Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

41–50 of 262 posts

Re: LibreSSL

#41

Post by abcd_f »

bananas wrote: post #36
abcd_f wrote: post #34

> removed MacOS, Netware, OS/2, VMS and Windows build machinery What are the plans for native Windows support? I don't know what they mean by "The right Portability team in place", but it'd be a joke if the lib would require CygWin or some other external portability scaffolding. And without proper Windows support LibreSSL will simply fragment OpenSSL user base. I guess it's still better than nothing, but it definitel…

Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.

There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them.

If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.

Re: LibreSSL

#42

Post by Bluerise »

antirez wrote: post #31

I imagine supporting non-POSIX operating systems, or not exactly conforming ones, to have its challenges, but is it really hard to make this stuff working in Linux and Open/NET/Free BSD from day one? It seems to me a better approach to start this way, without to mention that the potential developers base you get if you support Linux ASAP can be larger.

They don't care about that. Their main interest is to have a library conforming to OpenBSD standards.

Re: LibreSSL

#43

Post by bananas »

thebackwardsman wrote: post #38
sarahj wrote: post #19

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing…

Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.

I'd hope that I speak for the majority here when I say that OpenSSL has had its chance.

This is the beauty of open source, nothing more. We can take this and make it better.

Re: LibreSSL

#44

Post by mehrdada »

One annoying thing about OpenSSL is its license. I hope The Better Replacement™ fixes that as well (especially if its name gets to contain the string "Libre"), and it is not going to happen by forking OpenSSL.

Re: LibreSSL

#45

Post by bananas »

abcd_f wrote: post #41
bananas wrote: post #36

Earlier quoted context omitted.

Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.

There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them. If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.

Well I disagree. Whilst it's a natural choice for portability, when you port to a proprietary platform such as windows you lose a lot of the support and portability guarantees that POSIX gives you and the calling conventions and standards of many libraries. At this point it's advisable to pick a holistic 3rd party abstraction over this such as something right from APR to Qt that will abstract the platform specific implementation away.

Some people write a lot of stuff plugged into Win32 without considering the CSPs and pull in OpenSSL without thought. Their funeral.

As my father said: "when in France, talk French or hire a translator".

Re: LibreSSL

#47

Post by repsilat »

anaphor wrote: post #13
edent wrote: post #10

Somewhat ironic that https://www.libressl.org/ doesn't work, no?

Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.

>(not even source code or binaries

The real see site doesn't have those things, but a MITM'd unsecured version might.

Re: LibreSSL

#48

Post by codecondo »

I was going to ASK HN, when are we going to see a replacement for OpenSSL; you know, the company that has much more field experience, or even understanding of how SSL operates.

I then thought to myself, that'd be going too far..and nobody is really going to try and make an alternative.

Oh boy..

Re: LibreSSL

#49

Post by vayarajesh »

okamiueru wrote: post #40
vayarajesh wrote: post #24

Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

Mine doesn't show up in comic sans. However, the link to OpenSSL is to We're Not Gonna Take It ( http://www.youtube.com/watch?v=mRCGDUsdRDU )... This all seems like a joke to me.

Check the footer (last line) of the page.. its just a page for donation to get rid of comic sans :)

Re: LibreSSL

#50

Post by greatsuccess »

Before you guys get too high and mighty. Refactoring openSSL is pretty fucking trivial. Fixing these bugs is also massively fucking trivial.

Whats not trivial is that we as a community are using bug-ridden zero day software all the time, and we dont know because our profession is essentially a joke.

Before you write the next clever comment think about that. You and by extension, I and by extension WE, are a total fucking joke.

Post reply on HN