4 ms·

> Needlessly dismissive. What if the people got excited because of the increased security? If only people were so excited about making OpenSSL not a flaming ho

> Needlessly dismissive. What if the people got excited because of the increased security? If only people were so excited about making OpenSSL not a flaming hot bag of shit. Can't wait to find out what that patch on Thursday will be for.

pdimitar 6y ago
I don't see how that overlaps with many of us, myself included. My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong".
- busterarm 6y ago
  > My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. I would agree and it was already done by the OpenBSD project. Google started BoringSSL/Tink. Amazon created s2n. Linux continues to use OpenSSL. It's still probably in the top 3 problems with security in Linux that needs fixing. The rest of your statement is just making my point for me.
  - pdimitar 6y ago
    Well, in that case your statement of "If only people were so excited about making OpenSSL not a flaming hot bag of shit" is severely misplaced. I have no influence over Linux governance. 99.9999% of us out there don't have that influence. So what was your point exactly? Rants are fine and we all do them but I will strongly disagree with any responsibility or guilt transferred to me because I am excited about Rust and not about OpenSSL. As you yourself pointed out, alternatives exist but aren't adopted so the problem is political and not technical. Right? > The rest of your statement is just making my point for me. Not sure what you mean but okay. ¯\_(ツ)_/¯
    - busterarm 6y ago
      > Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong". > Not sure what you mean but okay. ¯\_(ツ)_/¯ Blame the carpenter, not the tools. C or C++ isn't a real business problem domain that anyone has. Nobody's committing their budget to fix that. That's the kind of problem only held by ideologues and other unreasonable people. My point was that people who care about fixing problems in the security domain will look to fix the biggest problems they can in the security domain. They won't look at it and say "no, I can't fix this because C/C++ is unacceptable to me." That's someone who cares more about the tools than the problem domain. Whethor or not you think C/C++ are suitable to the problem domain of writing secure software, software will be written in C/C++ and must be secured. Turn down work all you want though. More for the rest of us.
      - pdimitar 6y ago
        > My point was that people who care about fixing problems in the security domain will look to fix the biggest problems they can in the security domain. They won't look at it and say "no, I can't fix this because C/C++ is unacceptable to me." Sometimes that's true, sometimes it isn't. It's a cost-benefit analysis like almost anything else. Everyone is free to disagree on this -- or like you, misinterpret my motivation as "caring more about the tools than the problem domain". Quite the contrary, I want the problems solved but I also put deadlines and energy budgets on trying to solve problem X with tool Y and if it doesn't cut it within the deadline and/or the budget then it's out. Sure, that means more C/C++ work for you. I am OK with that. But let's not pretend that OpenSSL can only be written in C or C++ now. We all know that's not true. > Blame the carpenter, not the tools. It's no accident that professional craftsmen utilize innovation in their tooling as well, like Sushi chefs using ceramic knives for some fish and steel knives for others. Ceramic knives weren't that popular some mere decades ago. Your black and white philosophy makes no favours to your argument. It seems you take an issue with the rising popularity of Rust. But let me ask you this: if you are so confident in C/C++'s superiority, why are you bothered?
  - mlindner 6y ago
    To be frank BoringSSL and other derivatives are not "rewrites". They are largely the same as OpenSSL with some parts of the code removed. A rewrite starts from a fresh slate, not slowly modifying a fork. BTW, rustls exists and is a rewrite of OpenSSL of sorts.

pdimitar 6y ago

I don't see how that overlaps with many of us, myself included. My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong".

busterarm 6y ago
> My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. I would agree and it was already done by the OpenBSD project. Google started BoringSSL/Tink. Amazon created s2n. Linux continues to use OpenSSL. It's still probably in the top 3 problems with security in Linux that needs fixing. The rest of your statement is just making my point for me.
- pdimitar 6y ago
  Well, in that case your statement of "If only people were so excited about making OpenSSL not a flaming hot bag of shit" is severely misplaced. I have no influence over Linux governance. 99.9999% of us out there don't have that influence. So what was your point exactly? Rants are fine and we all do them but I will strongly disagree with any responsibility or guilt transferred to me because I am excited about Rust and not about OpenSSL. As you yourself pointed out, alternatives exist but aren't adopted so the problem is political and not technical. Right? > The rest of your statement is just making my point for me. Not sure what you mean but okay. ¯\_(ツ)_/¯
  - busterarm 6y ago
    > Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong". > Not sure what you mean but okay. ¯\_(ツ)_/¯ Blame the carpenter, not the tools. C or C++ isn't a real business problem domain that anyone has. Nobody's committing their budget to fix that. That's the kind of problem only held by ideologues and other unreasonable people. My point was that people who care about fixing problems in the security domain will look to fix the biggest problems they can in the security domain. They won't look at it and say "no, I can't fix this because C/C++ is unacceptable to me." That's someone who cares more about the tools than the problem domain. Whethor or not you think C/C++ are suitable to the problem domain of writing secure software, software will be written in C/C++ and must be secured. Turn down work all you want though. More for the rest of us.
    - pdimitar 6y ago
      > My point was that people who care about fixing problems in the security domain will look to fix the biggest problems they can in the security domain. They won't look at it and say "no, I can't fix this because C/C++ is unacceptable to me." Sometimes that's true, sometimes it isn't. It's a cost-benefit analysis like almost anything else. Everyone is free to disagree on this -- or like you, misinterpret my motivation as "caring more about the tools than the problem domain". Quite the contrary, I want the problems solved but I also put deadlines and energy budgets on trying to solve problem X with tool Y and if it doesn't cut it within the deadline and/or the budget then it's out. Sure, that means more C/C++ work for you. I am OK with that. But let's not pretend that OpenSSL can only be written in C or C++ now. We all know that's not true. > Blame the carpenter, not the tools. It's no accident that professional craftsmen utilize innovation in their tooling as well, like Sushi chefs using ceramic knives for some fish and steel knives for others. Ceramic knives weren't that popular some mere decades ago. Your black and white philosophy makes no favours to your argument. It seems you take an issue with the rising popularity of Rust. But let me ask you this: if you are so confident in C/C++'s superiority, why are you bothered?
- mlindner 6y ago
  To be frank BoringSSL and other derivatives are not "rewrites". They are largely the same as OpenSSL with some parts of the code removed. A rewrite starts from a fresh slate, not slowly modifying a fork. BTW, rustls exists and is a rewrite of OpenSSL of sorts.