Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LibreSSL

libressl.org

Post reply on HN
Print view View original

91–100 of 262 posts

Re: LibreSSL

#91

Post by frik »

abcd_f wrote: post #34

> removed MacOS, Netware, OS/2, VMS and Windows build machinery What are the plans for native Windows support? I don't know what they mean by "The right Portability team in place", but it'd be a joke if the lib would require CygWin or some other external portability scaffolding. And without proper Windows support LibreSSL will simply fragment OpenSSL user base. I guess it's still better than nothing, but it definitel…

maybe it's better to switch to NSS, the original SSL library developed by Netscape (now by Mozilla, Google, etc.), that is available under better open source licenses, is used in Firefox, (Chrome), OpenOffice, etc. and has an optional compatible API to OpenSSL: http://en.wikipedia.org/wiki/Network_Security_Services

Re: LibreSSL

#92

Post by Jare »

phlo wrote: post #27
anaphor wrote: post #13

Earlier quoted context omitted.

Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.

StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used…

I bet StartSSL would happily (and publicly) waive any revoke fees to FOSS SSL software projects.

Re: LibreSSL

#93

Post by huhtenberg »

whatevsbro wrote: post #66
huhtenberg wrote: post #60

Earlier quoted context omitted.

This is all great, but the fact remains that OpenSSL is very widely used on Windows and yanking it out without providing a drop-in replacement option is a bad idea. We can debate finer nuances of proper abstraction to the death, but it doesn't move a needle for people who already have OpenSSL dependencies in their code.

> the fact remains that OpenSSL is very widely used on Windows and yanking it out without providing a drop-in replacement option is a bad idea The LibreSSL guys are not yanking anything out of Windows, they're just providing an alternative to OpenSSL, for all the world to use, for free . They're not under any obligation to support Windows, no matter how bad you want them to.

I don't expect them to support Windows, you misunderstand the whole concern.

The concern is that OpenBSD fellas are fragmenting the project and they are also asserting that OpenSSL team was doing things wrong for a long time. This is not a start of a beautiful friendship. Throw in a bit of crowd lynching (to the tune of "OpenBSD is showing OpenSSL how to do security right") and we can end up with OpenSSL devs showing a finger and throwing in a towel. At best, we'll have to related SSL implementations, devs of which don't really talk to each other. That's the issue.

Re: LibreSSL

#94

Post by mrweasel »

boklm wrote: post #88
mrweasel wrote: post #70

Earlier quoted context omitted.

Why are people so obsessed with getting the OpenBSD developers to move from CVS? If it works for them and do what they need there's no need to move.

Because people might be interested to review their changes, and CVS makes that very difficult.

How so? CVS do make branching and merging rather annoying, but I don't see how reviewing changes becomes difficult. It's a lot easier to track the changes to the entire OpenBSD source three, compared to the Linux kernel.

Git and Mercurial are extremely nice tools, but the flow of patches and branches quickly become rather hard to follow. CVS doesn't have most of the features that newer tools have, so there's stuff you simply can't do, but it is extremely easy to follow the code.

Re: LibreSSL

#95

Post by rakoo »

DiabloD3 wrote: post #5

Comic Sans? Really? Edit: To those downvoting, yes, I saw the footer. This doesn't excuse their childish behavior. I will not be donating to this project if this is the level of seriousness they have for it.

You know, what you really care about is them spending time on writing good software, not writing good websites. They don't have time for this, they don't have money for this, and they don't want to spend human CPU on this.

Oh, and while we're at it, the OpenSSL page [0] isn't much better visually speaking. Would you donate to them to make OpenSSL better ?

[0] https://www.openssl.org/

Re: LibreSSL

#96

Post by zorbo »

Confusion wrote: post #85

Has anyone seen an explanation for why this effort isn't being undertaken together with the OpenSSL team?

I haven't seen an explanation for it, but one reasonable guess would be momentum. If you want to get work done, you don't want to have to wade through red-tape and bureaucracy to get it done. You don't want to work on something with the risk of it being shot-down by the current maintainers. This is not a criticism of the OpenSSL team, it's just a fact of life that it's often easier to "start fresh" than to try to change an already established routine.

I also suspect that part of the reason is because OpenBSD just doesn't work well with others.

Re: LibreSSL

#98

Post by icebraining »

tragic wrote: post #79
keyle wrote: post #12

Earlier quoted context omitted.

I was about to post the exact same question. And if that's supposed to promote donations... (?!) Ask yourself if a founder dresses as a clown to get funding.

Ask yourself which hipster start-up is going to do a comprehensive rewrite job on OpenSSL - or, for that matter, which SV VC is going to bung a few million green sheets into something like this (which, if we're honest, we could all do with happening, rather than the next DOA social media start up with a -ly/-able/-r suffix). If these people are prepared to take this on, then they can use whatever fonts they bloody we…

Firefox dumped it in version 23, and they did report that on the changelog[1]. jwz even wrote a post lamenting it[2].

[1] https://www.mozilla.org/en-US/firefox/23.0/releasenotes/

[2] http://www.jwz.org/blog/2013/08/a-light-has-gone-out-on-the-...

Re: LibreSSL

#99

Post by Sanddancer »

antirez wrote: post #73
Sanddancer wrote: post #59

Earlier quoted context omitted.

OpenBSD cares about their own first and foremost. OpenSSH has a similar porting team, and has since the beginning, and there have been no problems there.

"OpenBSD cares about their own first and foremost.". This is their choice, but their impact in the security of IT is much smaller this way because most servers are running Linux. It is surely a great result to have an operating system like OpenBSD that can be proud of the security level reached and the small amount of vulnerabilities over the years, however if you analyze the computer security problem from a vendor-n…

I'd disagree. As I wrote in the second half of my post, they do the same thing for OpenSSH, and I don't think anyone will say OpenSSH has had a minimal impact on IT security. One of the reasons they develop this way is that they can work with a known set of functions, etc, which may not be available on other platforms, and then have people who grok portability handle that part of the puzzle. Additionally, functions and libraries that are not used in the OpenBSD world, like PAM integration, can be maintained by people who understand all the security implications of those libraries.

I don't use OpenBSD for my own environments, but at the same time, I can understand why they code the way they do. Everyone ends up a biased toward their platform of choice in how they code, what functions they use, etc, it's just that the OpenBSD team is militantly upfront and open in their biases. Given their track record in creating secure software, and in auditing others' software, I'd argue their end result is appreciable, even if I'm not directly using those results.

Re: LibreSSL

#100

Post by Gigablah »

mrweasel wrote: post #84
thebackwardsman wrote: post #38

Earlier quoted context omitted.

Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.

I get your point, but let's face it, the OpenBSD developers have done more to fix OpenSSL in the last two weeks that the OpenSSL developers done the last two years. Some of the bug fixes have been pull from OpenSSLs bugtracker, they've just sat there for one or two years. This should make you think about what motivates the OpenSSL developers, my guess would be new crypto algorithms and the math, rather than maintaini…

> There's no point in ostracising the OpenSSL developers

Which is exactly what the entire "community" has been doing for the past few weeks.

Disappointing.

Post reply on HN