5 ms·
Audits cost money. Tons of money. And they don't guarantee anything - bugs in OpenSSL have not been discovered for years despite thousands of people using the c
by ktRolster 9y ago
Audits cost money. Tons of money. And they don't guarantee anything - bugs in OpenSSL have not been discovered for years despite thousands of people using the code, poring over it and billions depending on it.
Any reasonable audit of OpenSSL would have said, "Don't use it."
- smsm42 9y agoAnd instead use... what? Let's say you are creating a company that needs website to sell stuff. On that website, you need TLS implementation, to process user data & credit cards. After expensive security audit that consumed most of what your angel investors can give you, you decide that anything based on OpenSSL can't be safely used. Now what?
- marcoperaza 9y agoIf the system we're talking about existed, someone would have created a more robust implementation.
- smsm42 9y agoHow do you know? It's not a magic law of the universe that "someone" always creates things because someone wants them. Sometimes problems are hard and just don't get solved, for a long time, even though everybody wants them solved.
- marcoperaza 9y agoBut this isn't some intractable problem. For aerospace and critical infrastructure projects, for example, there is plenty of meticulously written and audited high-quality code developed at higher cost in response to the demand created by legal requirements.
- smsm42 9y agohttps://www.wired.com/2015/05/possible-passengers-hack-commercial-aircraft/ https://www.wired.com/2015/05/possible-passengers-hack-comme... http://www.cnn.com/2015/05/17/us/fbi-hacker-flight-computer-systems/index.html http://www.cnn.com/2015/05/17/us/fbi-hacker-flight-computer-... https://arstechnica.com/information-technology/2015/06/airbus-confirms-software-configuration-error-caused-plane-crash/ https://arstechnica.com/information-technology/2015/06/airbu... https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Therac-25 https://en.wikipedia.org/wiki/Accidents_and_incidents_involving_the_JAS_39_Gripen#February_1989 https://en.wikipedia.org/wiki/Accidents_and_incidents_involv... https://en.wikipedia.org/wiki/Mars_Climate_Orbiter#Cause_of_failure https://en.wikipedia.org/wiki/Mars_Climate_Orbiter#Cause_of_... Did I make my point clear or do I need to google for another 2 minutes to find a dozen more examples of "aerospace and critical infrastructure projects" with software problems?
- colejohnson66 9y agoForks of OpenSSL. After Heartbleed, dozens of forks were made. One I think is really promising is LibreSSL which is managed by the same people who work on OpenBSD.
- smsm42 9y agoSo, the premise there is "we couldn't find the bugs by the whole community in twenty years, but if we split the community into a dozen independent projects which do not cooperate, surely then we'll find the bugs that eluded us for two decades". Right.
- ktRolster 9y agoI would roll my own. I'm totally confident I can do it better than the OpenSSL team. Of course, I would see what I could do with GnuTLS, first. In practice, OpenSSL should not be considered secure. At best it can be considered as a way to stop script kiddies.
- smsm42 9y agoSo why didn't you do that already? I mean, there are very few problems as important to software world and, frankly, to the major part of world economy, than robust electronic commerce. And encryption pays a vital role in this process. Somebody releasing 100% secure crypto implementation, guaranteed no bugs, would be doing the humanity a huge service. What prevents you from doing it now, today, this minute? Please do it right now!