6 ms·

Business as usual with macOS. The other day I was browsing the ocspd source code. Turns out it calls openssl using system(). So openssl is officially deprecated

Business as usual with macOS. The other day I was browsing the ocspd source code. Turns out it calls openssl using system(). So openssl is officially deprecated on macOS and yet they're using it internally to handle certificates?! And there's an enlightening comment: /* Given a path to a DER-encoded CRL file and a path to a PEM-encoded * CA issuers file, use OpenSSL to validate the CRL. This is a hack, * necessitated by performance issues with inserting extremely large * numbers of CRL entries into a CSSM DB (see <rdar://8934440>). http://opensource.apple.com/source/security_ocspd/security_ocspd-55128.40.1/server/ocspdServer.cpp http://opensource.apple.com/source/security_ocspd/security_o... ocspd was introduced with 10.4. A decade ago. And that's really the problem with macOS: There's no refactoring of old hacks, but rather just bolting on of ever more new stuff.

0x0 10y ago
o.O
zimpenfish 10y ago
Linking to openssl was deprecated (lack of binary stability) - not the command line tools.
mikeash 10y ago
I don't see a major problem with using the openssl command for this, but using system() to do it is completely insane.
wyager 10y ago
Apple needs to take a bit of those tens of billions of dollars they have sitting around and spend it on starting from scratch with something that's not horrifically crufty. The quality of their software is lagging so far behind the quality of their hardware right now. Realistically, I think we may just be at the point where operating systems and all the stuff the companies put on top of them are too complicated to keep developing in the traditional way with traditional tools. Formal verification might be the cheapest way forward at this point.
- JoeAltmaier 10y ago
  Hundreds of billions?
  - protomyth 10y ago
    Yep, $237.6B in cash and equivalents http://blogs.marketwatch.com/thetell/2016/10/25/apple-earnings-expected-to-show-another-revenue-decline-live-blog/ http://blogs.marketwatch.com/thetell/2016/10/25/apple-earnin...
- tptacek 10y ago
  So far as the current state of the art in computer engineering goes, we don't know how to completely rewrite a system as complicated as XNU without creating fresh batches of implementation errors. So this is a little like suggesting Apple use its hundreds of billions of dollars to build an iPhone battery that only needs to be recharged once a month. We may someday get an XNU rewrite, but probably not until software engineering produces a new approach to building complex systems reliably that works at the scale (here: number of developers and shipping schedule) Apple needs.
  - pcwalton 10y ago
    > We may someday get an XNU rewrite, but probably not until software engineering produces a new approach to building complex systems reliably that works at the scale (here: number of developers and shipping schedule) Apple needs. It's conceivable to perform a gradual transition away, though. They could demote Mach to a fast IPC system that just augments BSD, similar to the way the kdbus/bus1 proposal for Linux does. That would be difficult and a long-term project, but it would fix the underlying issue in a way that mostly retains userspace compatibility. Driver compatibility would be more difficult, of course…
    - tptacek 10y ago
      That's true, but if you undertake a difficult and long-term project, you want the outcome to be decisive. Mach is ugly and a nest of bugs, but kernels implemented in C/C++ are bug magnets with several orders of magnitude more force. My prediction is that we don't ever see an XNU refactor/ redesign/ rewrite so long as C/C++ is the kernel implementation language.

0x0 10y ago

o.O

zimpenfish 10y ago

Linking to openssl was deprecated (lack of binary stability) - not the command line tools.

mikeash 10y ago

I don't see a major problem with using the openssl command for this, but using system() to do it is completely insane.

wyager 10y ago

Apple needs to take a bit of those tens of billions of dollars they have sitting around and spend it on starting from scratch with something that's not horrifically crufty. The quality of their software is lagging so far behind the quality of their hardware right now. Realistically, I think we may just be at the point where operating systems and all the stuff the companies put on top of them are too complicated to keep developing in the traditional way with traditional tools. Formal verification might be the cheapest way forward at this point.

JoeAltmaier 10y ago
Hundreds of billions?
- protomyth 10y ago
  Yep, $237.6B in cash and equivalents http://blogs.marketwatch.com/thetell/2016/10/25/apple-earnings-expected-to-show-another-revenue-decline-live-blog/ http://blogs.marketwatch.com/thetell/2016/10/25/apple-earnin...
tptacek 10y ago
So far as the current state of the art in computer engineering goes, we don't know how to completely rewrite a system as complicated as XNU without creating fresh batches of implementation errors. So this is a little like suggesting Apple use its hundreds of billions of dollars to build an iPhone battery that only needs to be recharged once a month. We may someday get an XNU rewrite, but probably not until software engineering produces a new approach to building complex systems reliably that works at the scale (here: number of developers and shipping schedule) Apple needs.
- pcwalton 10y ago
  > We may someday get an XNU rewrite, but probably not until software engineering produces a new approach to building complex systems reliably that works at the scale (here: number of developers and shipping schedule) Apple needs. It's conceivable to perform a gradual transition away, though. They could demote Mach to a fast IPC system that just augments BSD, similar to the way the kdbus/bus1 proposal for Linux does. That would be difficult and a long-term project, but it would fix the underlying issue in a way that mostly retains userspace compatibility. Driver compatibility would be more difficult, of course…
  - tptacek 10y ago
    That's true, but if you undertake a difficult and long-term project, you want the outcome to be decisive. Mach is ugly and a nest of bugs, but kernels implemented in C/C++ are bug magnets with several orders of magnitude more force. My prediction is that we don't ever see an XNU refactor/ redesign/ rewrite so long as C/C++ is the kernel implementation language.