped up and tried to start a collective effort to either fork the project and start a sweeping refactoring or start a completely new project with better foundations. You may argue that it's grunt work and nobody wants to do it, but if your company relies on this sensitive software is in your interest to put money on the table and pay people to do this kind of work.