Shouldn't take too long, though. It's still about 10kSLoC and it's been more/less feature frozen for over a year. I get the feeling that it's already probably safer than most deployed VPN systems. Most of the recent work seems to be forward porting, reworking the ratelimiter, and tweaks to the treatment of randomness.
If by 10kLoC you actually mean less than 4kLoC, then I agree with you. :)
There's more than 10k lines of C in the repository, 8200 lines of assembly, and almost three thousand lines of headers. Your kernel module is definitely smaller than the whole repo. I feel like I've just called you fat. ;- )
> you have to quadruple check each function invocation with the docs to make sure you got it right. If the docs contain that information ¯\_(ツ)_/¯
There's always a trade-off between how complicated the docs and usage are and how many people will use it. OpenSSL is problematic because it has very complicated docs and usage, but people still used it anyway . This leads to a situation where people use it incorrectly, and for a crypto library, that's a very bad thing. If OpenSSL wasn't the de facto king of OSS crypto libraries for so long (partly because it was the…
> If OpenSSL wasn't the de facto king of OSS crypto libraries for so long (partly because it was the only one for so long),
Netscape released the NSS library in 1998, and as far as I can tell it hasn't even changed its ABI incompatibly since 2000, but perhaps this is too recent for programmers to take notice.
There's always a trade-off between how complicated the docs and usage are and how many people will use it. OpenSSL is problematic because it has very complicated docs and usage, but people still used it anyway . This leads to a situation where people use it incorrectly, and for a crypto library, that's a very bad thing. If OpenSSL wasn't the de facto king of OSS crypto libraries for so long (partly because it was the…
> If OpenSSL wasn't the de facto king of OSS crypto libraries for so long (partly because it was the only one for so long), Netscape released the NSS library in 1998, and as far as I can tell it hasn't even changed its ABI incompatibly since 2000, but perhaps this is too recent for programmers to take notice.
I have no idea why NSS never got more use, but it didn't, for the most part. I assume there's a reason, but for the most part major adoption seemed to have been limited to Mozilla projects, Sun Enterprise Java, and OpenOffice (possibly because it also originated from a Sun project, and it seems to have enjoyed some popularity at Sun). If I had to make a wild guess from that info, it would be that it's more complex to work with, as odd as that sounds given the current context (although I guess it's possible OpenSSL got more complex over time, and was much simpler a decade ago).
A benefit of installing using your system package manager is that you can rely on your distro to manage the security of the package. If you just `pip install` it, you need to personally watch for new security bugs and upgrade (or backport them to your current version, which is what e.g. Debian will do for you). You'd also need to do that for all of the dependencies. Up to you if you trust your distro's security team,…
I did not say anything about package managers. I trust my distro and its suppplied packages just like you trust yours and aim to use official packages as much as I can. The instructions in README.md say "sudo pip install" and "sudo ./setup.py". To me, that is a bad idea. Things that are manually installed should be kept in completely separate directories. My preference is to install such packages in my home directory…
I agree. Looks like I only noticed the apt-get install line and incorrectly assumed that's what you were referring to.
The LibreSSL fork tries to do exactly that: Although they still provide the original OpenSSL API for existing applications, they add a much simpler and hassle-free API on top of it ("libtls" [1]), with the goal that all applications will be switched part-by-part to the new interface. [1] https://www.openbsd.org/papers/libtls-fsec-2015/
Does it make sense to stop recommending OpenSSL and start recommending LibreSSL now?
Yes, if only because LibreSSL is still a working drop-in replacement (which is nice to have as a first step of adoption), and because in LibreSSL they threw away lots of legacy code.
This throwing away of legacy code should not be underestimated. There were quite a lot of recent OpenSSL security issues from which LibreSSL had just a fraction, simply because the vulnerable code is no longer present at all in LibreSSL.
> If OpenSSL wasn't the de facto king of OSS crypto libraries for so long (partly because it was the only one for so long), Netscape released the NSS library in 1998, and as far as I can tell it hasn't even changed its ABI incompatibly since 2000, but perhaps this is too recent for programmers to take notice.
I have no idea why NSS never got more use, but it didn't, for the most part. I assume there's a reason, but for the most part major adoption seemed to have been limited to Mozilla projects, Sun Enterprise Java, and OpenOffice (possibly because it also originated from a Sun project, and it seems to have enjoyed some popularity at Sun). If I had to make a wild guess from that info, it would be that it's more complex to…
For one, NSS is not the kitchen sync that is openssl. With openssl you can do anything with any file you can get from the anywhere.
Secondly, when using openssl-based servers it's usually easier to specify certificates and keys. You don't have to import them into a database, you only configure the filesystem path.
Yup. Most VPNs with decent bandwith cost $4/month. You can get pretty much the same service for $4/year if you buy a cheap NAT VPS server and spend 10 minutes setting up openvpn.
Could you point me towards a $4/Year VPS ? Would gladly buy it.
I bought mine from
https://i-83.net/
It's £4.50/year, but you can probably find promotion codes that'll make it cheaper.