Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

linuxfoundation.org

Post reply on HN
Print view View original

71–80 of 94 posts

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#71

Post by daxelrod »

jimktrains2 wrote: post #18
wmf wrote: post #17

Earlier quoted context omitted.

Is the OpenSSL developers willing to drop support for 16 bit Windows or OpenVMS? They either need to properly maintain it or drop it, and they don't have enough money to maintain it.

I just want to know who's still compiling against 16bit windows or OpenVMS. I know my world view isn't infinite, but those systems seem a bit out there.

Part of my job involves writing software on OpenVMS. We actually just recently ported something that needed OpenSSL and were happy to find an up-to-date version.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#72

Post by tptacek »

kzrdude wrote: post #64
tptacek wrote: post #53

Earlier quoted context omitted.

Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL, which isn't even complete, the virtues of auditing the OpenSSL codebase seem pretty straightforward to me. How much have you donated to open audit projects? I've donated a bit, and I would be pissed to find out that my money was redirected from an audit to a rewrite. I am not in the least bit interested in the Theo vs. Whoever dra…

The vulnerabilities in OpenSSL seem to be symptoms of a wider problem, systemic problem, that comes from their project management. It seems appropriate to point out that auditing and fixing the details is just patching symptoms -- and that many think a longer-term solution is needed.

In the context of a funded audit, this is about as meaningful to me as the complaint that OpenSSL is insecure because it's written in C --- which is also true.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#73

Post by tytso »

orik wrote: post #45

If OpenSSL software foundation is a for profit operation, why are tech companies funding it(1) instead of LibreSSL? 1: http://arstechnica.com/information-technology/2014/04/tech-g... .

The CII is not funding the OpenSSL Foundation; it is directly funding two OpenSSL developers, so they can work on whatever is best for OpenSSL, instead of whatever feature improvements contracted by the OpenSSL Foundation.

As a result, the people behind the OpenSSL Foundation are NOT taking a cut of the monies from the CII.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#74

Post by gonzo »

tptacek wrote: post #72
kzrdude wrote: post #64

Earlier quoted context omitted.

The vulnerabilities in OpenSSL seem to be symptoms of a wider problem, systemic problem, that comes from their project management. It seems appropriate to point out that auditing and fixing the details is just patching symptoms -- and that many think a longer-term solution is needed.

In the context of a funded audit, this is about as meaningful to me as the complaint that OpenSSL is insecure because it's written in C --- which is also true.

Consider that OpenSSL is able to look at libressl and choose the good parts, preserving interoperability (.vs openbsd only).

The reasons to fund the audit, and two full time devs, are clear.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#75

Post by gonzo »

protomyth wrote: post #54
avar wrote: post #35

Earlier quoted context omitted.

Is it possible to give them more granular donations? I want to support OpenSSH and LibreSSL, but I don't cae about OpenBSD. The reason I don't donate to them is that I feel like most of my donation will be going towards something I don't care about.

Its one and the same, plus if you care about LibreSSL and OpenSSH than you need to care about OpenBSD because of the assumptions that code makes and what needs to added to the ported code to make it safe on other platforms.

Horse feathers.

Consider that ntp.org is being funded, not OpenBSD (and their inferior OpenNTP).

NTP is infrastructure. OpenBSD is not.

Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project).

OpenSSL is infrastructure.

OpenSSH got some funding, because it is widely used. It is infrastructure, not 3-5 people scratching an itch in a project.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#76

Post by simula67 »

tptacek wrote: post #26
kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with w…

From Beck's talk[1] they are not reviewing the cryptography code, merely cleaning up the programming. They admit they don't yet have cryptography experts reviewing if the algorithms/implementations are doing what they are supposed to be doing and that they are in fact secure.

[1] http://www.youtube.com/watch?v=GnBbhXBDmwU

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#77

Post by stephen_g »

Alupis wrote: post #27
clarry wrote: post #20

Earlier quoted context omitted.

> No it's not. Libressl is a different team OpenSSH and LibreSSL are both a part of OpenBSD. So when you donate to the OpenBSD Foundation, you are very much donating to one project. > one that feels a fork was more appropriate than just fixing the problems in openssl You can't start fixing things in other peoples' source tree just like that. I'm pretty sure nothing useful would've come out of it if the OpenBSD folk h…

> You can't start fixing things in other peoples' source tree just like that. Yes, you can. It's called contributing to a project. If the "half million lines of diffs" were actually things needing fixing, then the upstream team would accept them. If they are not necessary changes (such as ripping out all windows compatibility), then no, they would reject such changes. It will take years, maybe a decade before a new s…

> It will take years, maybe a decade before a new ssl library becomes the "default". OpenSSL has a lot of ground covered and a lot of history.

Why? The LibreSSL team are keeping the API backwards compatible, so it will literally be a drop-in replacement (once there are ports to other platforms). It should just require a recompile.

Since the barrier to entry will be fairly low, it is foreseeable that it could become popular quite quickly.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#78

Post by [deleted] »

XorNot wrote: post #70
Already__Taken wrote: post #50

Earlier quoted context omitted.

That reads less like Theo being a dick and more like the US making a farce of free speech in that instance.

You have a right to make yourself heard, not be shielded from criticism and other's exercising the right to free association.

[deleted]

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#79

Post by tribaal »

daxelrod wrote: post #71
jimktrains2 wrote: post #18

Earlier quoted context omitted.

I just want to know who's still compiling against 16bit windows or OpenVMS. I know my world view isn't infinite, but those systems seem a bit out there.

Part of my job involves writing software on OpenVMS. We actually just recently ported something that needed OpenSSL and were happy to find an up-to-date version.

Out of curiosity (sorry if that's offtopic), but what kind of workload are you running?

Is there anything except resources that prevent you from moving to a more modern platform? Of course, "it works" is a valid argument there, too. But you seem to be writing new code, too.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#80

Post by stevekemp »

tptacek wrote: post #53
marcosdumay wrote: post #46

Earlier quoted context omitted.

A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs. A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography. Anyway, they should send money to both. Both are important, and those companies make so much money using free soft…

Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL, which isn't even complete, the virtues of auditing the OpenSSL codebase seem pretty straightforward to me. How much have you donated to open audit projects? I've donated a bit, and I would be pissed to find out that my money was redirected from an audit to a rewrite. I am not in the least bit interested in the Theo vs. Whoever dra…

> How much have you donated to open audit projects?

Personally I've never donated for auditing, but in my free time I do look at code myself.

Today I had to install a proxy server, so I downloaded the source to Apache's traffic server. Within five minutes I'd decided that the code contained enough problems that I couldn't recommend using it.

Now I've reported those bugs, and made a contribution..

Post reply on HN