Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

141–150 of 262 posts

Re: LibreSSL

#141

Post by stuaxo »

orthecreedence wrote: post #53
bananas wrote: post #36

Earlier quoted context omitted.

Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.

Ehh, I maintain a few libs that rely on the OpenSSL Windows ports. I'm not too keen on writing a compatibility layer that says "if windows, use the MS version, else use libreSSL!" I'm fine with them not supporting MSVC in the build, but is it really that much harder to support something like MinGW/MSYS? No need for Cygwin. The whole point of OpenSSL was that it runs everywhere. If we're going to write a shiny new ver…

It's probably easier to cut the code right down to size now, then re-add compatibility once the base is solid.

Given how knarly build systems can be, then only supporting modern versions of the same could help remove a lot of cruft.

Re: LibreSSL

#142

Post by dtech »

fab13n wrote: post #126

With close to years of C under my belt, I believe it's a major error, today, to write a critical cryptographic library in C. OK, do the codecs in C if it's the only way to meet performance requirements. But the rest must be written in a language that's reasonably analyzable statically, and with adequate abstractions. Seriously, have you looked at the filthy mess of leaky abstractions that OpenSSL's BIO system is? How…

They're making a fork of OpenSSL, and removing all the cruft. Porting it to a completely different language would be an error.

There are several alternatives to OpenSSL available and/or popping up right now. They might or might not be a better choice for new developments. But refactoring OpenSSL (where a lot of currently used software depends upon) is certainly not a dumb decision.

Re: LibreSSL

#144

Post by whatevsbro »

huhtenberg wrote: post #93
whatevsbro wrote: post #66

Earlier quoted context omitted.

> the fact remains that OpenSSL is very widely used on Windows and yanking it out without providing a drop-in replacement option is a bad idea The LibreSSL guys are not yanking anything out of Windows, they're just providing an alternative to OpenSSL, for all the world to use, for free . They're not under any obligation to support Windows, no matter how bad you want them to.

I don't expect them to support Windows, you misunderstand the whole concern. The concern is that OpenBSD fellas are fragmenting the project and they are also asserting that OpenSSL team was doing things wrong for a long time. This is not a start of a beautiful friendship. Throw in a bit of crowd lynching (to the tune of "OpenBSD is showing OpenSSL how to do security right") and we can end up with OpenSSL devs showing…

> The concern is that OpenBSD fellas are fragmenting the project and they are also asserting that OpenSSL team was doing things wrong for a long time.

Fragmenting? Aren't they making a separate, alternative implementation?

Either way, the whole open source field is chock-full of "fragmentation", with countless precious little snowflakes rushing to fork and re-implement anything and everything under the sun to get it just the way they want it. I doubt whatever fragmentation might happen with OpenSSL is a cause for concern, especially when the OpenSSL codebase is objectively bad.

Re: LibreSSL

#145

Post by TacticalCoder »

I may have a stupid question but...

While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself?

It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA hashes and so people can't really "mess" with the history of a DVCS like Git: too many people noticed a critical file having no business being modified being, well... Modified.

Once again, it was quite a while ago but I'm pretty certain that both the fact that Git was decentralized and that Git was using cryptographically secure hashes was touted as a "Good Thing" [TM] that helped catch the backdooring attempts.

Ain't using CVS potentially an issue here?

Re: LibreSSL

#146

Post by rurounijones »

Confusion wrote: post #85

Has anyone seen an explanation for why this effort isn't being undertaken together with the OpenSSL team?

Considering the fact that the OpenBSD guys are complaining about the OpenSSL guys competance in their commits I don't think they WANT them near the new fork.

Re: LibreSSL

#147

Post by Pacabel »

fab13n wrote: post #126

With close to years of C under my belt, I believe it's a major error, today, to write a critical cryptographic library in C. OK, do the codecs in C if it's the only way to meet performance requirements. But the rest must be written in a language that's reasonably analyzable statically, and with adequate abstractions. Seriously, have you looked at the filthy mess of leaky abstractions that OpenSSL's BIO system is? How…

Like we always have to ask when somebody says what you have, "What's the alternative?"

Whatever it is, it'll need to be very portable (well beyond just Linux, OS X and Windows), and it'll presumably need a free implementation on each of those platforms, and it'll need to be quite fast, and it'll need to support native compilation, and it'll need to support interoperability with existing code, and it'll need to be "safer" in some way.

At this time, there are very, very few languages that meet every one of those criteria sufficiently. We're looking at C, or C++. Maybe Ada. But that's about it. Rust doesn't cut it yet, and probably won't for some time. Other candidates are lacking severely in one or more of those important areas.

C++ using modern techniques appears to be the only feasible alternative to C today.

Re: LibreSSL

#148

Post by twic »

zorbo wrote: post #83
vayarajesh wrote: post #24

Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

Ah yes, the kind of professionalism I've come to expect from OpenBSD. They make decent software, but boy could they use some work in the PR department.

I like the fact that OpenBSD has professional implementation but unprofessional presentation. It makes it easy to distinguish from FreeBSD.

Re: LibreSSL

#149

Post by mykhal »

antocv wrote: post #130

"No we dont need help with making web pages" its just a bunch of html very simple 1990s tags and it still looks and works much better than any html5 css3 bootstrap fanboy page Ive ever seen. Awesomeness

does not work wery well for instance for me or html validator..

Re: LibreSSL

#150

Post by Joeboy »

alexcroox wrote: post #54
sarahj wrote: post #19

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing…

Agreed, the tone of the page and the footer prevents me from taking these guys seriously, especially in this area (even more so with recent events).

Were you about to donate your time and money to the project, up until you saw the footer?
Post reply on HN