Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

161–170 of 262 posts

Re: LibreSSL

#161

Post by gnoway »

TacticalCoder wrote: post #145

I may have a stupid question but... While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself? It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA ha…

Git uses SHA-1 hashes, which have not been considered cryptographically secure since 2005.

Git and CVS are both just tools. They each provide a server implementation, but it's uncommon to use either of these for write access in large projects. It's more common to wrap CVS or Git with a different frontend like HTTPS or SSH. My guess is that the OpenBSD guys use OpenSSH.

This team is fanatical about security and process. I am completely comfortable with them using whichever tools they want.

Re: LibreSSL

#162

Post by copergi »

TacticalCoder wrote: post #145

I may have a stupid question but... While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself? It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA ha…

>Ain't using CVS potentially an issue here?

No, why would it? If you don't trust the openbsd developers, the don't use their code.

Re: LibreSSL

#163

Post by zorbo »

q3k wrote: post #101
zorbo wrote: post #83

Earlier quoted context omitted.

Ah yes, the kind of professionalism I've come to expect from OpenBSD. They make decent software, but boy could they use some work in the PR department.

I'd rather have great software and shitty PR than the recent trend of obnoxiously beautiful landing pages for “world-changing” shitty web apps.

You can have great software without insulting half the internet and being an immature brat. A beautiful landing page is optional.

Re: LibreSSL

#164

Post by copergi »

papaf wrote: post #128
akira2501 wrote: post #81

Earlier quoted context omitted.

For right now, it does not matter. Their goal is to fix the project from a security point of view, and it would be impossible if they tied their hands with that during the course of development. In the future, you can expect the same deal as OpenSSH, OpenNTPD and all the other OpenBSD software that _eventually_ gets ported to other architectures when it reaches a point of stability and safety that it makes sense to d…

Portable OpenNTPD seems to have died: https://wiki.archlinux.org/index.php/OpenNTPD I'm sure LibreSSL won't have that problem but I thought it worthwhile pointing out that support for other OSes is not guaranteed.

>Portable OpenNTPD seems to have died: https://wiki.archlinux.org/index.php/OpenNTPD

If you follow that through the series of links, you find that it is just an assumption based on one guy who didn't know the project existed thinking unchanged = unmaintained.

Re: LibreSSL

#166

Post by copergi »

sarahj wrote: post #19

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing…

>OpenSSL has provided years of free software, supporting thousands of sites and applications.

And has done it so poorly that it has been a security nightmare the whole time. Just because something is given away, doesn't mean the world is obligated to be thankful for it. Giving away crap doesn't make it not stink.

Re: LibreSSL

#167

Post by thefreeman »

rockdoe wrote: post #125
ProblemFactory wrote: post #110

Earlier quoted context omitted.

Curiously, the Heartbleed bug was found by the Google engineer who is working on replacing NSS with OpenSSL in Chrome: https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53... From the Pros & Cons table, it doesn't seem that NSS is obviously superior to OpenSSL. Both seem to suffer from focus on extra features instead of maintenance and reliability.

The reasoning there is, certainly post-Heartbleed, very scary. Their conclusion boils down to that they want to use the system-provided OpenSSL on Android, rather than shipping NSS. This might be fine if you're running a Nexus device that still gets updates to the latest Android (Nexus 4 and later?). But for everyone else, that's effectively forcing people to get a new Android phone if they don't want to get stuck wi…

I mean couldn't you say the same thing if a vulnerability was found in NSS?

Re: LibreSSL

#168

Post by copergi »

thebackwardsman wrote: post #55
bananas wrote: post #43

Earlier quoted context omitted.

I'd hope that I speak for the majority here when I say that OpenSSL has had its chance. This is the beauty of open source, nothing more. We can take this and make it better.

Count the number of vulnerabilities in OpenSSL over the last few years, relative to the size of its code base. A single vulnerability, albeit bad this year, results in a fork and the attitude of "it had its chance." LibreSSL inherits all of the undiscovered vulnerabilities in its huge code base. I hope your harsh criticism carries over to its code base once these flaws are discovered here too. That's the beauty of op…

>Count the number of vulnerabilities in OpenSSL over the last few years, relative to the size of its code base. A single vulnerability

You might want to take your own advice. There have been tons of vulnerabilities in openssl, not one.

>LibreSSL inherits all of the undiscovered vulnerabilities in its huge code base.

That would be why it is being gutted and audited. That's the whole point.

Re: LibreSSL

#169

Post by maxerickson »

rockdoe wrote: post #125
ProblemFactory wrote: post #110

Earlier quoted context omitted.

Curiously, the Heartbleed bug was found by the Google engineer who is working on replacing NSS with OpenSSL in Chrome: https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53... From the Pros & Cons table, it doesn't seem that NSS is obviously superior to OpenSSL. Both seem to suffer from focus on extra features instead of maintenance and reliability.

The reasoning there is, certainly post-Heartbleed, very scary. Their conclusion boils down to that they want to use the system-provided OpenSSL on Android, rather than shipping NSS. This might be fine if you're running a Nexus device that still gets updates to the latest Android (Nexus 4 and later?). But for everyone else, that's effectively forcing people to get a new Android phone if they don't want to get stuck wi…

It says "On Android, Chromium uses OpenSSL." in the background section. The question is whether they want to switch other platforms to OpenSSL (or Android to NSS, or keep using both).

Re: LibreSSL

#170

Post by copergi »

zorbo wrote: post #163
q3k wrote: post #101

Earlier quoted context omitted.

I'd rather have great software and shitty PR than the recent trend of obnoxiously beautiful landing pages for “world-changing” shitty web apps.

You can have great software without insulting half the internet and being an immature brat. A beautiful landing page is optional.

>You can have great software without insulting half the internet

You overestimate how many web hipsters there are. And annoying them is not "being an immature brat". It is precisely to discourage their involvement. Because the mentality behind the web fads are precisely why the entire world of software is layers upon layers of shit stacked on top of each other.

Post reply on HN