Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

121–130 of 262 posts

Re: LibreSSL

#121

Post by tragic »

icebraining wrote: post #98
tragic wrote: post #79

Earlier quoted context omitted.

Ask yourself which hipster start-up is going to do a comprehensive rewrite job on OpenSSL - or, for that matter, which SV VC is going to bung a few million green sheets into something like this (which, if we're honest, we could all do with happening, rather than the next DOA social media start up with a -ly/-able/-r suffix). If these people are prepared to take this on, then they can use whatever fonts they bloody we…

Firefox dumped it in version 23, and they did report that on the changelog[1]. jwz even wrote a post lamenting it[2]. [1] https://www.mozilla.org/en-US/firefox/23.0/releasenotes/ [2] http://www.jwz.org/blog/2013/08/a-light-has-gone-out-on-the-...

That doesn't surprise me, but IE10 in IE7 compat mode in IE5 Quirks document mode still didn't blink for me. Farewell, old friend.

(Wonder if marquee still works. EDIT: yes, it does. Thank the lord for that.)

Re: LibreSSL

#122

Post by rubyfan »

zorbo wrote: post #83
vayarajesh wrote: post #24

Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

Ah yes, the kind of professionalism I've come to expect from OpenBSD. They make decent software, but boy could they use some work in the PR department.

I just donated because of that little line at the bottom of the page. I think it is that extra character from the OpenBSD team that I love...

The fact that are are true and opinionated and no bullshit. Real character is hard to find these days.

Re: LibreSSL

#123

Post by jbergstroem »

Since libressl.org doesn't seem to contain this information, hopefully someone here perhaps knows more about it: Is it possible to donate specifically to subprojects? As a previous donator to the OpenBSD foundation, being able to do so would hopefully aid receivers of those funds not only use time (timing) as one way to measure the potential success of libressl.

Attitude and font choice aside, I can't help somewhat feel that one could explore better ways to funnel interest, commitment and donations to a project such as this; especially since it sparked as a result of heartbleed.

Re: LibreSSL

#124

Post by higherpurpose »

abcd_f wrote: post #41
bananas wrote: post #36

Earlier quoted context omitted.

Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.

There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them. If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.

If that Windows software doesn't need SSL, then it should just use NaCl anyway.

Re: LibreSSL

#125

Post by rockdoe »

ProblemFactory wrote: post #110
frik wrote: post #91

Earlier quoted context omitted.

maybe it's better to switch to NSS, the original SSL library developed by Netscape (now by Mozilla, Google, etc.), that is available under better open source licenses, is used in Firefox, (Chrome), OpenOffice, etc. and has an optional compatible API to OpenSSL: http://en.wikipedia.org/wiki/Network_Security_Services

Curiously, the Heartbleed bug was found by the Google engineer who is working on replacing NSS with OpenSSL in Chrome: https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53... From the Pros & Cons table, it doesn't seem that NSS is obviously superior to OpenSSL. Both seem to suffer from focus on extra features instead of maintenance and reliability.

The reasoning there is, certainly post-Heartbleed, very scary. Their conclusion boils down to that they want to use the system-provided OpenSSL on Android, rather than shipping NSS.

This might be fine if you're running a Nexus device that still gets updates to the latest Android (Nexus 4 and later?). But for everyone else, that's effectively forcing people to get a new Android phone if they don't want to get stuck with a horribly insecure phone.

Oh, I see the point already...

Re: LibreSSL

#126

Post by fab13n »

With close to years of C under my belt, I believe it's a major error, today, to write a critical cryptographic library in C.

OK, do the codecs in C if it's the only way to meet performance requirements. But the rest must be written in a language that's reasonably analyzable statically, and with adequate abstractions. Seriously, have you looked at the filthy mess of leaky abstractions that OpenSSL's BIO system is? How many bugs could be found and/or planted by a 3-letters agency in that crap? Is there anyone who's comfortable with its #ifdef labyrinths?

Finally, I don't think you can retrofit clarity in OpenSSL any better than you could, say, retrofit virus-resilience in a Microsoft OS that hasn't been originally designed for hostile network environments. I used to believe OpenSSL was made messy in order to sell consulting hours, since Snowden I have a more paranoid hypothesis.

Re: LibreSSL

#127

Post by higherpurpose »

CHY872 wrote: post #116
sergiotapia wrote: post #71

Earlier quoted context omitted.

I still can't believe such a fundamental backbone of the web runs on $2000/year. This is a -worldwide- service, and it runs on peanuts. It's flabbergasting. Please donate today if you can. https://www.openssl.org/support/donations.html

No. It needs corporate involvement, from Google, Red Hat, Amazon, Verisign etc. Lend minds, not money. By all means fund people to write it, but like it's not you who should be contributing, it's the corporations who rely on it.

Google and Amazon should be donating to LibreSSL, too. They may have no intention of using it in the next few years, but I'm sure they'd like for a solid alternative to be out there, so they can use it just in case they do change their minds, just like Google recently did with the switch from NSS to OpenSSL, just before Heartbleed happened.

It would've been smart of them to donate to OpenSSL starting a few years back, so that by the time they decided to quit NSS, they would've been sure OpenSSL is pretty solid, and would've also discovered the Heartbleed bug much earlier. They could not repeat the same mistake twice by donating to LibreSSL right now.

Re: LibreSSL

#128

Post by papaf »

akira2501 wrote: post #81
huhtenberg wrote: post #60

Earlier quoted context omitted.

This is all great, but the fact remains that OpenSSL is very widely used on Windows and yanking it out without providing a drop-in replacement option is a bad idea. We can debate finer nuances of proper abstraction to the death, but it doesn't move a needle for people who already have OpenSSL dependencies in their code.

For right now, it does not matter. Their goal is to fix the project from a security point of view, and it would be impossible if they tied their hands with that during the course of development. In the future, you can expect the same deal as OpenSSH, OpenNTPD and all the other OpenBSD software that _eventually_ gets ported to other architectures when it reaches a point of stability and safety that it makes sense to d…

Portable OpenNTPD seems to have died: https://wiki.archlinux.org/index.php/OpenNTPD

I'm sure LibreSSL won't have that problem but I thought it worthwhile pointing out that support for other OSes is not guaranteed.

Re: LibreSSL

#129

Post by AlexMeesters »

MonsieurHoho wrote: post #119

I don't get the point of this fork. Usually when a project is forked, it means that people want to keep the code base but disagree with the way the project is managed. After heartbleed everybody blamed OpenSSL's bloated code base and it became apparent that many contributions came from volunteers with very few financing. By forking the project, LibreSSL will keep the problematic code legacy and split the community. M…

> After heartbleed everybody blamed OpenSSL's bloated code base And this is exactly what they are fixing.

OpenSSL's response was to fix heartbleed and move on, not fixing the more broad problem of to much code cruft that led to the bug. IMHO they are right to fork it, OpenSSL's lack of reaction to this is a raise for concern. I am sure Theo( de Raadt) and its team can tackle this, making the code base much much leaner, reducing the risks of bugs similar to heartbleed. And there is really no excuse for OpenSSL to deny that.

Also i think OpenSSL has to much technical debt to be efficient in tackling a cleanup like this.

Re: LibreSSL

#130

Post by antocv »

"No we dont need help with making web pages"

its just a bunch of html very simple 1990s tags and it still looks and works much better than any html5 css3 bootstrap fanboy page Ive ever seen.

Awesomeness

Post reply on HN