3 ms·

Serious question: who are the decision makers on "using OpenSSL" vs other stuff? It feels like most application level people will be using whatever gets package

by rtpg 6y ago

Serious question: who are the decision makers on "using OpenSSL" vs other stuff? It feels like most application level people will be using whatever gets packaged with whatever framework/HTTP server they use, so shouldn't there be relatively few people to convince here? Or is that a big misread of the situation

dijit 6y ago
> who are the decision makers on "using OpenSSL" vs other stuff? Since you said you were being serious then I hope you don't find the answer flippant; The decision makers are usually the people who originally wrote the software. Once software is written it is unusual to alter dependencies unless there is a very solid reason. For a great example, check how many projects moved from MySQL to PostgreSQL (or vice-versa) despite fundamental issues in MySQL regarding safety and (previously) performance issues in PostgreSQL.
- tptacek 6y ago
  That is not what's happening with OpenSSL.
jamal-kumar 6y ago
It's an integral part of operating systems often pre-installed on there these days, so I think you could probably point out distros who have tried and failed to replace this component that they have to ship. I think a few distros tried libressl and had to end up going back because of reasons I'm not entirely sure of, but I suspect enterprise interests has something to do with anything like this breaking compat and causing them to have to do more work
bigiain 6y ago
For most people that’s kinda like asking who’s the decision maker on what brand of bearings get used in your cars engine. It’s just not even on most people’s radar, it’s just something that comes along with the web hosting/Linux disto/AMI/SaaS they buy. Most people don’t even think about whether Ford or Toyota make the bearings in their engines (they don’t), a very very few people tear down their engines and replace bearings and most of them will just order new ones from the car’s manufacturer. A tiny percentage of people tearing down engines will actively make decisions about whether Ford/Toyotas bearings are right for their project, and maybe if they’re drag racers or rally car builders they’ll choose different bearings. There’s an even smaller number of people who build engines from scratch, who’ll decide for themselves the right bearings for them. There are maybe a few dozen people on the planet who work at major car manufacturers who specify 99.999+% of all the engine bearings used in current passenger cars. FAANG are kinda like Formula1 teams here, they work very closely with their engine manufactures to ensure they have the best possible bearings/ssl implementations for their specific use cases. Radha/Cannonical/Microsoft/et al. are the car manufacturers, who choose bearings/ssl libraries most generally suitable for the expected use and lifespans of their products - without optimising fo any one specific use case. (And most HN commenters, like me, are the armchair quarterbacks second guessing and speculating endlessly about why a particular racer's engine expired during yesterday's race on internet forums every Monday morning... :-) )

by rtpg 6y ago

dijit 6y ago

> who are the decision makers on "using OpenSSL" vs other stuff? Since you said you were being serious then I hope you don't find the answer flippant; The decision makers are usually the people who originally wrote the software. Once software is written it is unusual to alter dependencies unless there is a very solid reason. For a great example, check how many projects moved from MySQL to PostgreSQL (or vice-versa) despite fundamental issues in MySQL regarding safety and (previously) performance issues in PostgreSQL.

tptacek 6y ago
That is not what's happening with OpenSSL.

jamal-kumar 6y ago

It's an integral part of operating systems often pre-installed on there these days, so I think you could probably point out distros who have tried and failed to replace this component that they have to ship. I think a few distros tried libressl and had to end up going back because of reasons I'm not entirely sure of, but I suspect enterprise interests has something to do with anything like this breaking compat and causing them to have to do more work

bigiain 6y ago

For most people that’s kinda like asking who’s the decision maker on what brand of bearings get used in your cars engine. It’s just not even on most people’s radar, it’s just something that comes along with the web hosting/Linux disto/AMI/SaaS they buy. Most people don’t even think about whether Ford or Toyota make the bearings in their engines (they don’t), a very very few people tear down their engines and replace bearings and most of them will just order new ones from the car’s manufacturer. A tiny percentage of people tearing down engines will actively make decisions about whether Ford/Toyotas bearings are right for their project, and maybe if they’re drag racers or rally car builders they’ll choose different bearings. There’s an even smaller number of people who build engines from scratch, who’ll decide for themselves the right bearings for them. There are maybe a few dozen people on the planet who work at major car manufacturers who specify 99.999+% of all the engine bearings used in current passenger cars. FAANG are kinda like Formula1 teams here, they work very closely with their engine manufactures to ensure they have the best possible bearings/ssl implementations for their specific use cases. Radha/Cannonical/Microsoft/et al. are the car manufacturers, who choose bearings/ssl libraries most generally suitable for the expected use and lifespans of their products - without optimising fo any one specific use case. (And most HN commenters, like me, are the armchair quarterbacks second guessing and speculating endlessly about why a particular racer's engine expired during yesterday's race on internet forums every Monday morning... :-) )