4 ms·

Seems like this stems from https://github.com/openssl/openssl/issues/16660 https://github.com/openssl/openssl/issues/16660 which contains the full backstory and

Seems like this stems from https://github.com/openssl/openssl/issues/16660 https://github.com/openssl/openssl/issues/16660 which contains the full backstory and some more information. kaniini, same as Ariadne Conill who posted the issue in the linked GitLab instance, opened a issue about a regression. They felt the response from the OpenSSL team wasn't as fast as expected, and created the text that this submission is linking to. Seems expectations of a quick fix was never told about in the GitHub repository for OpenSSL, and instead the author chose to write on Twitter and in AlpineLinux GitLab about the frustrations. I can't help but to see this as a personal reaction to these events, and unsure about the merit to change it out so hastily. But, I'm not super up-to-date about things in LibreSSL/OpenSSL land so I could be wrong, it has happened before.

stonogo 5y ago
They ignored a crash bug for a month and a half. Nobody should have to explain to a security package maintainer that a crash bug is a priority. If I were running a distro I'd be advertising to my users that there is a problem too, so they would know that the distro is considering alternatives.
- soraminazuki 5y ago
  Thinking about ways you can contribute would be far more productive than fantasizing about what the best possible position to be in would be when criticizing the project. Judging from the issues and commit logs, the OpenSSL project looks very busy and I'd guess they'd gladly accept genuine help.
ThatGeoGuy 5y ago
Ariadne actually answers this in that thread: https://github.com/openssl/openssl/issues/16660#issuecomment-967315484 https://github.com/openssl/openssl/issues/16660#issuecomment... I'll quote the section: "Given that the OpenSSL 3 migration had an outcome where our contingency plan came into effect, I believe it to be the most prudent course of action to evaluate all possible options before committing to trying the OpenSSL 3 migration again, such an evaluation would be required by the TSC anyway." The Alpine project operates independently from OpenSSL, so it's no surprise they published their own report to discuss their own timelines. I'm not sure I can attest to this being a "personal" reaction from my interpretation. Instead, this seems rather like the Alpine project's reaction to their own internal deadlines. Tossing out OpenSSL may appear flippant from a distance, but getting SSL correct for their own releases and finding projects that want to work alongside them (as LibreSSL is supposedly responsive towards doing) should be a priority if you're in charge of getting this work ticket over the line. Of course, the wording and general attitude towards OpenSSL developers can be interpreted however you want, but I don't see this as outright hostility or a personal reaction so much as "this ticket was left for over a month, and our project needs to make forward progress."
lonjil 5y ago
Ehh, it doesn't seem very hasty to me. The proposal is for Alpine 3.17 or 3.18, which are 1 and 1.5 years away respectively. That's plenty of time to consider the pros and cons, try it, and revert if it ends up being a poor choice. > Seems like this stems from https://github.com/openssl/openssl/issues/16660 https://github.com/openssl/openssl/issues/16660 which contains the full backstory and some more information. I wouldn't call that the "full backstory", since it is only about a single issue outlined in this proposal. Though she does explain that fact in that GitHub thread too, and also why they're looking into alternatives: > Given that the OpenSSL 3 migration had an outcome where our contingency plan came into effect, I believe it to be the most prudent course of action to evaluate all possible options before committing to trying the OpenSSL 3 migration again, such an evaluation would be required by the TSC anyway. > and instead the author chose to write on Twitter and in AlpineLinux GitLab about the frustrations. Eh, I wouldn't read too much into short twitter vents. As for the Alpine Linux GitLab, well, she's the head of Alpine's security team and a member of the TSC, so coming up with proposals as for what should be investigated w.r.t. security critical packages is one of the things she's supposed to be doing.

stonogo 5y ago

They ignored a crash bug for a month and a half. Nobody should have to explain to a security package maintainer that a crash bug is a priority. If I were running a distro I'd be advertising to my users that there is a problem too, so they would know that the distro is considering alternatives.

soraminazuki 5y ago
Thinking about ways you can contribute would be far more productive than fantasizing about what the best possible position to be in would be when criticizing the project. Judging from the issues and commit logs, the OpenSSL project looks very busy and I'd guess they'd gladly accept genuine help.

ThatGeoGuy 5y ago

Ariadne actually answers this in that thread: https://github.com/openssl/openssl/issues/16660#issuecomment-967315484 https://github.com/openssl/openssl/issues/16660#issuecomment... I'll quote the section: "Given that the OpenSSL 3 migration had an outcome where our contingency plan came into effect, I believe it to be the most prudent course of action to evaluate all possible options before committing to trying the OpenSSL 3 migration again, such an evaluation would be required by the TSC anyway." The Alpine project operates independently from OpenSSL, so it's no surprise they published their own report to discuss their own timelines. I'm not sure I can attest to this being a "personal" reaction from my interpretation. Instead, this seems rather like the Alpine project's reaction to their own internal deadlines. Tossing out OpenSSL may appear flippant from a distance, but getting SSL correct for their own releases and finding projects that want to work alongside them (as LibreSSL is supposedly responsive towards doing) should be a priority if you're in charge of getting this work ticket over the line. Of course, the wording and general attitude towards OpenSSL developers can be interpreted however you want, but I don't see this as outright hostility or a personal reaction so much as "this ticket was left for over a month, and our project needs to make forward progress."

lonjil 5y ago

Ehh, it doesn't seem very hasty to me. The proposal is for Alpine 3.17 or 3.18, which are 1 and 1.5 years away respectively. That's plenty of time to consider the pros and cons, try it, and revert if it ends up being a poor choice. > Seems like this stems from https://github.com/openssl/openssl/issues/16660 https://github.com/openssl/openssl/issues/16660 which contains the full backstory and some more information. I wouldn't call that the "full backstory", since it is only about a single issue outlined in this proposal. Though she does explain that fact in that GitHub thread too, and also why they're looking into alternatives: > Given that the OpenSSL 3 migration had an outcome where our contingency plan came into effect, I believe it to be the most prudent course of action to evaluate all possible options before committing to trying the OpenSSL 3 migration again, such an evaluation would be required by the TSC anyway. > and instead the author chose to write on Twitter and in AlpineLinux GitLab about the frustrations. Eh, I wouldn't read too much into short twitter vents. As for the Alpine Linux GitLab, well, she's the head of Alpine's security team and a member of the TSC, so coming up with proposals as for what should be investigated w.r.t. security critical packages is one of the things she's supposed to be doing.