Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

111–120 of 262 posts

Re: LibreSSL

#111

Post by beefhash »

nailer wrote: post #29
sarahj wrote: post #19

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing…

They've already done massive amounts of work already - adding missing checks, documenting a metric ton of magic numbers, removing VMS support, fixing year 2038 bugs, removing insecure cypher support, removing less secure replacements for secure OS inbuilts, unused code, and more, see http://opensslrampage.org . On a side note, I was really hoping for the name to be OpenTLS (consistent with OpenBSD and OpenSSH, which…

OpenTLS was already taken: http://www.opentls.org/ -- it's dead, but still taken.

Re: LibreSSL

#112

Post by vayarajesh »

zorbo wrote: post #83
vayarajesh wrote: post #24

Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

Ah yes, the kind of professionalism I've come to expect from OpenBSD. They make decent software, but boy could they use some work in the PR department.

I am not sure if anyone noticed the footer of the page. It not the PR's fault or anything to blame PR. Its just a link for donation :).. they are trying to improve the standards of the web by wanting/helping to get rid of comic sans font

Re: LibreSSL

#113

Post by M2Ys4U »

Jare wrote: post #92
phlo wrote: post #27

Earlier quoted context omitted.

StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used…

I bet StartSSL would happily (and publicly) waive any revoke fees to FOSS SSL software projects.

And you would lose your money.

Re: LibreSSL

#115

Post by simias »

asddubs wrote: post #78
simias wrote: post #69

Earlier quoted context omitted.

Quite frankly unless LibreSSL manages to raise more than 2000$ a year (what the OpenSSL fundation makes, apparently) I fail to see how they hope to avoid encountering the same kind of problems OpenSSL did (and still does). And given that the OpenBSD projects had to beg for donations to reach a 150k$ goal, if memory serves, I doubt they'll be able to sink a tremendous amount of money into LibreSSL. If you can't pay pe…

openbsd has a tremendously good track record with writing secure software, though. OpenSSH, anyone?

Well sure, OpenSSH is probably one of the most useful and versatile tools out there, there's no denying that it's a huge achievement.

That being said it's a program with mostly well defined use cases while OpenSSL is a library used in thousands of programs (including OpenSSH) on a variety of hardware and operating systems. The OpenBSD project naturally mostly cares about OpenBSD first and the rest second, which might be a bad thing if we end up with a multitude of forks each supporting a particular OS/architecture, increasing the chances of messing things up. After all, the latest big OpenSSH vulnerability was due to debian-specific patches...

Also, for what it's worth, sloccount tells me the latest snapshot of OpenSSH has about 90 thousand lines of code while OpenSSL has more than 360 thousand. It's a huge, huge library, forking and maintaining it is a tremendous undertaking, even compared to OpenSSH.

Re: LibreSSL

#116

Post by CHY872 »

sergiotapia wrote: post #71
sarahj wrote: post #19

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing…

I still can't believe such a fundamental backbone of the web runs on $2000/year. This is a -worldwide- service, and it runs on peanuts. It's flabbergasting. Please donate today if you can. https://www.openssl.org/support/donations.html

No. It needs corporate involvement, from Google, Red Hat, Amazon, Verisign etc. Lend minds, not money. By all means fund people to write it, but like it's not you who should be contributing, it's the corporations who rely on it.

Re: LibreSSL

#117

Post by watwut »

watwut wrote: post #35
phlo wrote: post #27

Earlier quoted context omitted.

StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used…

If you have to pay for revocation, then it is not free certificate. It is just certificate with fees postponed. It is not the same thing. Not sure how you, but when I buy things I do not consider only initial price, but also additional fees. If we want SSL used everywhere, browsers need accept self signed certificates in less obtuse way or there need to be other way to get really free ones.

Why was this downvoted?

Re: LibreSSL

#118

Post by CHY872 »

huhtenberg wrote: post #93
whatevsbro wrote: post #66

Earlier quoted context omitted.

> the fact remains that OpenSSL is very widely used on Windows and yanking it out without providing a drop-in replacement option is a bad idea The LibreSSL guys are not yanking anything out of Windows, they're just providing an alternative to OpenSSL, for all the world to use, for free . They're not under any obligation to support Windows, no matter how bad you want them to.

I don't expect them to support Windows, you misunderstand the whole concern. The concern is that OpenBSD fellas are fragmenting the project and they are also asserting that OpenSSL team was doing things wrong for a long time. This is not a start of a beautiful friendship. Throw in a bit of crowd lynching (to the tune of "OpenBSD is showing OpenSSL how to do security right") and we can end up with OpenSSL devs showing…

The devs can probably at least be mature enough to use each others code where it is compatible. More to the point, there's really only a couple of full time OpenSSL devs, and the others are more contributors, for whom I'd imagine switching to a better laid out, less buggy, less spaghetti-codey, more practical implementation would be an advantage.

Re: LibreSSL

#119

Post by MonsieurHoho »

I don't get the point of this fork. Usually when a project is forked, it means that people want to keep the code base but disagree with the way the project is managed.

After heartbleed everybody blamed OpenSSL's bloated code base and it became apparent that many contributions came from volunteers with very few financing.

By forking the project, LibreSSL will keep the problematic code legacy and split the community. Maybe I am missing something, but it looks like opportunism here...

Re: LibreSSL

#120

Post by mykhal »

zorbo wrote: post #83
vayarajesh wrote: post #24

Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

Ah yes, the kind of professionalism I've come to expect from OpenBSD. They make decent software, but boy could they use some work in the PR department.

i guess it was designed by theo@ himself )
Post reply on HN