3 ms·

OpenSSL WAS good library in past. Today it's bloatware. But since it's have lot of DEAD code that left there for compatibility reasons. Just like SSL2/SSL3 and

OpenSSL WAS good library in past. Today it's bloatware. But since it's have lot of DEAD code that left there for compatibility reasons. Just like SSL2/SSL3 and their "encryptions". Google also start fork project - BoringSSL in order to separate their patches between mainline OpenSSL.

lsofzz 6y ago
It's hard to know exactly how bloated SSL/TLS libraries have become without actually taking the time to research them but some of the folks behind `LibreSSL` seem to know crypto well enough.
shinigami 6y ago
It's the opposite, really. It improved a lot after the heartbleed issue.
simias 6y ago
You'll have to substantiate these assertions. When was it good? Why is it bloatware today? If anything IMHO it's significantly cleaner today than it used to be ~10 years ago. It still feel like the code quality is not up to the standard I'd hope for in such a critical piece of software but I don't think it's really worse now.
- coldpie 6y ago
  Back around the time of Heartbleed, there was a bunch of childish[1,2] attention given to OpenSSL's warts, mostly centered around the OpenBSD fork called LibreSSL, which stripped out a lot bad, old code and code for non-Unix platforms. Unsurprisingly, the childish attention faded into nothing because it's much harder to write good code than it is to tear apart someone else's. But the smear on the OpenSSL volunteers' reputation remains, as seen by GP's comment. [1] https://opensslrampage.org/page/49 https://opensslrampage.org/page/49 [2] https://opensslrampage.org/post/83555615721/the-future-or-lack-thereof-of-libressls-fips https://opensslrampage.org/post/83555615721/the-future-or-la...
  - tialaramex 6y ago
    I have previously characterized OpenSSL as "Stamp collector cryptography". Here's an implementation of IDEA. Should you use IDEA? No. So why is this even here? Compare the Go crypto reaction when somebody wants to add ECB mode: https://github.com/golang/go/issues/5597 https://github.com/golang/go/issues/5597 OpenSSL is better now than it was then, it might even be the least worst option for a lot of people in low-level languages who want to spin up a TLS client or server. But that is deliberately faint praise.

lsofzz 6y ago

It's hard to know exactly how bloated SSL/TLS libraries have become without actually taking the time to research them but some of the folks behind `LibreSSL` seem to know crypto well enough.

shinigami 6y ago

It's the opposite, really. It improved a lot after the heartbleed issue.

simias 6y ago

You'll have to substantiate these assertions. When was it good? Why is it bloatware today? If anything IMHO it's significantly cleaner today than it used to be ~10 years ago. It still feel like the code quality is not up to the standard I'd hope for in such a critical piece of software but I don't think it's really worse now.

coldpie 6y ago
Back around the time of Heartbleed, there was a bunch of childish[1,2] attention given to OpenSSL's warts, mostly centered around the OpenBSD fork called LibreSSL, which stripped out a lot bad, old code and code for non-Unix platforms. Unsurprisingly, the childish attention faded into nothing because it's much harder to write good code than it is to tear apart someone else's. But the smear on the OpenSSL volunteers' reputation remains, as seen by GP's comment. [1] https://opensslrampage.org/page/49 https://opensslrampage.org/page/49 [2] https://opensslrampage.org/post/83555615721/the-future-or-lack-thereof-of-libressls-fips https://opensslrampage.org/post/83555615721/the-future-or-la...
- tialaramex 6y ago
  I have previously characterized OpenSSL as "Stamp collector cryptography". Here's an implementation of IDEA. Should you use IDEA? No. So why is this even here? Compare the Go crypto reaction when somebody wants to add ECB mode: https://github.com/golang/go/issues/5597 https://github.com/golang/go/issues/5597 OpenSSL is better now than it was then, it might even be the least worst option for a lot of people in low-level languages who want to spin up a TLS client or server. But that is deliberately faint praise.