Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome: From NSS to OpenSSL

docs.google.com

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Chrome: From NSS to OpenSSL

#21

Post by pfortuny »

ewindisch wrote: post #12
majke wrote: post #4

And here is compulsory email thread explaining some context: https://groups.google.com/forum/?_escaped_fragment_=msg/mozi... > Strange that "PKCS#11 support" is listed as a "con" for NSS > It was not accidental that it was listed under "Con", nor do I see ENGINE_pkcs11 as a "Pro"

This conversation circles back to Theo de Raadt's argument that developers are caring too much about performance in security-critical applications.

Which is the typical point in which Theo de Raadt is right even though he may be saying so quite singularly.

This is another instance of the lack of 'engineering' in Computer Science/Programming/you name it. Engineers have long ago learnt that you need "automatic" standards and compliance before, during and after building anything, and that the best practice is always assuming thing will go wrong.

This, unfortunately, is not the case with programming as we can see time and again.

But I digress.

Re: Chrome: From NSS to OpenSSL

#22

Post by [deleted] »

tptacek wrote: post #20

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of d…

[deleted]

Re: Chrome: From NSS to OpenSSL

#23

Post by danudey »

Shish2k wrote: post #14
rdudek wrote: post #11

Earlier quoted context omitted.

Considering how widely it's used, if Google could use some of their resources to better it, I'm all for it!

Considering how widely SSL is used, and the resources of Google, I wonder if they could come up with their own encryption toolkit? How hard can it be for a company the size of Google to create a library that lives up to eg SQLite's quality standards?

I would say that Joel Spolsky answers this quite well:

http://www.joelonsoftware.com/articles/fog0000000069.html

What would be interesting to see is a fork of OpenSSL with the intention of cleaning up the code, removing abstractions where they are unnecessary and adding them where they are, and adding a comprehensive test suite to ensure correct behaviour wherever possible.

Re: Chrome: From NSS to OpenSSL

#24

Post by [deleted] »

[deleted] wrote: post #22
tptacek wrote: post #20

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of d…

[deleted]

[deleted]

Re: Chrome: From NSS to OpenSSL

#25

Post by Wohui »

[deleted] wrote: post #22
tptacek wrote: post #20

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of d…

[deleted]

When the ratio of comments to article-upvotes reaches a certain point, threads are punished as 'flamewars'.

Re: Chrome: From NSS to OpenSSL

#26

Post by [deleted] »

[deleted] wrote: post #22
tptacek wrote: post #20

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of d…

[deleted]

[deleted]

Re: Chrome: From NSS to OpenSSL

#27

Post by tekacs »

tptacek wrote: post #17
higherpurpose wrote: post #2

Can't they use Sodium instead? http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...

No. Not only is Sodium (more accurately: NaCl) not a TLS library, but it doesn't even implement the primitives that TLS needs; it can't really even serve as a component of another TLS library.

Not that you're not absolutely right about NaCl & Sodium, but isn't the GP talking explicitly about Sodium and not NaCl?

When you say 'more accurately: NaCl', is there something particular you're getting at, or are you speaking from experience of NaCl rather than Sodium (or are you talking about the fact that the bindings seem to be named/built for the original NaCl?)

Edit: or do you just think it's still better to call it NaCl given that it's a fork of, or I suppose a refined implementation of NaCl?

Re: Chrome: From NSS to OpenSSL

#29

Post by agl »

tptacek wrote: post #20

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of d…

> NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it.

Why not? NSS is handled by Mozilla. Mozilla prides itself on being open-source. People can submit patches to NSS by filing in Bugzilla.

> The most important code in both NSS and OpenSSL is the SSL state machine. The code for that state machine is incontrovertibly clearer and better expressed in NSS.

I agree with this to some extent (although I don't think it's quite as much better as you suggest), and cleanups in that code are needed. Other parts of NSS can certainly rival OpenSSL on the "dear god" scale however. I'll take the low-level parts of OpenSSL over NSS any day.

> NSS has had better battle-testing as a clientside browser TLS library than OpenSSL, which, apart from Android Chrome, isn't a big factor in TLS clientsides.

This is true. We will have to rack our brains and our bug database for some of the unwritten rules of TLS to port over to OpenSSL. I'm not too worried about this in the long term however.

Ultimately the proof will be in the pudding. Ask again in 12 months :)

Re: Chrome: From NSS to OpenSSL

#30

Post by plorkyeran »

tptacek wrote: post #20

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of d…

> Maybe a fork of NSS would be a better plan.

Is forking it actually needed? I was under the impression that Mozilla has many of the same complaints about the current state of NSS as the Chrome team and merely don't want to dedicate the resources to cleaning it up.

Post reply on HN