5 ms·
OpenSSL wins the Levchin prize
- mstachowiak 9y agoCan't help but find it ironic the winner of the 2018 Levchin Prize for Advancements in Real-World Cryptography has an invalid SSL certificate on his research website.
- jlgaddis 9y agoI did think the same thing, but you can't blame that on him. Blame IBM/Akamai.
- Edmond 9y agoIt is on Akamai but it is on Akamai's non-TLS network (ie .egsuite.net)...you have to pay more for TLS on Akamai (.edgekey.net)....I'd blame IBM but not Akamai.
- nothrabannosir 9y agoYou can. Responsibility for their choice of business partners lies with them, not the public. Otherwise this blame-game-treasure-hunt-rigmarole never ends. It doesn’t matter that much, but it’s a matter of principle.
- emmelaich 9y agoAlso the levchinprize.com website. (not that there is a link to it; and it might not even attempt to do ssl) levchinprize.com uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH Classic.
- duozerk 9y agoAt first glance they do support SSL, but not TLS; basically your browser laughed at their antiquated protocol.
- majewsky 9y agoA few hours ago, I went to their website after seeing the submission, and it worked. Now I'm getting SSL_ERROR_NO_CYPHER_OVERLAP (in Firefox 57). Maybe they're loadbalancing and one of the servers is incorrectly configured?
- privateprofile 9y agoI can't help but finding it sad that the prize is a meager 10K, especially for projects that are so relevant for the Internet at large.
- amelius 9y agoSecurity, in any organization, is always last on the budget list. Perhaps this is reflected in the prize.
- cosmojg 9y agoWhat about LibreSSL?
- corndoge 9y agoWhat about it?
- sidlls 9y agoWhat significant contributions to real-world cryptography have LibreSSL made?
- wasx 9y agoWell seeing as the criteria that they used to pick the OpenSSL project is: "for dramatic improvements to the code quality of OpenSSL" I think there is a question around why LibreSSL was not chosen seeing as it has done exactly that...
- tephra 9y agoI don't have any numbers but I would guess this would be since OpenSSL is used a lot more than LibreSSL at the moment. So the criteria "and its use in real world systems" would qualify OpenSSL more than LibreSSL.
- mrweasel 9y agoI was think along the same lines. It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess. Honestly, given the background for the award, cleaning up your code base shouldn't qualify you: > The prize honors significant contributions to real-world cryptography and celebrates recent advances that have had a major impact on the practice of cryptography and its use in real-world systems. Improving code quality doesn't actually impact "the practice of cryptography".
- shandor 9y ago> It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess. Though to be honest, an insane amount of stuff relies on OpenSSH for their security, and has for years. If their code was messy earlier, ok, but they have still been basically de facto standard SSH client for much of networking. I'd say their prize is well earned.
- ramshanker 9y agoDidn't hear of the prize before, so searched for it. From the website of prize. >>>>>The Levchin Prize was established in 2015 by internet entrepreneur, Max Levchin. The prize honors significant contributions to real-world cryptography and celebrates recent advances that have had a major impact on the practice of cryptography and its use in real-world systems. Up to two awards will be given every year and each carries a cash prize of $10,000.<<<<< 2015. That is pretty new. So, for me it's more of a publicity for the "prize" itself the the"advancement".
- pvg 9y agoIt's a serious conference with a steering committee of serious experts who award the prize for serious work. Take a look at the previous winners. I think the only thing you're getting right here is that the prize is relatively new.
- CharlesMerriam2 9y agoCongratulations! When money cannot be given, at least kudos can be given. Words to live by.
- deleted 9y ago[deleted]
- bluejekyll 9y agoIf you haven’t seen the difference in quality and design from older versions of OpenSSL to more recent versions, it’s a quite impressive transformation. I definitely learned a lot of new techniques for writing quality modern C from the recent versions of OpenSSL. Congrats on the award.
- voltagex_ 9y agoCan you provide a short example?
- bluejekyll 9y agotake a look at this current pkey impl: https://github.com/openssl/openssl/blob/OpenSSL_1_1_0-stable/crypto/evp/evp_pkey.c#L21 https://github.com/openssl/openssl/blob/OpenSSL_1_1_0-stable... and compare that to 0.9.8: https://github.com/openssl/openssl/blob/OpenSSL-fips-0_9_8-stable/crypto/evp/evp_pkey.c#L81 https://github.com/openssl/openssl/blob/OpenSSL-fips-0_9_8-s... You'll notice how much cleaner the code is. Error conditions are more consistently handled. Many fewer macros interleaving the code... etc.
- pjmlp 9y agoYes quite true, it is like night and day.
- virtualized 9y agoDoes OpenSSL have useful documentation yet?
- wasx 9y agoNo. Source: writing code using openSSL
- snvzz 9y agoEvery time I see openssl rather than libressl getting attention, I'm reminded of how often incompetence is rewarded.