OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative • Hacker News Board

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#91

Post by danudey » Fri, May 30, 2014, 6:08 PM UTC

Xylakant wrote: post #83

InclinedPlane wrote: post #82

Earlier quoted context omitted.

> Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago? Moreover, the biggest problem sits with the biggest, and often most capable, internet companies. So having a reasonable path for them to a more secure TLS implementation, even if it meant h…

> You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago? How many years did it take to get there? How many servers are still running apache? > And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager. Eventually, maybe. That's no reason not to audit openss…

The comparison isn't terribly apt; for example, LibreSSL's intention is to be a drop-in replacement for OpenSSL; if nginx were a drop-in replacement for Apache I suspect we would see a lot more people using it than there are now.

As for auditing OpenSSL, the OpenBSD team has found so many problems, misdesigns, misfeatures, idiotic decisions, and bugs, that it seems a shame to repeat that work again. If I had to choose, I'd say give the OpenSSL name to the OpenBSD guys, let them take over the project officially, and let the folks behind the OpenSSL foundation handle things like platform-dependent code, FIPS compliance patches, etc.

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#92

Post by danudey » Fri, May 30, 2014, 6:11 PM UTC

XorNot wrote: post #70

Already__Taken wrote: post #50

Earlier quoted context omitted.

That reads less like Theo being a dick and more like the US making a farce of free speech in that instance.

You have a right to make yourself heard, not be shielded from criticism and other's exercising the right to free association.

Of course, but the reasoning here feels flawed. Person A doesn't approve of war, so we're going to cancel a university project grant to punish him? Not a wonderful way of running a grant program (or a government).

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#93

Post by protomyth » Fri, May 30, 2014, 11:33 PM UTC

lomnakkus wrote: post #22

kyledrake wrote: post #3

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating s…

Maybe I'm misremembering, but SSH wasn't crappy, it was just proprietary. (I'm no fan of proprietary software, but let's at least be honest here.)

you are correct, http://en.wikipedia.org/wiki/OpenSSH

"OpenSSH was created by the OpenBSD team as an alternative to the original SSH software by Tatu Ylönen, which is now proprietary software. Although source code is available for the original SSH, various restrictions are imposed on its use and distribution. OpenSSH was created as a fork of Björn Grönvall's OSSH that itself was a fork of Tatu Ylönen's original free SSH 1.2.12 release, which was the last one having a license suitable for forking."

Re: OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative

#94

Post by daxelrod » Sun, Jun 01, 2014, 2:53 PM UTC

tribaal wrote: post #79

daxelrod wrote: post #71

Earlier quoted context omitted.

Part of my job involves writing software on OpenVMS. We actually just recently ported something that needed OpenSSL and were happy to find an up-to-date version.

Out of curiosity (sorry if that's offtopic), but what kind of workload are you running? Is there anything except resources that prevent you from moving to a more modern platform? Of course, "it works" is a valid argument there, too. But you seem to be writing new code, too.

No, nothing except resources is in the way of completion of a move to a more modern platform. It's coming gradually, but we can't drop everything for a year or two to devote all of our engineering resources to getting us there.

OpenVMS has some really good ideas baked into the OS that we've had to reimplement or find off-the-shelf solutions for our new platform (for example a distributed key-value store (called "logicals"), a job queue system, and a clustered filesystem) but nothing so earth-shattering that it would keep us on VMS.

The biggest downsides are expensive hardware (OpenVMS is designed around clusters of a few beefy boxes, rather than many commodity boxes), lack of community knowledge, and lack of new software available for the platform. (End of life is also looming: http://h71000.www7.hp.com/openvms/openvms_supportchart.html .)