Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

linuxfoundation.org

Post reply on HN
Print view View original

61–70 of 94 posts

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#61

Post by ivoras »

clarry wrote: post #20
Alupis wrote: post #14

Earlier quoted context omitted.

No it's not. Libressl is a different team; one that feels a fork was more appropriate than just fixing the problems in openssl. IMHO, libressl is a mistake. It's splitting resources over something that needs to be as air-tight as possible. I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones.

> No it's not. Libressl is a different team OpenSSH and LibreSSL are both a part of OpenBSD. So when you donate to the OpenBSD Foundation, you are very much donating to one project. > one that feels a fork was more appropriate than just fixing the problems in openssl You can't start fixing things in other peoples' source tree just like that. I'm pretty sure nothing useful would've come out of it if the OpenBSD folk h…

Anyone interested in details of LibreSSL development can watch the BSDCan talk at https://www.youtube.com/watch?v=oM6S7FEUfkU - there really are a LOT of instances of braindamaged code in OpenSSL and a radical repair is pretty much the only thing which will work.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#62

Post by Florin_Andrei »

gnuvince wrote: post #40
akerl_ wrote: post #24

Earlier quoted context omitted.

Most of the "Linus being a dick" examples are him being a dick to developers, and several of those cases are "him being a dick to developers because they did something that affects users". That's the kind of thing that's good for PR more than bad for it, because when Linus rages at a developer for breaking things, a large portion of users think "Linus has my back".

And that's not the case with Theo?

Oh, c'mon, give it a rest. Linus, while not necessarily mild-mannered, "gets" people. Theo sounds a lot like a socially clueless ubergeek. They are both abrasive superficially, but Linus is aware of the "meta", or strategic, level in human interactions, and knows when to back off; Theo is blind to it. That much is obvious even from a cursory glance.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#63

Post by rodgerd »

kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

> Why does everyone have this aversion to giving the OpenBSD team the funding they deserve?

Given their work is avowdly OpenBSD-only and portability has to be added on in the case of e.g. OpenSSH it would seem a dead-end for anyone who wants broader platform support.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#64

Post by kzrdude »

tptacek wrote: post #53
marcosdumay wrote: post #46

Earlier quoted context omitted.

A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs. A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography. Anyway, they should send money to both. Both are important, and those companies make so much money using free soft…

Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL, which isn't even complete, the virtues of auditing the OpenSSL codebase seem pretty straightforward to me. How much have you donated to open audit projects? I've donated a bit, and I would be pissed to find out that my money was redirected from an audit to a rewrite. I am not in the least bit interested in the Theo vs. Whoever dra…

The vulnerabilities in OpenSSL seem to be symptoms of a wider problem, systemic problem, that comes from their project management.

It seems appropriate to point out that auditing and fixing the details is just patching symptoms -- and that many think a longer-term solution is needed.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#65

Post by protomyth »

rodgerd wrote: post #63
kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

> Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? Given their work is avowdly OpenBSD-only and portability has to be added on in the case of e.g. OpenSSH it would seem a dead-end for anyone who wants broader platform support.

Strange characterization given OpenSSH is everywhere so it isn't a dead-end.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#66

Post by rgbrenner »

awj wrote: post #19
allendoerfer wrote: post #2

When the missing funding of OpenSSL was discussed, it came up several times, that OpenSSH, while doing great, is quite underfunded, too. I am glad to see them getting some money. What i can't really comment on myself, but am reading from the OpenBSD guys is, that the OpenSSL team does quite well with FIPS consulting and has no increased interest in improving the library.[0] Even if those claims are not true, it would…

Straight from the horse's mouth[1] > Also, the income they earn though their paid consulting work supports their unpaid work on OpenSSL, so by hiring OpenSSL team members you are not only solving your own problems but also helping to ensure the long term viability of the OpenSSL product. They also on their website list hourly consulting starting at $250/hour. Neither of these describe how much they get out of this, b…

"but it seems reasonable to say that the "OpenSSL runs of $2k/year" line is disingenuous at best."

Is it? The last contract listed on that page is 4 years old. Maybe they don't regularly get contracts.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#67

Post by pjscott »

orik wrote: post #45

If OpenSSL software foundation is a for profit operation, why are tech companies funding it(1) instead of LibreSSL? 1: http://arstechnica.com/information-technology/2014/04/tech-g... .

The tech companies want OpenSSL to improve, and are willing to pay money; the OpenSSL guys will improve OpenSSL if paid money. What's the problem here?

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#68

Post by axman6 »

rodgerd wrote: post #63
kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

> Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? Given their work is avowdly OpenBSD-only and portability has to be added on in the case of e.g. OpenSSH it would seem a dead-end for anyone who wants broader platform support.

They've explicitly said that they are seeking to reduce the surface area for bugs by initially removing cross platform compatibility, and then exposing what primitives the OS needs to supply to make it possible to port. This seems like a much much saner approach to me than trying to work through every quirk in every operating system known to man in the one project itself. Any OS that doesn't implement any of the primitives can legally go and take OpenBSD's implementation and use it if necessary (and hopefully contribute money or code back to them).

I'm not sure why you brought up OpenSSH, since it's by far the most widely used SSh implementation in the world...

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#69

Post by XorNot »

axman6 wrote: post #68
rodgerd wrote: post #63

Earlier quoted context omitted.

> Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? Given their work is avowdly OpenBSD-only and portability has to be added on in the case of e.g. OpenSSH it would seem a dead-end for anyone who wants broader platform support.

They've explicitly said that they are seeking to reduce the surface area for bugs by initially removing cross platform compatibility, and then exposing what primitives the OS needs to supply to make it possible to port. This seems like a much much saner approach to me than trying to work through every quirk in every operating system known to man in the one project itself. Any OS that doesn't implement any of the prim…

The point is that no one wants to fund a team who won't produce a final working product for the system they're running.

Linux Foundation wants things which run on Linux. Trying to figure out how you fund the BSD version + porting effort leads to a weird incentive scheme.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#70

Post by XorNot »

Already__Taken wrote: post #50
dfc wrote: post #32

Earlier quoted context omitted.

Theo's "outspokeness" is believed to be the reason that DARPA canceled a million dollar development grant. https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_ca...

That reads less like Theo being a dick and more like the US making a farce of free speech in that instance.

You have a right to make yourself heard, not be shielded from criticism and other's exercising the right to free association.
Post reply on HN