Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

251–260 of 262 posts

Re: LibreSSL

#251

Post by ColdHawaiian »

TacticalCoder wrote: post #145

I may have a stupid question but... While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself? It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA ha…

FYI, here is an Ars Technica article that talks about the break-in into the Linux Kernel, and Git's role in revealing the tampering[1].

[1]: http://arstechnica.com/security/2013/09/who-rooted-kernel-or...

Re: LibreSSL

#253

Post by clarry »

boklm wrote: post #240
mrweasel wrote: post #94

Earlier quoted context omitted.

How so? CVS do make branching and merging rather annoying, but I don't see how reviewing changes becomes difficult. It's a lot easier to track the changes to the entire OpenBSD source three, compared to the Linux kernel. Git and Mercurial are extremely nice tools, but the flow of patches and branches quickly become rather hard to follow. CVS doesn't have most of the features that newer tools have, so there's stuff yo…

There's many problems that makes it very annoying to review their changes: - CVS commits are per file. You can't see changes made by a single commit to multiple files. - CVS cannot rename files. You have to create a new file and remove the old one. So you cannot follow history of the changes. - CVS is really slow. You cannot clone the repository locally, so it takes a few seconds to show any change, whereas git shows…

> I'm not an openssl expert, so I didn't plan to review their changes anyway

Bad excuse. Now if you said you don't know C at all, that'd be reasonable.

> But if I had to, using CVS would be the most annoying thing.

There's freshbsd, cgit on anoncvs, probably a git repo or two on github. You don't need to touch CVS to view the code and diffs. Blaming the VCS that much is a bunch of lazy excuses. Yes, CVS has its shortcomings. No it doesn't make code review difficult.

Re: LibreSSL

#254

Post by mehrdada »

gioele wrote: post #249
mehrdada wrote: post #248

Earlier quoted context omitted.

Why wouldn't it? The author of the file will be the copyright holder by the virtue of authoring it. If she does not get rid of it, she still remains the copyright holder. Copyright does not switch owners purely by the virtue of distribution with another piece of work. IANAL.

But isn't the ISC file a "derivate work" of the Apache 1.0 and thus subject to the same limits?

The copyright holders can later on relicense the work under something else. Licensing a work under some non-exclusive license does not restrict you from licensing it again in the future under other terms.

Re: LibreSSL

#255

Post by nfoz »

antocv wrote: post #242
nfoz wrote: post #226

Earlier quoted context omitted.

Can you explain how this attack works, or provide a link?

Lets assume somehow you as attacker got access to the box where their CVS process is running. Now you can edit a file, insert a line or change a "uid != 0" to "uid = 0", you also edit the history of the CVS repistory to make it seem that this change was introduced with some patch 3 years ago by Theo. Because its CVS or SVN the history is in the server, and not on every developers computers. Next time the devs build t…

Ah that makes sense. Thanks!!

Re: LibreSSL

#256

Post by TazeTSchnitzel »

jarin wrote: post #192
vayarajesh wrote: post #75

Earlier quoted context omitted.

There is a pro-type / mordern-type version of comic sans http://comicneue.com/ :)

I added it to homebrew-cask :) https://github.com/caskroom/homebrew-fonts brew tap caskroom/fonts brew cask install font-comic-neue

  Andreas-MacBook-Air:Source ajf$ brew tap caskroom/fonts && brew cask install font-comic-neue
  Cloning into '/usr/local/Library/Taps/caskroom-fonts'...
  remote: Reusing existing pack: 3465, done.
  remote: Total 3465 (delta 0), reused 0 (delta 0)
  Receiving objects: 100% (3465/3465), 496.33 KiB | 280.00 KiB/s, done.
  Resolving deltas: 100% (1974/1974), done.
  Checking connectivity... done.
  Tapped 0 formula
  Error: Unknown command: cask

Re: LibreSSL

#257

Post by scintill76 »

adamman wrote: post #202
antocv wrote: post #130

"No we dont need help with making web pages" its just a bunch of html very simple 1990s tags and it still looks and works much better than any html5 css3 bootstrap fanboy page Ive ever seen. Awesomeness

You must be trolling. The site is ugly and I'm sure they would agree. That clearly is not the focus of their work.

"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags."

They know. I find simple HTML like http://cr.yp.to/ to be refreshing sometimes, albeit not "pretty." But with the font and blink tag (powered by CSS), they've gone out of their way to make it a bit ugly. At least they drew a line and don't have headache-inducing colors or animations.

Re: LibreSSL

#258

Post by Crito »

stephen_g wrote: post #21
anaphor wrote: post #7

Earlier quoted context omitted.

Maybe you should consider donating

To me it comes off as pretty childish - turned me off donating really...

Why would you consciously permit yourself to be biased by the appearance of their webpage in such a way?

Re: LibreSSL

#259

Post by boklm »

clarry wrote: post #253
boklm wrote: post #240

Earlier quoted context omitted.

There's many problems that makes it very annoying to review their changes: - CVS commits are per file. You can't see changes made by a single commit to multiple files. - CVS cannot rename files. You have to create a new file and remove the old one. So you cannot follow history of the changes. - CVS is really slow. You cannot clone the repository locally, so it takes a few seconds to show any change, whereas git shows…

> I'm not an openssl expert, so I didn't plan to review their changes anyway Bad excuse. Now if you said you don't know C at all, that'd be reasonable. > But if I had to, using CVS would be the most annoying thing. There's freshbsd, cgit on anoncvs, probably a git repo or two on github. You don't need to touch CVS to view the code and diffs. Blaming the VCS that much is a bunch of lazy excuses. Yes, CVS has its short…

> Blaming the VCS that much is a bunch of lazy excuses.

I'm not blaming CVS as an excuse, because as I said, I didn't plan to review it anyway.

> No it doesn't make code review difficult.

It does make code review difficult, for all the reasons I gave. And I've seen several people who try review it complain about that too.

Re: LibreSSL

#260

Post by Flenser »

DCKing wrote: post #102
abcd_f wrote: post #41

Earlier quoted context omitted.

There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them. If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.

Windows is just a little too different for them to make a proper purge of the project right now. Having Windows support is just a much larger cross-cutting concern than a Unix-like OS, which appears to be the only category of operating system they're currently supporting. Windows will probably get a port some time later on. Remember that OpenSSH's libssh also has Windows support. It's just not something that fits in…

> I like the term flensing they're using

Indeed!

Post reply on HN