Ask HN: Negative OpenSSL sentiments • Hacker News Board

Re: Ask HN: Negative OpenSSL sentiments

#21

Post by wpietri » Sat, Apr 12, 2014, 1:56 PM UTC

MediaSquirrel wrote: post #12

It sounds to me like the way to solve this problem is to turn OpenSSL into a benevolent for profit company with an actual business model. Why not give the software away as is current practice but then charge top-dollar to MSFT, Google, et al. for professional consulting? This way they could actually devote real resources to the project and implement some of the obvious process reforms that OP and others are suggestin…

Not sure why you're getting downvoted; it's a legitimate question.

I'm not sure OpenSSL is really a good match for that. I've never really studied this, but my impression is that open-source companies fall into two categories:

1) Very small consulting companies built around one or a few passionate people that scrape by rounding up contracts for specific features that businesses want, and

2) Larger companies that provide a substantial set of services around an open-source product (e.g., Chef, Puppet, RedHat, Ubuntu).

OpenSSL definitely doesn't match the latter, and I don't think it's great for the former. Having done consulting for years at a time, it's a giant pain in the ass. There's no reason to think people who are good at this sort of coding really want to spend half their time on sales, or would be good at it if they did. And adding features to OpenSSL is exactly what got us into this trouble.

This strikes me as the classic case for a tax: benefits are modest but spread widely. If you could painlessly charge each user $0.01/year, you could fund this work no problem. That leads you into all the issues you get with taxes, of course, but in this case I don't think they're obviously larger than the issues you get with capitalism.

It's a shame that the US Government has totally burned their reputation with security-minded techies, or they'd be an obvious way to collect and distribute, say, $100m/year for valuable internet infrastructure. Maybe this is a chance for Europe to step up.

Re: Ask HN: Negative OpenSSL sentiments

#22

Post by morgante » Sat, Apr 12, 2014, 1:59 PM UTC

I think the saddest thing is how incredibly short the list of OpenSSL sponsors is.[1] Every major internet company should be on there—throwing thousands of dollars at this is far less than they lose from responding to the vulnerabilities. As a critical piece of internet infrastructure, everyone with a large (monetary) stake in the integrity of that infrastructure should chip in some.

1: https://www.openssl.org/support/acknowledgments.html

Re: Ask HN: Negative OpenSSL sentiments

#23

Post by KhalilK » Sat, Apr 12, 2014, 2:00 PM UTC

"mistakes will continue to be made in code" Not gravely if professional testing of the open source code is put into place. Yes it might be expensive but critical Internet libraries that serve a variety of purposes—with names such as Apache, Ruby, PHP, SSH and Linux– would benefit greatly from deep assessments.

Re: Ask HN: Negative OpenSSL sentiments

#24

Post by jacques_chester » Sat, Apr 12, 2014, 2:00 PM UTC

notacoward wrote: post #8

I've tried not to be too critical of the developers, but I do understand where some of the negativity comes from. Have you ever tried to use OpenSSL, as a developer? It's kind of a crufty mess. * Initialization is even more complicated than the security needs dictate, and so is everything afterward. * The internal abstractions are leaky, e.g. requiring a poll for read before you can write (and vice versa), because of…

OpenSSL is less like a library, and more like a framework. You need to mesh your code to it pretty closely to get anything done. All you want is a SHA256? Too bad, here's a dozen things you need to do first.

A lot of what makes OpenSSL complicated is that it covers almost every crypto/algo/protocol permutation (there are lots) and it is heavily tuned to run fast on a variety of hardware.

I like PolarSSL as an alternative. It is just a collection of libraries. When I just need SHA256, I can just compile, link and use SHA256. No book-keeping, no boilerplate.

But it's not as wide-ranging or optimised.

Re: Ask HN: Negative OpenSSL sentiments

#25

Post by _pmf_ » Sat, Apr 12, 2014, 2:06 PM UTC

Just tell yourself that most of these clueless webmonkeys' companies and their "products" will not live for a tenth of the lifespan of OpenSSL. This helps for me.

Re: Ask HN: Negative OpenSSL sentiments

#26

Post by hoilogoi » Sat, Apr 12, 2014, 2:10 PM UTC

morgante wrote: post #22

I think the saddest thing is how incredibly short the list of OpenSSL sponsors is.[1] Every major internet company should be on there—throwing thousands of dollars at this is far less than they lose from responding to the vulnerabilities. As a critical piece of internet infrastructure, everyone with a large (monetary) stake in the integrity of that infrastructure should chip in some. 1: https://www.openssl.org/suppor…

Absolutely. I was really surprised to hear this. I'm sadly getting the impression that the only large entities who have thrown funding into audits are the intelligence agencies.

Re: Ask HN: Negative OpenSSL sentiments

#27

Post by danmaz74 » Sat, Apr 12, 2014, 2:13 PM UTC

oskarth wrote: post #7

Couldn't agree more. Heuristic to use when someone is bashing someone else's code: Have you contributed (money, code, docs) to the project? If the answer is no: person lacking skin in the game - irrelevant (even harmful) armchair comment.

when someone is bashing someone else's code if you mean free and open source code, I absolutely agree

Re: Ask HN: Negative OpenSSL sentiments

#28

Post by jrockway » Sat, Apr 12, 2014, 2:13 PM UTC

What we need is to not add fucking stupid features to TLS. TLS did not need an MTU discovery mechanism or keepalive; TCP already does both.

Re: Ask HN: Negative OpenSSL sentiments

#29

Post by [deleted] » Sat, Apr 12, 2014, 2:15 PM UTC

danmaz74 wrote: post #27

oskarth wrote: post #7

Couldn't agree more. Heuristic to use when someone is bashing someone else's code: Have you contributed (money, code, docs) to the project? If the answer is no: person lacking skin in the game - irrelevant (even harmful) armchair comment.

when someone is bashing someone else's code if you mean free and open source code, I absolutely agree

[deleted]

Re: Ask HN: Negative OpenSSL sentiments

#30

Post by rfrey » Sat, Apr 12, 2014, 2:18 PM UTC

Shish2k wrote: post #19

oskarth wrote: post #7

Couldn't agree more. Heuristic to use when someone is bashing someone else's code: Have you contributed (money, code, docs) to the project? If the answer is no: person lacking skin in the game - irrelevant (even harmful) armchair comment.

Did you personally take part in the fighting in WWII? If not, how can you say that Hitler was a bad person? (Deliberately invoking Godwin, because that's the level of logic I'm responding to :P )

Although I recognize that your intent is a reductio ad absurdum of the parent's point of view. you should also recognize that this comment draws a parallel between the volunteer devs of OpenSSL and Hitler.