3 ms·

Hi, Redis 6 will have SSL, however there is no obligation by an OSS developer to put any feature inside a software. If you like it with its shortcomings you use

Hi, Redis 6 will have SSL, however there is no obligation by an OSS developer to put any feature inside a software. If you like it with its shortcomings you use it otherwise not. If the feature is about security, nothing changes that. I provide a tool and it's up to the users to apply it in a way that makes sense, using or not an SSL proxy and so forth.

stephenr 7y ago
I disagree about obligations. If you market a product that is intended to be used in a multi-server environment, but the software has no way to encrypt that traffic, you’re doing active harm. That there is also a commercial/enterprise offering by your employer which “bundles” TLS support doesn’t help the situation. You’ve had an issue open for 5 years on this. You’ve had multiple people submit PRs to add this, and even forks made just to add TLS support - any of which you could have used to make this happen sooner. Saying “I have no obligation to provide secure software” is a cop out when you actively develop new features that are almost guaranteed to need the security you’ve refused to add thus far.
- antirez 7y ago
  AWS which is basically the main competitor of Redis Labs has SSL since forever and they are even the contributors of the SSL PR that will be merged. So sorry, conspiracy theory not correct. About obligation I disagree, if we are in doubt let's check what the law says. I've no obligation whatever your opinion is.
- dang 7y ago
  Would you please not be so rude on HN? You're breaking the site guidelines. I'm sure you can make your substantive points without doing that, even if you have reason to be frustrated about something. Attacking someone else for their work is particularly unwelcome here. Imagine if everyone did that—what reason would people have to discuss their work here? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
happythought 7y ago
I agree 100% that a developer isn’t required to implement any feature. One thing to think about is that it’s not necessarily a single user or a single team weighing costs and benefits. In an organization with separate dev and ops teams, a dev team may pick a solution for the benefits but the ops team bears the costs of operations and security.

stephenr 7y ago

I disagree about obligations. If you market a product that is intended to be used in a multi-server environment, but the software has no way to encrypt that traffic, you’re doing active harm. That there is also a commercial/enterprise offering by your employer which “bundles” TLS support doesn’t help the situation. You’ve had an issue open for 5 years on this. You’ve had multiple people submit PRs to add this, and even forks made just to add TLS support - any of which you could have used to make this happen sooner. Saying “I have no obligation to provide secure software” is a cop out when you actively develop new features that are almost guaranteed to need the security you’ve refused to add thus far.

antirez 7y ago
AWS which is basically the main competitor of Redis Labs has SSL since forever and they are even the contributors of the SSL PR that will be merged. So sorry, conspiracy theory not correct. About obligation I disagree, if we are in doubt let's check what the law says. I've no obligation whatever your opinion is.
dang 7y ago
Would you please not be so rude on HN? You're breaking the site guidelines. I'm sure you can make your substantive points without doing that, even if you have reason to be frustrated about something. Attacking someone else for their work is particularly unwelcome here. Imagine if everyone did that—what reason would people have to discuss their work here? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

happythought 7y ago

I agree 100% that a developer isn’t required to implement any feature. One thing to think about is that it’s not necessarily a single user or a single team weighing costs and benefits. In an organization with separate dev and ops teams, a dev team may pick a solution for the benefits but the ops team bears the costs of operations and security.