4 ms·

Go see the talk on the reasons for the LibreSSL fork. Don't just fear the worst, know the worst.

mrweasel 10y ago
Bob Becks talk on LibreSSL is really informative, scary and entertaining. https://www.youtube.com/watch?v=-4psTQ1sX7s https://www.youtube.com/watch?v=-4psTQ1sX7s
- qwertyuiop924 10y ago
  That's the one I was talking about. Sorry, I didn't have the link on me.
- protomyth 10y ago
  This is the other one given by Bob Beck https://www.youtube.com/watch?v=GnBbhXBDmwU https://www.youtube.com/watch?v=GnBbhXBDmwU - bit different conversation, but same slides
gpvos 10y ago
Oh, I saw that. I just want to forget it.
- protomyth 10y ago
  The "Big Endian AMD 64 support" slide and discussion should be required viewing in a CompSci ethics class.
  - nickpsecurity 10y ago
    Is that the one where they check for endianness changes while the program is running? One of those moments where I was stunned by the stupidity of what I was hearing.
    - protomyth 10y ago
      Yep. Hearing that solution to the problem was just beyond reason. Its like they didn't just set some compile flags and constants for the architecture, but decided that their code had to calculate it every time the variable is needed. The line about finding if /dev/null moved was also pretty scary.
      - nickpsecurity 10y ago
        I remember cracking up then forwarding it to all kinds of people and forums. Along the lines of "remember this" if you try to justify trusting the OpenSSL codebase for anything.
        qwertyuiop924 10y ago
        ...Which is why LibreSSL was started in the first place: Trusting OSSL is fundamentally insane.
      - gpvos 10y ago
        > finding if /dev/null moved Couldn't find that, do you have a reference somewhere? (I only watched the video that mrweasel posted.)
        protomyth 10y ago
        43:16 into the video I posted https://www.youtube.com/watch?v=-4psTQ1sX7s https://www.youtube.com/watch?v=-4psTQ1sX7s
    - qwertyuiop924 10y ago
      The OSSL outlook is that both the OS and the hardware were designed by untrustworthy, paranoid, schizophrenics who wanted OSSL crash and burn. I wouldn't expect intelligence, sanity, rhyme, or reason.

Bob Becks talk on LibreSSL is really informative, scary and entertaining. https://www.youtube.com/watch?v=-4psTQ1sX7s https://www.youtube.com/watch?v=-4psTQ1sX7s

qwertyuiop924 10y ago
That's the one I was talking about. Sorry, I didn't have the link on me.
protomyth 10y ago
This is the other one given by Bob Beck https://www.youtube.com/watch?v=GnBbhXBDmwU https://www.youtube.com/watch?v=GnBbhXBDmwU - bit different conversation, but same slides

gpvos 10y ago

Oh, I saw that. I just want to forget it.

protomyth 10y ago
The "Big Endian AMD 64 support" slide and discussion should be required viewing in a CompSci ethics class.
- nickpsecurity 10y ago
  Is that the one where they check for endianness changes while the program is running? One of those moments where I was stunned by the stupidity of what I was hearing.
  - protomyth 10y ago
    Yep. Hearing that solution to the problem was just beyond reason. Its like they didn't just set some compile flags and constants for the architecture, but decided that their code had to calculate it every time the variable is needed. The line about finding if /dev/null moved was also pretty scary.
    - nickpsecurity 10y ago
      I remember cracking up then forwarding it to all kinds of people and forums. Along the lines of "remember this" if you try to justify trusting the OpenSSL codebase for anything.
      - qwertyuiop924 10y ago
        ...Which is why LibreSSL was started in the first place: Trusting OSSL is fundamentally insane.
    - gpvos 10y ago
      > finding if /dev/null moved Couldn't find that, do you have a reference somewhere? (I only watched the video that mrweasel posted.)
      - protomyth 10y ago
        43:16 into the video I posted https://www.youtube.com/watch?v=-4psTQ1sX7s https://www.youtube.com/watch?v=-4psTQ1sX7s
  - qwertyuiop924 10y ago
    The OSSL outlook is that both the OS and the hardware were designed by untrustworthy, paranoid, schizophrenics who wanted OSSL crash and burn. I wouldn't expect intelligence, sanity, rhyme, or reason.