4 ms·

What about LibreSSL?

by cosmojg 9y ago

corndoge 9y ago
What about it?
sidlls 9y ago
What significant contributions to real-world cryptography have LibreSSL made?
- wasx 9y ago
  Well seeing as the criteria that they used to pick the OpenSSL project is: "for dramatic improvements to the code quality of OpenSSL" I think there is a question around why LibreSSL was not chosen seeing as it has done exactly that...
  - tephra 9y ago
    I don't have any numbers but I would guess this would be since OpenSSL is used a lot more than LibreSSL at the moment. So the criteria "and its use in real world systems" would qualify OpenSSL more than LibreSSL.
mrweasel 9y ago
I was think along the same lines. It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess. Honestly, given the background for the award, cleaning up your code base shouldn't qualify you: > The prize honors significant contributions to real-world cryptography and celebrates recent advances that have had a major impact on the practice of cryptography and its use in real-world systems. Improving code quality doesn't actually impact "the practice of cryptography".
- shandor 9y ago
  > It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess. Though to be honest, an insane amount of stuff relies on OpenSSH for their security, and has for years. If their code was messy earlier, ok, but they have still been basically de facto standard SSH client for much of networking. I'd say their prize is well earned.
  - inferiorhuman 9y ago
    OpenSSL vs OpenSSH.
  - mulander 9y ago
    The reward was given to the OpenSSL team. OpenSSH is a different project, developed by the OpenBSD project. OpenBSD also works on LibreSSL which is a fork of OpenSSL. OpenSSL itself has NOTHING to do with OpenBSD and OpenBSD related projects.
tedunangst 9y ago
So, good for OpenSSL for getting better. More better crypto libraries benefit everyone. Who benefits from OpenSSL remaining terrible? I certainly don't think libressl deserves any sort of prize, but it does seem a little weird to give an award designated for advancement for something more like hitting par. If they'd been better to start, then no award? Most improved awards have strange incentives. This award did feel a little different. I can't build anything on top of OpenSSL in quite the same way that I can take the signal protocol and build on it. (All the other winners did something that's useful to rust, too. :))

What about LibreSSL?

corndoge 9y ago

What about it?

sidlls 9y ago

What significant contributions to real-world cryptography have LibreSSL made?

wasx 9y ago
Well seeing as the criteria that they used to pick the OpenSSL project is: "for dramatic improvements to the code quality of OpenSSL" I think there is a question around why LibreSSL was not chosen seeing as it has done exactly that...
- tephra 9y ago
  I don't have any numbers but I would guess this would be since OpenSSL is used a lot more than LibreSSL at the moment. So the criteria "and its use in real world systems" would qualify OpenSSL more than LibreSSL.

mrweasel 9y ago

I was think along the same lines. It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess. Honestly, given the background for the award, cleaning up your code base shouldn't qualify you: > The prize honors significant contributions to real-world cryptography and celebrates recent advances that have had a major impact on the practice of cryptography and its use in real-world systems. Improving code quality doesn't actually impact "the practice of cryptography".

shandor 9y ago
> It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess. Though to be honest, an insane amount of stuff relies on OpenSSH for their security, and has for years. If their code was messy earlier, ok, but they have still been basically de facto standard SSH client for much of networking. I'd say their prize is well earned.
- inferiorhuman 9y ago
  OpenSSL vs OpenSSH.
- mulander 9y ago
  The reward was given to the OpenSSL team. OpenSSH is a different project, developed by the OpenBSD project. OpenBSD also works on LibreSSL which is a fork of OpenSSL. OpenSSL itself has NOTHING to do with OpenBSD and OpenBSD related projects.

tedunangst 9y ago

So, good for OpenSSL for getting better. More better crypto libraries benefit everyone. Who benefits from OpenSSL remaining terrible? I certainly don't think libressl deserves any sort of prize, but it does seem a little weird to give an award designated for advancement for something more like hitting par. If they'd been better to start, then no award? Most improved awards have strange incentives. This award did feel a little different. I can't build anything on top of OpenSSL in quite the same way that I can take the signal protocol and build on it. (All the other winners did something that's useful to rust, too. :))