Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The State of OpenSSL for pyca/cryptography

cryptography.io

Post reply on HN
Print view View original

61–65 of 65 posts

Re: The State of OpenSSL for pyca/cryptography

#61

Post by PunchyHamster »

tptacek wrote: post #31
timschmidt wrote: post #28

Earlier quoted context omitted.

I am not surprised at all, because instead of throwing their support behind the LibreSSL folks who audited the OpenSSL codebase after Heartbleed and found deep design and implementation issues, Linux Foundation and member orgs including most of Silicon Valley decided that OpenSSL just needed more funding. Felt like good money after bad on day 1.

The problem with the OpenSSL 3 codebase isn't security; many organizations, including the OpenSSL team itself, have been responsible for pulling out of the security rut OpenSSL was in when Heartbleed happened. The OpenSSL 3 problem is something else.

so, incompetence of people writing it

Re: The State of OpenSSL for pyca/cryptography

#62

Post by tptacek »

PunchyHamster wrote: post #61
tptacek wrote: post #31

Earlier quoted context omitted.

The problem with the OpenSSL 3 codebase isn't security; many organizations, including the OpenSSL team itself, have been responsible for pulling out of the security rut OpenSSL was in when Heartbleed happened. The OpenSSL 3 problem is something else.

so, incompetence of people writing it

If you don't have anything meaningful to say, you can just not comment.

Re: The State of OpenSSL for pyca/cryptography

#63

Post by jiggawatts »

tuetuopay wrote: post #49

> OpenSSL allowed replacing any algorithm at any point in program execution Just this is completely nuts. What in the world is the usecase for this? Fanatics of hotpatching systems for zero-downtime-ever? No wonder the performance is crippled by locks left and right, it's pure recipe for disaster.

I’ve done this kind of thing before: I wrote a 3D game engine that could switch between DirectX and OpenGL at runtime and also switch GPUs dynamically.

At some point the architecture becomes a toy to play with, like a train set. Trying to push the abstractions as far as they can possibly go within the bounds of the parent language is a fun challenge to tackle.

Of course, this is pointless and even counterproductive. I only did this decades ago when I was a junior developer. With more experience I now deeply appreciate simple, straightforward, to-the-point code.

I tell juniors: “Just do the thing.”

Re: The State of OpenSSL for pyca/cryptography

#65

Post by snvzz »

Instead of everybody switching to LibreSSL, we had the Linux Foundation reward OpenSSL's incompetence with funding.

We are still suffering from that mistake, and LibreSSL is well-maintained and easier to migrate to than it ever was.

What the hell are we waiting for?

Is nobody at Debian, Fedora or Ubuntu able to step forward and set the direction?

Post reply on HN