5 ms·

I remember so many people in the open source world angry or annoyed with the OpenBSD team for forking LibreSSL. The fact is it's more than a year later, severa

I remember so many people in the open source world angry or annoyed with the OpenBSD team for forking LibreSSL. The fact is it's more than a year later, several more high-risk vulnerabilities discovered, and OpenSSL has yet to make any noticable changes. Meanwhile those same vulnerabilities were fixed in LibreSSL due to code cleanup and removal.[1] No matter how you feel about the forking or the openbsd team, there is something to be learned here. There are times when forking, deleting old code, and major clean-ups can be very useful strategies. Sunk cost bias can be an enemy of progress. [1] - https://en.wikipedia.org/wiki/LibreSSL#Security_and_vulnerabilities https://en.wikipedia.org/wiki/LibreSSL#Security_and_vulnerab...

timcameronryan 11y ago
I recall a lot of renewed energy a year ago into improving OpenSSL, including funding and support. Has that panned out as I would have hoped? LibreSSL improvements are highly visible (and exciting) but I expect I would have overlooked any OpenSSL improvements.
- Twirrim 11y ago
  There has been a whole bunch of changes and cleanups in OpenSSL, it's just stuff like that doesn't seem to pick up as much traction here (they don't really have the blogging / communicating thing down so well, I guess?) This is the current roadmap. https://www.openssl.org/policies/roadmap.html https://www.openssl.org/policies/roadmap.html Picking out a few highlights: * "Objective met (2015): The FIPS code has been removed from the master branch, and will be re-integrated more cleanly during a future validation. " * "Objective met (2015): All use of dynamic memory allocation has been cleaned up and made consistent, and the internal memory pool has been removed. " Under Coding Style: * "Objective met (2015): All release branches were reformatted using a script included in the release." (so all code now adheres to a consistent style at least, which is a good starting point) And amongst their targeted goals now: * Legacy platforms that are unlikely to have wide deployment will be removed from the code. .. but .. * Non-supported platforms requiring regular maintenance activities will eventually be removed from the code after first seeking community owners to support the platforms in platform specific repositories. Not convinced that's necessarily the right route, but I can appreciate where they're coming from.
LukeShu 11y ago
I'm curious what circles you run in in the open source world. In my little corner of it, most everyone had nothing but excitement and support for LibreSSL.
- mrweasel 11y ago
  I do seem to recall some complaining about the tone the OpenBSD developers used, but they where not really getting anywhere by being nice either. Also some complaining about them not helping to fix OpenSSL instead.
- neoCrimeLabs 11y ago
  I was employed at a large open-source organization at the time of the fork. A conversation I participated in was specifically along the lines of (broad paraphrasing here) "They should be contributing their changes back to OpenSSL versus forking". While attending a security conference in Vancouver earlier this year, someone commented that they thought the OpenBSD team was childish for forking LibreSSL, and several people chimed in with agreement. Of course this is all hear-say for you, and your experiences may vary. I've met more than a handful of people who did not like the fork. There are lots of people in the world, and they all have different opinions.
  - pix64 11y ago
    OpenSSL wouldn't have accepted a lot of changes. Dropping legacy OS support or not caring about FIPS for examples.
  - angersock 11y ago
    So, forking is pretty much the only way to do proper code cleanup in a timely fashion, right? If you don't, people still clamor for legacy support and bug-for-bug compatibility. A fork is the only way of truly signalling "We aren't going to support our old mistakes anymore." New features don't need forks, but cleaning up raging stupid and cruft does.
    - neoCrimeLabs 11y ago

timcameronryan 11y ago

I recall a lot of renewed energy a year ago into improving OpenSSL, including funding and support. Has that panned out as I would have hoped? LibreSSL improvements are highly visible (and exciting) but I expect I would have overlooked any OpenSSL improvements.

Twirrim 11y ago
There has been a whole bunch of changes and cleanups in OpenSSL, it's just stuff like that doesn't seem to pick up as much traction here (they don't really have the blogging / communicating thing down so well, I guess?) This is the current roadmap. https://www.openssl.org/policies/roadmap.html https://www.openssl.org/policies/roadmap.html Picking out a few highlights: * "Objective met (2015): The FIPS code has been removed from the master branch, and will be re-integrated more cleanly during a future validation. " * "Objective met (2015): All use of dynamic memory allocation has been cleaned up and made consistent, and the internal memory pool has been removed. " Under Coding Style: * "Objective met (2015): All release branches were reformatted using a script included in the release." (so all code now adheres to a consistent style at least, which is a good starting point) And amongst their targeted goals now: * Legacy platforms that are unlikely to have wide deployment will be removed from the code. .. but .. * Non-supported platforms requiring regular maintenance activities will eventually be removed from the code after first seeking community owners to support the platforms in platform specific repositories. Not convinced that's necessarily the right route, but I can appreciate where they're coming from.

LukeShu 11y ago

I'm curious what circles you run in in the open source world. In my little corner of it, most everyone had nothing but excitement and support for LibreSSL.

mrweasel 11y ago
I do seem to recall some complaining about the tone the OpenBSD developers used, but they where not really getting anywhere by being nice either. Also some complaining about them not helping to fix OpenSSL instead.
neoCrimeLabs 11y ago
I was employed at a large open-source organization at the time of the fork. A conversation I participated in was specifically along the lines of (broad paraphrasing here) "They should be contributing their changes back to OpenSSL versus forking". While attending a security conference in Vancouver earlier this year, someone commented that they thought the OpenBSD team was childish for forking LibreSSL, and several people chimed in with agreement. Of course this is all hear-say for you, and your experiences may vary. I've met more than a handful of people who did not like the fork. There are lots of people in the world, and they all have different opinions.
- pix64 11y ago
  OpenSSL wouldn't have accepted a lot of changes. Dropping legacy OS support or not caring about FIPS for examples.
- angersock 11y ago
  So, forking is pretty much the only way to do proper code cleanup in a timely fashion, right? If you don't, people still clamor for legacy support and bug-for-bug compatibility. A fork is the only way of truly signalling "We aren't going to support our old mistakes anymore." New features don't need forks, but cleaning up raging stupid and cruft does.
  - neoCrimeLabs 11y ago