19 ms·

If OpenSSL were a GUI

744 points by soheilpro 4y ago

amelius 4y ago
A badly designed GUI. You should determine first what options are independent of other options, and which options aren't.
- ykl 4y ago
  I think that’s the whole joke; OpenSSL’s various options are so extensive and so Byzantine that this is what you end up with.
phtrivier 4y ago
Is there a reasonable subset of openssl / TLS / whatever that covers the use case people should really start with in 2022 ? Can it get a branding ?
- gspr 4y ago
  I believe things look a lot better if you stick to TLS 1.3 only, and drop support for almost all formats for certificates.
- krallja 4y ago
  I think that’s the intention of LibreSSL.
sudu1 4y ago
Nice world
jandrusk 4y ago
This also demonstrates were CLI excels and where GUI's fall short. With the GUI your just stuck digging for the correct option and tab. With the CLI you can create aliases or shell scripts to make wrappers for complex CLI options. Not to mention building custom openssl.cnf configs.
- layer8 4y ago
  An actual GUI for openssl tasks could be hugely more user-friendly than the one depicted here. If anything, it demonstrates that a GUI interface could be superior (for non-scripting use, obviously), because the depicted version is meant to illustrate the CLI experience.
  - deleted 4y ago
    [deleted]
- behnamoh 4y ago
  Maybe that's also why visual programming never took off. There's just a sense of "power and control" that comes with raw text that's unmatched in GUI apps. I agree with your point about CLI. At the same time, I wish we had more GUI *inside* CLI. For example, an interactive and pretty MAN page that's not just text, but has clear borders, boxes, buttons (with keyboard shortcuts), and uses different colors for different sections (e.g., command description, arguments, examples, etc.)
  - ocdtrekkie 4y ago
    I think there's a strong case for a lot of systems having both a GUI and a CLI, because there are purposes each excel at, and a user may want to be able to switch between them depending what they are doing.
    - behnamoh 4y ago
      I think VSCode's command palette is close to this idea. I wish MS Word and other apps would add something similar.
- dmart 4y ago
  Funny, when I looked at this my first impression was how much nicer the (hypothetical) GUI looked to use, with all of the functionality easily discoverable without digging through man pages and rewriting your intentions in terms of obscure flags. To clarify, I'm not saying the GUI is actually better. But I wish we could bring some of those conveniences to the command line experience (way better autocomplete and command discovery).
jchw 4y ago
I would love to see the equivalent “If libsodium were a GUI.”
- marcosdumay 4y ago
  A large part of what makes libsodium simple is that it does very little. Some of doing little is great. It does not let you erratically mess with your encryption options, it does not let you apply a bad algorithm, and it does not let you use one algorithm for a task it's badly suited for (well, up to a point). But some of it is just things the library doesn't do. You can't run a PKI with it, you can't deal with industry-standard file types, and your options for interoperability are just none. It's really good to make those nice focused libraries that people can actually use. But that doesn't remove the need for kitchen-sink packages that will solve every problem under the Sun.
  - jchw 4y ago
    This is true, but a majority of projects are using this kitchen sink library, poorly, for roughly the same 0.2% of it. Not good. Thankfully, the situation has improved; at least some old stuff has been moved off into a module in 3.x, and a lot of cruft has been cleaned up. But still, it’s hard to not want to pick a library with reduced scope, if you at all can.
    - marcosdumay 4y ago
      You should pick a library with reduced scope. And not feel any bad about it. But that doesn't mean the kitchen sink one is useless.
      - jchw 4y ago
        Yeah, I think we're in agreement.
fizzbuzz-rs 4y ago
Practically all GUI software would look too complicated if you have to put everything on one screen. Compare tar and your favorite archive tool GUI.
RcouF1uZ4gsC 4y ago
As an aside, does anyone else miss the tabbed interfaces of the late 1990’s?
- layer8 4y ago
  Yes, except that the reordering behavior of multi-row tab controls always confuses me, and that there should be a way to “break out” individual tabs to see them side-by-side, maybe similar to an MDI interface.
  - em-bee 4y ago
    with so many tabs, i'd put them in a column down the left side
equivocates 4y ago
Let me introduce you to a little app called FFMPEG
- billyhoffman 4y ago
  True, but you use the wrong FFMpeg codec, or transcode an audio track instead of copying it to the output, no one is left dangerously insecure. You just have a bloated MKV :-D
  - astrange 4y ago
    A whole lot of option combinations to ffmpeg straight up don't work and will produce broken files. Streamcopy is a lot more likely to find those.
- em-bee 4y ago
  and there are dozens of GUIs for it.
  - usrn 4y ago
    And most look pretty much like that.
- apocalyptic0n3 4y ago
  There are plenty of ffmpeg interfaces, though. The most prominent is Handbrake. Of course, I don't think any of them try to expose every single option. The goal for them is almost always to create an interface that works for the 99% and let the 1% deal with the CLI
- formerly_proven 4y ago
  Both ffmpeg(1) and openssl(1) share that they're meant, or used to be meant, as examples/demos of the underlying APIs. No one was actually supposed to run an actual CA with openssl(1), for example. Both also share that some things are vastly easier using the API than bending over backwards thrice at full moon using the CLI, but because using the API has more friction to it, people generally stick to the CLI (almost) no matter how hard that'll make things. Oh, and just like you have to know a ton about how media containers, streams and codecs actually work to use the ffmpeg API, you likewise need to be a crypto expert to use the OpenSSL API. Almost the same is true for their CLIs as well, though.
throwaway0x7E6 4y ago
I unironically love this
bbkane 4y ago
Is it bad that I actually want this?
- layer8 4y ago
  No, I had the same thought. Moreover, a GUI/TUI would actually allow implementing some further usability improvements. And there could be a “save as script” option.
- raisedbyninjas 4y ago
  I was just wondering if this existed yesterday. LetsEncrypt is out there for real certs. I need a site cert for local development. Why can't I type my hostname and mash one button?
- marcosdumay 4y ago
  I want a version of this that spills the command at the end. One that runs it, not so much.
  - banana_giraffe 4y ago
    A team I worked on years ago had a build system with an insane number of options. Someone made a GUI that looked vaguely like this OpenSSL GUI does, only it didn't have a "Build" button, but a textbox that showed you the command line options you had picked (I think it could automatically save to a script as well). It was such a useful tool. I've endeavored to recreate that a few times in other teams when I encounter a tool with a --help that's more than a page long. Really helps new people figure things out.
  - mr_mitm 4y ago
    I'd settle for tab completion of openssl parameters, but even that is a tall order, unless you only cover a very small portion of it.
matthewaveryusa 4y ago
This is where the builder pattern works really well. rclone is a good example of a cli that uses a builder for config, and turbotax for guis.
chaps 4y ago
Heh, I once did the opposite and turned an infrastructure's asset management GUI/API into a CLI tool. It had a backend API which presented some decent typing and its nested structure, so it wasn't beyond impossible, just had to be massaged into a doctopt string. It was, uh... It had a lot of options. It was immediately obvious that it was beyond useless because any use of the tool started with a search in the documentation, just as I would if I was just calling the API. No time saved and had an excessively small niche.
- em-bee 4y ago
  this highlights the difference: on a commandline it is syntactically easy to add lots of options, whereas the GUI has limits, but the GUI is easier to discover. for the commandline you need to read documentation.
riazrizvi 4y ago
Beautiful and educational. It’s a design activity very similar to building a good cheat sheet or study guide. From an evolutionary standpoint our intelligence is heavily oriented toward navigation of complex terrain, to locate food sources and avoid danger. So translating this API into a structured layout makes it more suited to our natural learning faculties.
kringo 4y ago
A great way to visualize the complexity of OpenSSL Like others mentioned FFMPEG is even complex :-)
ape4 4y ago
As we know too many options / complexity is bad for reliable cryptography. Perhaps some options could be removed or depreciated.
mseepgood 4y ago
Why would it be implemented for Mac OS 9?
- jandrese 4y ago
  Because it would have been implemented in 1999 and then left to rot for decades, just like the CLI interface.
  - sph 4y ago
    It would probably be some old Tcl/Tk GUI module written in 1999 that a single madman has maintained until today.
tambourine_man 4y ago
Checkboxes are not 100% platinum accurate, but great job all in all.
throw7 4y ago
Do ImageMagick! ;)
- em-bee 4y ago
  imagemagick has a GUI: display
throwaway892238 4y ago
Does this exist? Because I want it. The only thing it needs is a couple extra buttons at the top like "Modern TLS Certificate" and it selects the right options, but then I can tweak it from there.
commandlinefan 4y ago
I was really hoping those tabs would be clickable...
gpm 4y ago
This reminds me of this project which automatically converts rust programs using the most popular (in rust) arg parsing library to gui's https://github.com/MichalGniadek/klask https://github.com/MichalGniadek/klask
- Iv 4y ago
  Wow, such a good and useful idea!
- akpa1 4y ago
  This also exists for Python! It's called Gooey, and mimics the argparse standard library module. https://github.com/chriskiehl/Gooey https://github.com/chriskiehl/Gooey
werdnapk 4y ago
Needs a "wizard" interface. :)
- em-bee 4y ago
  try this one: https://www.reddit.com/r/photoshopbattles/comments/9w663a/psbattle_man_with_beard_sitting_on_a_chair_made/ https://www.reddit.com/r/photoshopbattles/comments/9w663a/ps...
charonn0 4y ago
I would use this if it existed.
xwdv 4y ago
Need certificate policy options. Highlight tabs that had values set.
notriddle 4y ago
I remember when I wrote a pretty harsh rant about a wget GUI [1]. This thing is much, much better. [1]: https://news.ycombinator.com/item?id=30797575 https://news.ycombinator.com/item?id=30797575 Just for fun, here's a list of things IMHO this one does right, and the wget one does wrong: * They actually have an option for specifying where the output data goes, and it's right at the top. * "Open..." buttons. OpenSSL doesn't ask you to type local filesystem paths directly into the thing. * There don't seem to be any sentinel values in here. Every optional config option has a checkbox or radio button to turn it on, instead of some magic like setting it to -1. * The spacing is a lot better. I don't see any places where the connection between checkboxes and their text entry fields is ambiguous, if you're willing to assume left-to-right, top-to-bottom associativity. And here's a few things it still does wrong: * Text boxes that won't get used should be grayed out. * The text output and display options make no sense at this stage. Instead, allow the user to configure what they see after running. Output everything, and use various kinds of disclosure widgets to to filter the output. * Multiple rows of tabs are bad [2]. These should be separate apps, like how LibreOffice Writer and Impress use the same backend but have separate start menu entries. [2]: https://www.nngroup.com/articles/tabs-used-right/ https://www.nngroup.com/articles/tabs-used-right/
- phil294 4y ago
  That wget GUI you are referring to and dragging through the dirt is a GPL Perl script from a lone programmer done in 2007 who did it out of personal motivation [1]. He provides his personal email address and asks for feedback through it. Have you contacted him? It's fine to shit on proprietary garbage by huge companies which are involving UX experts into their development process such as Reddit or Facebook UI, but what you're doing is not cool. [1] http://www.martin-achern.de/wgetgui http://www.martin-achern.de/wgetgui
  - roryokane 4y ago
    I think notriddle’s comment is fine. They didn’t criticize the designer of the UI, just the UI itself. Their detailed UI critique helps other people reading the comments improve their UI design skills by prompting them to think how to avoid such criticisms.
dekhn 4y ago
Truly great GUI design is very challenging. I've used very few applications which I think have a truly great UI that beats the CLI in terms of the efficiency of presenting options in orthogonal and conditional ways (orthogonal: two features which don't interact at all can usually be programmed independently and appear in distinct locations, while conditional: options that are only valid if another option is set to a specific value). The best UI I've worked with so far is Fusion 360. Like most 3d modelling tools it has a fairly steep learning curve, but it does a fantastic job of making your life easier. It has a bunch of UI dialogs for parameter setting (some of which are better than others) that do a good job with both orthogonality and conditionality. I really wanted to like blender but just about everything in it feels rotated 90 degrees to how I'd do it.
- bsder 4y ago
  What you probably like most are the "Radial Menus". Which are a damn good GUI paradigm. That nobody uses outside of games. And Fusion 360 basically had to write their own entire GUI engine to do all the stuff they wanted. Infuriatingly, Fusion 360 doesn't provide a Linux version which should be stupidly easy to do since they wrote their own GUI.
  - dekhn 4y ago
    IIRC Fusion 360 has radial menus (https://help.autodesk.com/view/fusion360/ENU/?guid=GUID-6514ABC1-CB75-4F0B-AB0E-316FAD36BA93 https://help.autodesk.com/view/fusion360/ENU/?guid=GUID-6514...), and I think it was a major part of Maya or another one of the older modellers. I was never a huge fan and the mouse model still trips me up (imho, mouse-button-1 drags should rotate, and shift/alt mouse-button-1 pan and zoom, respectively). Also, everything in Fusion 360 could be done in Qt5 without a lot of work, it's just that getting all the hints and the second level details (like maintaing the selection when you switch tools) is a real bear.
    - meue 4y ago
      I work in industrial design and the use of Alias for surface modeling is quite prevalent (and has been for decades). It used to be called PowerAnimator, and marking menus were first added somewhere around the release of v6 (1995). Alias/Wavefront actually incorporated this functionality into their first release of Maya several years later, trying to innovate on the feature further with the use of hotbox menus [1][2]. Since Alias corp. was later acquired by Autodesk in the early 2000's, you can imagine Fusion 360 as being the symbolical evolution of it. Especially considering the current Alias UI has not changed much since 1999! [3][4] If interested more on this topic, fun HCI bath-time reading: Gord Kurtenbach's 1993 dissertation on The Design and Evaluation of Marking Menus [5]. Not surprisingly, from Alias/Wavefront he went on to head Autodesk Research for most of the 2000's. [1]: https://books.google.com/books?id=7wEAAAAAMBAJ&pg=PT89&lpg=PT89 https://books.google.com/books?id=7wEAAAAAMBAJ&pg=PT89&lpg=P... [2]: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.86.8917&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.86... [3]: https://youtu.be/cVusw4JNK0s https://youtu.be/cVusw4JNK0s (1999) [4]: https://youtu.be/323fmUgwMyI https://youtu.be/323fmUgwMyI (2022) [5]: https://damassets.autodesk.net/content/dam/autodesk/www/autodesk-reasearch/Publications/pdf/the-design-and-evaluation.pdf https://damassets.autodesk.net/content/dam/autodesk/www/auto...
tigroferoce 4y ago
I have worked with smallstep and I can't say anything but amazing things. It's a top quality project with clear doc and great UX. I really wish we had many more projects like this. Kudos guys, kudos.
corrral 4y ago
This but instead as a "WTF are you trying to do?" wizard that left out options that are very obsolete or entirely a bad idea, would actually be cool. Start with the goal rather than the "how".
- msla 4y ago
  The UX design concept for that is probably "progressive disclosure": https://www.nngroup.com/articles/progressive-disclosure/ https://www.nngroup.com/articles/progressive-disclosure/ > Progressive disclosure defers advanced or rarely used features to a secondary screen, making applications easier to learn and less error-prone. "Encrypt File" would be a big button on the first screen, which would lead to the most common secure ways to encrypt a file that version of the software knows about, with less-common but still secure methods gated behind an "Advanced" button, and known-insecure methods gated behind a "Danger" button after that, which shows them on a screen which explains that they're known to be insecure and are not recommended for use. It's well-known that people, in general, refuse to read what's on their screens, so the warnings won't do a single bit of good if someone has the patience to click through all the way to the insecure algorithms. Since most people don't have that kind of patience, it evens out in the end.
mirekrusin 4y ago
Jesus, I just realized how amazingly clean and dense UIs really can be. Radios, checkboxes, sliders, complexity hiding tabs, help on hover (not shown), error messages on invalid inputs, making invalid inputs not representable in general etc. Imagine every cli tool having this kind of mock ui as playground that spits out cmd line command with args - as help tool/whatever as alternative to medium sized book text help.
- sprash 4y ago
  This is exactly what was done on A/UX (an obscure Apple Unix before NEXT). When you open CLI applications in Finder a GUI like this appears. (examples are here: "http://bitsavers.org/pdf/apple/mac/a_ux/aux_2.0/030-0759-A_AUX_Essentials_1990.pdf http://bitsavers.org/pdf/apple/mac/a_ux/aux_2.0/030-0759-A_A...", "chmod" page 89, "grep" page 152, "ls" page 157, "wc" page 164, ...)
  - im_down_w_otp 4y ago
    The Quadra 610 I have running A/UX 3.0 is presently taking umbrage with your calling it obscure, and I don't have the heart to tell it that you're right.
    - gattilorenz 4y ago
      Bring it to its senses by asking on how many non-Quadra Macs A/UX works. Hell, it did not even run on _all_ Quadras... Then give it a pat from me and my 650.
      - im_down_w_otp 4y ago
        Oh, it knows. As it won't even run on my Quadra 840AV. :-)
  - astrange 4y ago
    MPW had that in MacOS as well with Commando.
- 4y ago
colordrops 4y ago
The Jony Ive quote "When something exceeds your ability to understand how it works, it sort of becomes magical” sounds like a restatement of Arthur C Clarke's famous quote: “Any sufficiently advanced technology is indistinguishable from magic”
greyhair 4y ago
That isn't a praise of GUIs, it is a damnation of OpenSSL The exact opposite of *NIX philosophy. Don't do just one thing well, be Swiss Army knife, the largest one you have ever seen, with a lot of the blades poking part way out, so you may lacerate yourself at any moment.
- car_analogy 4y ago
  I heard rumors on HN that security agencies had a hand in making the protocols overly complex, hoping that would cause bugs in implementations they could exploit.
  - dymk 4y ago
    Sounds unfalsifiable
  - LeoPanthera 4y ago
    I mean, that's almost a textbook conspiracy theory. "Heard from a friend", hard to prove, hard to disprove.
    - mise_en_place 4y ago
      No conspiracy needed, they deliberately sabotaged certain standards to make them weak/easy to break, until it was caught by the security community and they were rightly rebuked for it. Like DES
    - car_analogy 4y ago
      "Heard a rumor" was there to provide an estimate of how (un)reliable the information was. My hope was someone would be able to confirm it, and it was not my intent to pass it off as confirmed fact. Regardless, as the sibling poster noted, they have already been caught weakening standards.
  - hannob 4y ago
    This may sound plausible at first, but if you've watched these kinds of things for a while there's an entirely plausible other explanation. Everyone wants to have their little special case feature in, and nobody says "No!". Very few people actively try to avoid complexity and favor simplicity in standardization processes, even fewer did up until a few years ago. "Avoiding complexity is good for security" is the thing that everyone will claim to agree if you say it, but hardly anyone follows in practice.
MontyCarloHall 4y ago
With rare exception, good GUIs are good because they intelligently restrict the options available to the user. The default values for 99% of OpenSSL options work for 99% of use cases. A good GUI designer would identify the 1% of options that frequently require nondefault values and expose only those to the user. A great GUI designer would identify more obscure options that might need manual specification depending on how other basic options are set and show those on an as-needed basis. If the above do not apply, then a GUI is probably not the right interface for your tool, as this facetious mess of a GUI hilariously illustrates.
kebman 4y ago
Everyone discussing the GUI, and none of them the tons of options that goes into PEM and DER files. For some obscure reason I decided that I needed to go into the hex coding of those, but eventually I just scrapped it and said "F IT! I'm just going to make my own bcos who needs compatibility or compliance anyway!1" (And don't get me started on ASN.1!)
axilmar 4y ago
This is not about GUIs, it's about OpenSSL. I.e. how complex it is.
AdamH12113 4y ago
I think people are wildly missing the point here. This GUI mock-up is not about improving usability, it's a comment on the hideous complexity of OpenSSL. The visible tab's options represent, in the words of the author, "80% of one corner of OpenSSL’s functionality". There are 45 tabs shown. On my monitor, this one tab is over two pages long. If the other tabs average out to a similar length, there would be around 100 pages of options available. That is too much complexity for a single security-critical program.
- ajsnigrutin 4y ago
  OpenSSL is a "swiss army knife" for all things security... making a bad (mock) gui makes it look a lot more terrible than it really is. Imagine the same gui for bash settings, ffmpeg or even just a browser (just look at the size of about:config!) Most people do just one of a few operations, where they copy-paste the commands found online, as they do with windows registry, firefox about:config or ffmpeg, so it's no different than that.
  - jyrkesh 4y ago
    > ffmpeg You mean like this? https://iangetz.com/projects/ffmpeg-builder/ https://iangetz.com/projects/ffmpeg-builder/ I'm a CLI guy, but `openssl` is insanely complex and I think it would benefit the ecosystem immensely if someone built a wrapper CLI that made it easier to complete the small handful of popular use cases that 90% of us have to go to Google to remember.
    - fugalfervor 4y ago
      I have seen many tutorials using CloudFlare's `cfssl` as an alternative.
    - ajsnigrutin 4y ago
      That is just a small subset of ffmpeg commands, here's the full list: https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a3a50 https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a... If you make a GUI out of this, it will be a pain in the ass... and ugly! Luckily, there are many ffmpeg frontends, that select just a tiny subset of commands that are most often needed (like yours and many others), and the same things exist for openssl, eg: https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/
codedokode 4y ago
This is just an example of poor GUI design. The author didn't make any attempt to think of user experience and just mechanically converted OpenSSL CLI options into widgets. This is not how one does GUI design [1]. For example, let's take "Input format" switch. Our computers can do billions of calculations per second, cannot they determine file format automatically? And show a warning if the format doesn't match file extension? Or let's look at checkboxes, determining which information should be displayed: "print serial number" and so on. Cannot a program just display all important information at once without toggling any checkboxes? Of course, CLI interface is good for using in scripts. But not every CLI program matches that purpose: utilities intended for use in scripts should output data in machine-friendly format like CSV or JSON or TOML or even specially invented CLIML, but not in plain text. Otherwise scripts will break every time they stumble upon a filename with spaces. Sadly, despite decades of evolution, many CLI programs are not machine-friendly yet. I use openssl maybe once a month or once a year and I cannot remember a single option. I would rather prefer to type "crypttool /some/file.pem" than spend time finding out which options I need to specify. And obviously if I had to manage a company-wide PKI with its own CA I would definitely prefer a well designed GUI tool. [1] Please note that I am not a designer. I just learn things by observing other people's work.
- mmalone 4y ago
  It's a critique of OpenSSL, which also makes no attempt to think of user experience.
linsomniac 4y ago
I have been playing around with trying to simplify the CLI-based self-signed CA use case, which started as a Memorial Day Weekend toy project. I have something working for the "new cert" case which replaces the old shell script that manages openssl.cnf files that no longer met our current use case (largely because it didn't support SANs). My experiment is basically: A config file, which can be overridden by the environment or CLI options, for the common certificate generation arguments. So the simple use case is: rgca cert new --san users.example.com www.example.com It can also run pre and post scripts to, say update your serial/index in git, and deploy keys to the server, say you are rekeying every 30 days... Interested in feedback. https://github.com/linsomniac/rgca https://github.com/linsomniac/rgca
qwertox 4y ago
I've finally found some time to play with WireGuard and have been doing so for nearly a month now for about 5 hours a week. Many things were really easy and clear, in contrast to OpenVPN, though it lacks some hooks I'd like to have. For example something like OpenVPN's `client-connect` and `client-disconnect` script triggers. Also it looks like one can't reduce the handshake interval. And the issue with DynDNS where it doesn't reconnect to a new IP if it changes (though there are acceptable workarounds for this). I'm currently looking at how I can replace my site-to-site OpenVPN setup with it, where the issue is that I don't have physical access to the remote site, so the slightest mistake can end up being a real problem.
- tptacek 4y ago
  WireGuard is much, much better than OpenVPN, and almost nobody should still be deploying OpenVPN, but this is about OpenSSL, not OpenVPN.
gsich 4y ago
This looks actually good.
tptacek 4y ago
This is funny, but the OpenSSL CLI is in large part just a series of utility/driver/diagnostic programs for library functionality that isn't expected to be used on a standalone basis. It's the industry standard for generating certificates, but that's because the industry doesn't understand certificates; most people should be using nothing but certbot and mkcert. What bugs me a little is the idea that you might want a well-designed version of what the OpenSSL CLI offers. Bad idea! You want tools designed to do one thing well, not one tool that offers a thin layer of getopt() over a low-level cryptography API.
- georgyo 4y ago
  Mkcert and certbot are new utilities. OpenSSL predates them by decades. Before acme, someone had to create a CSR manually, often using OpenSSL. Also, should therw be a separate tool to debug and inspect ssl certs and connection? How many individual tools should there be?
  - sreevisakh 4y ago
    Perhaps it's worth mentioning XCA [1] at this point. It's a GUI based on openssl that provides an intuitive UI for managing keys, certs (root CA, intermediate CA, server and client) and CSR. It existed before acme and mkcert. What I liked in XCA was that it made it easy to review all parameters related to the operations it managed. [1] https://hohnstaedt.de/xca/index.php https://hohnstaedt.de/xca/index.php
    - Ayesh 4y ago
      I continue to use it even today for small root stores I manage for internal networks. Very clean and intuitive UI that gets the job done well. Also using Kleopatra for GPG keys.
    - urda 4y ago
      +1 XCA. It is a fantastic way to manage your own root CA.
  - tptacek 4y ago
johnklos 4y ago
Side note: the cookies preference pop-up on that site is absolutely evil. Anyone who actually chooses something like that is an asshole. It's funny that someone who writes an article about how crazy of a GUI OpenSSL would have to have would also have a form that someone needs to fill out to opt-out of bullshit tracking. It's almost as if... Never mind. This Carl Tashian person is just shitty.
- fein 4y ago
  Was this recently disabled? I'm on mobile right now (android) and tried reloading in desktop mode, but to no avail. I never saw this prompt. The way you describe it almost seems like a joke, as in "If GDPR were a GUI".
  - johnklos 4y ago
    There's a "chat" floating icon in the lower right corner on the desktop web page, and along with that there's a floating checkmark above that. If you click on the checkmark, you can see the "This site uses cookies", "Continue to site", "Policies | Preferences", "Do not sell my personal information" window.
- pmontra 4y ago
  The controls in that pop up are definitely worse than the ones in the OpenSSL GUI mockup. The boolean switches suffer from the same problem of many light switches: which is the on position and which is the off one? The radio buttons in the mock up are impossible to mistake. Accept ( ) Do not accept (*) would do.
  - deleted 4y ago
    [deleted]
jasonhansel 4y ago
Honestly: this is what I dislike about OpenSSL. There are so many different knobs you can turn that I'm not sure how to use it securely, or whether specific options increase or decrease security. Its documentation seems to assume a lot of background knowledge about cryptography and the technologies involved, making it particularly tricky to get things right or figure out how to perform even simple workflows safely.
forinti 4y ago
Every time I have to use Bouncy Castle, it feels like everything has changed. Crypto is a muddle of protocols, formats, and algorithms.
j1elo 4y ago
What this tells me is that a tool that follows the "huge swiss army knife" style instead of "do just one thing and do it well", ought to have an extra option that provides Profiles for the most common use cases. Otherwise for most non-expert people (but who end up needing to use the tool anyways for whatever reason), who I'd wager is the majority of users, the tool is close to useless due to the sheer amount of knobs. Just provide some profiles, for the love of $DEITY!
vonwoodson 4y ago
I love how simple this is for newcomers. With this tool we can finally get folks managing their own privacy and stop asking poor developers to implement “same defaults”
jeroenhd 4y ago
That's a funny spoof for a GUI. I don't know what design language was used here, but it's pretty outdated by now. Windows (for domain admins) has similar tools to OpenSSL. How do you use that, you may ask? Simple: wizards. There's a wizard to create a CA. There's a wizard to create a CSR. There's a wizard to sign said CSR. There are probably wizards to set up custom wizards. When you turn OpenSSL into a step-by-step process (with the subcommand chosen by the button that spawns the wizard, as well as a separate wizard for the "mini CA") it becomes quite manageable. Just stuff each part into a separate page and filter out any options that might be irrelevant based on earlier choices. You'd end up with a seven to eight step wizard for most operations and I doubt you'd be as confused. OpenSSL is forty tools in one executable.
- easrng 4y ago
  That's one of the pre-OSX Mac UI styles.
userbinator 4y ago
As someone who doesn't use OpenSSL often enough to remember all the options, this actually looks very useful to have (with the exception of the help and list options). That said, the pixelated tabs and controls combined with an antialiased font look really weird. I suppose it could be called the "fake retro" aesthetic.
makecheck 4y ago
Brings back memories; the Apple Platinum look appeared around the time when 90% of the UI was black-and-white or at least boring so it really seemed to instantly transform the Mac into a professional-looking tool. I can’t wait until they release it (oh wait, they did, decades ago; now we just have — whatever — the Mac is now).
- asveikau 4y ago
  In hindsight I'm not sure if I prefer Platinum over System 7. They both looked good and evoke nostalgia.
knowaveragejoe 4y ago
All criticism of OpenSSL aside, I would like to see other tools represented in a similar fashion. If nothing else it is more intuitive for me to look at this and understand what is possible than a man page.
neycoda 4y ago
That is awesome. I'm glad I don't have to use it as a GUI and that I can have all those options nicely tucked away until I need to look something up that I haven't memorized from frequent usage yet.
codegangsta 4y ago
This better explains how ruthlessly focused UI design needs to be. User Interface design needs to know the person on the other side, what their motives are and what makes them feel like they have superpowers. OpenSSL is a system. A GUI needs to bridge the gap between the system and the user, and it can’t be done in one implementation, because the types of user is super diverse. Makes the whole act of UI design increasingly challenging and fun all at the same time
- paulryanrogers 4y ago
  OpenSSL is an expert tool. And one that should probably be three or more specialized tools instead. Then three+ expert UIs built on them. Any simpler UIs should probably just consume a stable API of those more specialized tools/libraries. This is kind of happening with the various forks and alternative tooling taking over. But not soon even IMO. Anyway, a girl can dream.
drawingthesun 4y ago
This got me thinking, is there any program that converts cli tool to gui?!? It would perhaps take a cli program as its input, and outputs a gui version of the input program? I know this is a bad idea! But still, the gui in the article looks kinda cool.
- noasaservice 4y ago
  To give that idea serious credence would mean being able to parse the inputs and outputs, and make the togglable settings on each. When it's a simple number, that's not hard. When it's a file, it's a lot harder, since there's a lot of non-file files (fifo's, directories, symlinks, hard symlinks, network locations, mountpoints, etc). And don't forget that you can pipe stuff in anything that looks like a file. It sounds simple, but for things like ffmpeg or openssl, the possibilities are just stupid complex.
spaetzleesser 4y ago
Now let’s do a GUI for all git options!
shp0ngle 4y ago
I wish there was one for ffmpeg.... wait maybe there is one? edit: no there isn't
KronisLV 4y ago
I... kind of like it? Not the fact that using such a GUI would be almost impossible, like the humorous example of an "engineer oriented UI" in the Silicon Valley series https://www.reddit.com/r/SiliconValleyHBO/comments/4nvvnl/pied_pipers_easytouse_tools/ https://www.reddit.com/r/SiliconValleyHBO/comments/4nvvnl/pi... which might be confusing for most people. But rather the fact that all of the complexity the software has is laid bare, so that nobody could mistakenly assume that it's just a small utility that does just one thing. But rather, that it's a system with a large surface area and plenty of things that it attempts to do. Somehow the example also has better discoverability of what's available to use, than reading manpages or help documentation ever would. So I guess, why not? Hide 80% of the GUI under context sensitive menus and options and you'll actually have something usable. For an example of a good GUI in this space, see KeyStore Explorer: https://keystore-explorer.org/ https://keystore-explorer.org/ Somehow, if you look at the screenshots, it actually feels more discoverable for the average user than using a CLI tool might be: https://keystore-explorer.org/screenshots.html https://keystore-explorer.org/screenshots.html (especially if you talk about the Java CLI tools in the space) The problems with GUIs are largely the fact that they don't really map nicely to CLI commands and usually cannot be automated themselves - the ideal software would have a GUI that's optionally available, but would offer you the underlying CLI commands when you're about to do something (implying that the UI would be separate from the logic, being optional). The best example that I can think of this is Zenmap, a GUI for nmap: https://nmap.org/zenmap/ https://nmap.org/zenmap/ So in the GUI you might pick: Target: some_ip_address Profile: Intense scan plus UDP (dropdown) And get the following output: nmap -sS -sU -T4 -A -v some_ip_address Whether you execute the command through the UI or add it to some script, that's up to you. Some other software that comes to mind: - Kdenlive: shows you what the encoder command for rendering videos will be - SourceTree (or other Git GUIs): shows you what commands you're attempting to execute - MySQL Workbench/pgAdmin: shows you what SQL will be executed I think that's the perfect approach to having your cake and eating it too.
hardware2win 4y ago
Wow, this is incredibly good way of showing complexity of things Within a few secs i had somewhat not bad awarness of how big this thing can be I would want to see more If x were a gui
jokoon 4y ago
I once tried to encrypt something with pip install cryptography, for personal purposes and to learn. I can't remember that I managed to do it properly, but as I asked on IRC, I was warned that there was a lot of probability of doing it wrong. I guess I will keep trusting 7zip (who had a crypto flaw at some point).

744 points by soheilpro 4y ago

A badly designed GUI. You should determine first what options are independent of other options, and which options aren't.

ykl 4y ago
I think that’s the whole joke; OpenSSL’s various options are so extensive and so Byzantine that this is what you end up with.

phtrivier 4y ago

Is there a reasonable subset of openssl / TLS / whatever that covers the use case people should really start with in 2022 ? Can it get a branding ?

gspr 4y ago
I believe things look a lot better if you stick to TLS 1.3 only, and drop support for almost all formats for certificates.
krallja 4y ago
I think that’s the intention of LibreSSL.

sudu1 4y ago

Nice world

jandrusk 4y ago

This also demonstrates were CLI excels and where GUI's fall short. With the GUI your just stuck digging for the correct option and tab. With the CLI you can create aliases or shell scripts to make wrappers for complex CLI options. Not to mention building custom openssl.cnf configs.

layer8 4y ago
An actual GUI for openssl tasks could be hugely more user-friendly than the one depicted here. If anything, it demonstrates that a GUI interface could be superior (for non-scripting use, obviously), because the depicted version is meant to illustrate the CLI experience.
- deleted 4y ago
  [deleted]
behnamoh 4y ago
Maybe that's also why visual programming never took off. There's just a sense of "power and control" that comes with raw text that's unmatched in GUI apps. I agree with your point about CLI. At the same time, I wish we had more GUI *inside* CLI. For example, an interactive and pretty MAN page that's not just text, but has clear borders, boxes, buttons (with keyboard shortcuts), and uses different colors for different sections (e.g., command description, arguments, examples, etc.)
- ocdtrekkie 4y ago
  I think there's a strong case for a lot of systems having both a GUI and a CLI, because there are purposes each excel at, and a user may want to be able to switch between them depending what they are doing.
  - behnamoh 4y ago
    I think VSCode's command palette is close to this idea. I wish MS Word and other apps would add something similar.
dmart 4y ago
Funny, when I looked at this my first impression was how much nicer the (hypothetical) GUI looked to use, with all of the functionality easily discoverable without digging through man pages and rewriting your intentions in terms of obscure flags. To clarify, I'm not saying the GUI is actually better. But I wish we could bring some of those conveniences to the command line experience (way better autocomplete and command discovery).

jchw 4y ago

I would love to see the equivalent “If libsodium were a GUI.”

marcosdumay 4y ago
A large part of what makes libsodium simple is that it does very little. Some of doing little is great. It does not let you erratically mess with your encryption options, it does not let you apply a bad algorithm, and it does not let you use one algorithm for a task it's badly suited for (well, up to a point). But some of it is just things the library doesn't do. You can't run a PKI with it, you can't deal with industry-standard file types, and your options for interoperability are just none. It's really good to make those nice focused libraries that people can actually use. But that doesn't remove the need for kitchen-sink packages that will solve every problem under the Sun.
- jchw 4y ago
  This is true, but a majority of projects are using this kitchen sink library, poorly, for roughly the same 0.2% of it. Not good. Thankfully, the situation has improved; at least some old stuff has been moved off into a module in 3.x, and a lot of cruft has been cleaned up. But still, it’s hard to not want to pick a library with reduced scope, if you at all can.
  - marcosdumay 4y ago
    You should pick a library with reduced scope. And not feel any bad about it. But that doesn't mean the kitchen sink one is useless.
    - jchw 4y ago
      Yeah, I think we're in agreement.

fizzbuzz-rs 4y ago

Practically all GUI software would look too complicated if you have to put everything on one screen. Compare tar and your favorite archive tool GUI.

RcouF1uZ4gsC 4y ago

As an aside, does anyone else miss the tabbed interfaces of the late 1990’s?

layer8 4y ago
Yes, except that the reordering behavior of multi-row tab controls always confuses me, and that there should be a way to “break out” individual tabs to see them side-by-side, maybe similar to an MDI interface.
- em-bee 4y ago
  with so many tabs, i'd put them in a column down the left side

equivocates 4y ago

Let me introduce you to a little app called FFMPEG

billyhoffman 4y ago
True, but you use the wrong FFMpeg codec, or transcode an audio track instead of copying it to the output, no one is left dangerously insecure. You just have a bloated MKV :-D
- astrange 4y ago
  A whole lot of option combinations to ffmpeg straight up don't work and will produce broken files. Streamcopy is a lot more likely to find those.
em-bee 4y ago
and there are dozens of GUIs for it.
- usrn 4y ago
  And most look pretty much like that.
apocalyptic0n3 4y ago
There are plenty of ffmpeg interfaces, though. The most prominent is Handbrake. Of course, I don't think any of them try to expose every single option. The goal for them is almost always to create an interface that works for the 99% and let the 1% deal with the CLI
formerly_proven 4y ago
Both ffmpeg(1) and openssl(1) share that they're meant, or used to be meant, as examples/demos of the underlying APIs. No one was actually supposed to run an actual CA with openssl(1), for example. Both also share that some things are vastly easier using the API than bending over backwards thrice at full moon using the CLI, but because using the API has more friction to it, people generally stick to the CLI (almost) no matter how hard that'll make things. Oh, and just like you have to know a ton about how media containers, streams and codecs actually work to use the ffmpeg API, you likewise need to be a crypto expert to use the OpenSSL API. Almost the same is true for their CLIs as well, though.

throwaway0x7E6 4y ago

I unironically love this

bbkane 4y ago

Is it bad that I actually want this?

layer8 4y ago
No, I had the same thought. Moreover, a GUI/TUI would actually allow implementing some further usability improvements. And there could be a “save as script” option.
raisedbyninjas 4y ago
I was just wondering if this existed yesterday. LetsEncrypt is out there for real certs. I need a site cert for local development. Why can't I type my hostname and mash one button?
marcosdumay 4y ago
I want a version of this that spills the command at the end. One that runs it, not so much.
- banana_giraffe 4y ago
  A team I worked on years ago had a build system with an insane number of options. Someone made a GUI that looked vaguely like this OpenSSL GUI does, only it didn't have a "Build" button, but a textbox that showed you the command line options you had picked (I think it could automatically save to a script as well). It was such a useful tool. I've endeavored to recreate that a few times in other teams when I encounter a tool with a --help that's more than a page long. Really helps new people figure things out.
- mr_mitm 4y ago
  I'd settle for tab completion of openssl parameters, but even that is a tall order, unless you only cover a very small portion of it.

matthewaveryusa 4y ago

This is where the builder pattern works really well. rclone is a good example of a cli that uses a builder for config, and turbotax for guis.

chaps 4y ago

Heh, I once did the opposite and turned an infrastructure's asset management GUI/API into a CLI tool. It had a backend API which presented some decent typing and its nested structure, so it wasn't beyond impossible, just had to be massaged into a doctopt string. It was, uh... It had a lot of options. It was immediately obvious that it was beyond useless because any use of the tool started with a search in the documentation, just as I would if I was just calling the API. No time saved and had an excessively small niche.

em-bee 4y ago
this highlights the difference: on a commandline it is syntactically easy to add lots of options, whereas the GUI has limits, but the GUI is easier to discover. for the commandline you need to read documentation.

riazrizvi 4y ago

Beautiful and educational. It’s a design activity very similar to building a good cheat sheet or study guide. From an evolutionary standpoint our intelligence is heavily oriented toward navigation of complex terrain, to locate food sources and avoid danger. So translating this API into a structured layout makes it more suited to our natural learning faculties.

kringo 4y ago

A great way to visualize the complexity of OpenSSL Like others mentioned FFMPEG is even complex :-)

ape4 4y ago

As we know too many options / complexity is bad for reliable cryptography. Perhaps some options could be removed or depreciated.

mseepgood 4y ago

Why would it be implemented for Mac OS 9?

jandrese 4y ago
Because it would have been implemented in 1999 and then left to rot for decades, just like the CLI interface.
- sph 4y ago
  It would probably be some old Tcl/Tk GUI module written in 1999 that a single madman has maintained until today.

tambourine_man 4y ago

Checkboxes are not 100% platinum accurate, but great job all in all.

throw7 4y ago

Do ImageMagick! ;)

em-bee 4y ago
imagemagick has a GUI: display

throwaway892238 4y ago

Does this exist? Because I want it. The only thing it needs is a couple extra buttons at the top like "Modern TLS Certificate" and it selects the right options, but then I can tweak it from there.

commandlinefan 4y ago

I was really hoping those tabs would be clickable...

gpm 4y ago

This reminds me of this project which automatically converts rust programs using the most popular (in rust) arg parsing library to gui's https://github.com/MichalGniadek/klask https://github.com/MichalGniadek/klask

Iv 4y ago
Wow, such a good and useful idea!
akpa1 4y ago
This also exists for Python! It's called Gooey, and mimics the argparse standard library module. https://github.com/chriskiehl/Gooey https://github.com/chriskiehl/Gooey

werdnapk 4y ago

Needs a "wizard" interface. :)

em-bee 4y ago
try this one: https://www.reddit.com/r/photoshopbattles/comments/9w663a/psbattle_man_with_beard_sitting_on_a_chair_made/ https://www.reddit.com/r/photoshopbattles/comments/9w663a/ps...

charonn0 4y ago

I would use this if it existed.

xwdv 4y ago

Need certificate policy options. Highlight tabs that had values set.

notriddle 4y ago

I remember when I wrote a pretty harsh rant about a wget GUI [1]. This thing is much, much better. [1]: https://news.ycombinator.com/item?id=30797575 https://news.ycombinator.com/item?id=30797575 Just for fun, here's a list of things IMHO this one does right, and the wget one does wrong: * They actually have an option for specifying where the output data goes, and it's right at the top. * "Open..." buttons. OpenSSL doesn't ask you to type local filesystem paths directly into the thing. * There don't seem to be any sentinel values in here. Every optional config option has a checkbox or radio button to turn it on, instead of some magic like setting it to -1. * The spacing is a lot better. I don't see any places where the connection between checkboxes and their text entry fields is ambiguous, if you're willing to assume left-to-right, top-to-bottom associativity. And here's a few things it still does wrong: * Text boxes that won't get used should be grayed out. * The text output and display options make no sense at this stage. Instead, allow the user to configure what they see after running. Output everything, and use various kinds of disclosure widgets to to filter the output. * Multiple rows of tabs are bad [2]. These should be separate apps, like how LibreOffice Writer and Impress use the same backend but have separate start menu entries. [2]: https://www.nngroup.com/articles/tabs-used-right/ https://www.nngroup.com/articles/tabs-used-right/

phil294 4y ago
That wget GUI you are referring to and dragging through the dirt is a GPL Perl script from a lone programmer done in 2007 who did it out of personal motivation [1]. He provides his personal email address and asks for feedback through it. Have you contacted him? It's fine to shit on proprietary garbage by huge companies which are involving UX experts into their development process such as Reddit or Facebook UI, but what you're doing is not cool. [1] http://www.martin-achern.de/wgetgui http://www.martin-achern.de/wgetgui
- roryokane 4y ago
  I think notriddle’s comment is fine. They didn’t criticize the designer of the UI, just the UI itself. Their detailed UI critique helps other people reading the comments improve their UI design skills by prompting them to think how to avoid such criticisms.

dekhn 4y ago

Truly great GUI design is very challenging. I've used very few applications which I think have a truly great UI that beats the CLI in terms of the efficiency of presenting options in orthogonal and conditional ways (orthogonal: two features which don't interact at all can usually be programmed independently and appear in distinct locations, while conditional: options that are only valid if another option is set to a specific value). The best UI I've worked with so far is Fusion 360. Like most 3d modelling tools it has a fairly steep learning curve, but it does a fantastic job of making your life easier. It has a bunch of UI dialogs for parameter setting (some of which are better than others) that do a good job with both orthogonality and conditionality. I really wanted to like blender but just about everything in it feels rotated 90 degrees to how I'd do it.

bsder 4y ago
What you probably like most are the "Radial Menus". Which are a damn good GUI paradigm. That nobody uses outside of games. And Fusion 360 basically had to write their own entire GUI engine to do all the stuff they wanted. Infuriatingly, Fusion 360 doesn't provide a Linux version which should be stupidly easy to do since they wrote their own GUI.
- dekhn 4y ago
  IIRC Fusion 360 has radial menus (https://help.autodesk.com/view/fusion360/ENU/?guid=GUID-6514ABC1-CB75-4F0B-AB0E-316FAD36BA93 https://help.autodesk.com/view/fusion360/ENU/?guid=GUID-6514...), and I think it was a major part of Maya or another one of the older modellers. I was never a huge fan and the mouse model still trips me up (imho, mouse-button-1 drags should rotate, and shift/alt mouse-button-1 pan and zoom, respectively). Also, everything in Fusion 360 could be done in Qt5 without a lot of work, it's just that getting all the hints and the second level details (like maintaing the selection when you switch tools) is a real bear.
  - meue 4y ago
    I work in industrial design and the use of Alias for surface modeling is quite prevalent (and has been for decades). It used to be called PowerAnimator, and marking menus were first added somewhere around the release of v6 (1995). Alias/Wavefront actually incorporated this functionality into their first release of Maya several years later, trying to innovate on the feature further with the use of hotbox menus [1][2]. Since Alias corp. was later acquired by Autodesk in the early 2000's, you can imagine Fusion 360 as being the symbolical evolution of it. Especially considering the current Alias UI has not changed much since 1999! [3][4] If interested more on this topic, fun HCI bath-time reading: Gord Kurtenbach's 1993 dissertation on The Design and Evaluation of Marking Menus [5]. Not surprisingly, from Alias/Wavefront he went on to head Autodesk Research for most of the 2000's. [1]: https://books.google.com/books?id=7wEAAAAAMBAJ&pg=PT89&lpg=PT89 https://books.google.com/books?id=7wEAAAAAMBAJ&pg=PT89&lpg=P... [2]: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.86.8917&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.86... [3]: https://youtu.be/cVusw4JNK0s https://youtu.be/cVusw4JNK0s (1999) [4]: https://youtu.be/323fmUgwMyI https://youtu.be/323fmUgwMyI (2022) [5]: https://damassets.autodesk.net/content/dam/autodesk/www/autodesk-reasearch/Publications/pdf/the-design-and-evaluation.pdf https://damassets.autodesk.net/content/dam/autodesk/www/auto...

tigroferoce 4y ago

I have worked with smallstep and I can't say anything but amazing things. It's a top quality project with clear doc and great UX. I really wish we had many more projects like this. Kudos guys, kudos.

corrral 4y ago

This but instead as a "WTF are you trying to do?" wizard that left out options that are very obsolete or entirely a bad idea, would actually be cool. Start with the goal rather than the "how".

msla 4y ago
The UX design concept for that is probably "progressive disclosure": https://www.nngroup.com/articles/progressive-disclosure/ https://www.nngroup.com/articles/progressive-disclosure/ > Progressive disclosure defers advanced or rarely used features to a secondary screen, making applications easier to learn and less error-prone. "Encrypt File" would be a big button on the first screen, which would lead to the most common secure ways to encrypt a file that version of the software knows about, with less-common but still secure methods gated behind an "Advanced" button, and known-insecure methods gated behind a "Danger" button after that, which shows them on a screen which explains that they're known to be insecure and are not recommended for use. It's well-known that people, in general, refuse to read what's on their screens, so the warnings won't do a single bit of good if someone has the patience to click through all the way to the insecure algorithms. Since most people don't have that kind of patience, it evens out in the end.

mirekrusin 4y ago

Jesus, I just realized how amazingly clean and dense UIs really can be. Radios, checkboxes, sliders, complexity hiding tabs, help on hover (not shown), error messages on invalid inputs, making invalid inputs not representable in general etc. Imagine every cli tool having this kind of mock ui as playground that spits out cmd line command with args - as help tool/whatever as alternative to medium sized book text help.

sprash 4y ago
This is exactly what was done on A/UX (an obscure Apple Unix before NEXT). When you open CLI applications in Finder a GUI like this appears. (examples are here: "http://bitsavers.org/pdf/apple/mac/a_ux/aux_2.0/030-0759-A_AUX_Essentials_1990.pdf http://bitsavers.org/pdf/apple/mac/a_ux/aux_2.0/030-0759-A_A...", "chmod" page 89, "grep" page 152, "ls" page 157, "wc" page 164, ...)
- im_down_w_otp 4y ago
  The Quadra 610 I have running A/UX 3.0 is presently taking umbrage with your calling it obscure, and I don't have the heart to tell it that you're right.
  - gattilorenz 4y ago
    Bring it to its senses by asking on how many non-Quadra Macs A/UX works. Hell, it did not even run on _all_ Quadras... Then give it a pat from me and my 650.
    - im_down_w_otp 4y ago
      Oh, it knows. As it won't even run on my Quadra 840AV. :-)
- astrange 4y ago
  MPW had that in MacOS as well with Commando.
4y ago

colordrops 4y ago

The Jony Ive quote "When something exceeds your ability to understand how it works, it sort of becomes magical” sounds like a restatement of Arthur C Clarke's famous quote: “Any sufficiently advanced technology is indistinguishable from magic”

greyhair 4y ago

That isn't a praise of GUIs, it is a damnation of OpenSSL The exact opposite of *NIX philosophy. Don't do just one thing well, be Swiss Army knife, the largest one you have ever seen, with a lot of the blades poking part way out, so you may lacerate yourself at any moment.

car_analogy 4y ago
I heard rumors on HN that security agencies had a hand in making the protocols overly complex, hoping that would cause bugs in implementations they could exploit.
- dymk 4y ago
  Sounds unfalsifiable
- LeoPanthera 4y ago
  I mean, that's almost a textbook conspiracy theory. "Heard from a friend", hard to prove, hard to disprove.
  - mise_en_place 4y ago
    No conspiracy needed, they deliberately sabotaged certain standards to make them weak/easy to break, until it was caught by the security community and they were rightly rebuked for it. Like DES
  - car_analogy 4y ago
    "Heard a rumor" was there to provide an estimate of how (un)reliable the information was. My hope was someone would be able to confirm it, and it was not my intent to pass it off as confirmed fact. Regardless, as the sibling poster noted, they have already been caught weakening standards.
- hannob 4y ago
  This may sound plausible at first, but if you've watched these kinds of things for a while there's an entirely plausible other explanation. Everyone wants to have their little special case feature in, and nobody says "No!". Very few people actively try to avoid complexity and favor simplicity in standardization processes, even fewer did up until a few years ago. "Avoiding complexity is good for security" is the thing that everyone will claim to agree if you say it, but hardly anyone follows in practice.

MontyCarloHall 4y ago

With rare exception, good GUIs are good because they intelligently restrict the options available to the user. The default values for 99% of OpenSSL options work for 99% of use cases. A good GUI designer would identify the 1% of options that frequently require nondefault values and expose only those to the user. A great GUI designer would identify more obscure options that might need manual specification depending on how other basic options are set and show those on an as-needed basis. If the above do not apply, then a GUI is probably not the right interface for your tool, as this facetious mess of a GUI hilariously illustrates.

kebman 4y ago

Everyone discussing the GUI, and none of them the tons of options that goes into PEM and DER files. For some obscure reason I decided that I needed to go into the hex coding of those, but eventually I just scrapped it and said "F IT! I'm just going to make my own bcos who needs compatibility or compliance anyway!1" (And don't get me started on ASN.1!)

axilmar 4y ago

This is not about GUIs, it's about OpenSSL. I.e. how complex it is.

AdamH12113 4y ago

I think people are wildly missing the point here. This GUI mock-up is not about improving usability, it's a comment on the hideous complexity of OpenSSL. The visible tab's options represent, in the words of the author, "80% of one corner of OpenSSL’s functionality". There are 45 tabs shown. On my monitor, this one tab is over two pages long. If the other tabs average out to a similar length, there would be around 100 pages of options available. That is too much complexity for a single security-critical program.

ajsnigrutin 4y ago
OpenSSL is a "swiss army knife" for all things security... making a bad (mock) gui makes it look a lot more terrible than it really is. Imagine the same gui for bash settings, ffmpeg or even just a browser (just look at the size of about:config!) Most people do just one of a few operations, where they copy-paste the commands found online, as they do with windows registry, firefox about:config or ffmpeg, so it's no different than that.
- jyrkesh 4y ago
  > ffmpeg You mean like this? https://iangetz.com/projects/ffmpeg-builder/ https://iangetz.com/projects/ffmpeg-builder/ I'm a CLI guy, but `openssl` is insanely complex and I think it would benefit the ecosystem immensely if someone built a wrapper CLI that made it easier to complete the small handful of popular use cases that 90% of us have to go to Google to remember.
  - fugalfervor 4y ago
    I have seen many tutorials using CloudFlare's `cfssl` as an alternative.
  - ajsnigrutin 4y ago
    That is just a small subset of ffmpeg commands, here's the full list: https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a3a50 https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a... If you make a GUI out of this, it will be a pain in the ass... and ugly! Luckily, there are many ffmpeg frontends, that select just a tiny subset of commands that are most often needed (like yours and many others), and the same things exist for openssl, eg: https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/

codedokode 4y ago

This is just an example of poor GUI design. The author didn't make any attempt to think of user experience and just mechanically converted OpenSSL CLI options into widgets. This is not how one does GUI design [1]. For example, let's take "Input format" switch. Our computers can do billions of calculations per second, cannot they determine file format automatically? And show a warning if the format doesn't match file extension? Or let's look at checkboxes, determining which information should be displayed: "print serial number" and so on. Cannot a program just display all important information at once without toggling any checkboxes? Of course, CLI interface is good for using in scripts. But not every CLI program matches that purpose: utilities intended for use in scripts should output data in machine-friendly format like CSV or JSON or TOML or even specially invented CLIML, but not in plain text. Otherwise scripts will break every time they stumble upon a filename with spaces. Sadly, despite decades of evolution, many CLI programs are not machine-friendly yet. I use openssl maybe once a month or once a year and I cannot remember a single option. I would rather prefer to type "crypttool /some/file.pem" than spend time finding out which options I need to specify. And obviously if I had to manage a company-wide PKI with its own CA I would definitely prefer a well designed GUI tool. [1] Please note that I am not a designer. I just learn things by observing other people's work.

mmalone 4y ago
It's a critique of OpenSSL, which also makes no attempt to think of user experience.

linsomniac 4y ago

I have been playing around with trying to simplify the CLI-based self-signed CA use case, which started as a Memorial Day Weekend toy project. I have something working for the "new cert" case which replaces the old shell script that manages openssl.cnf files that no longer met our current use case (largely because it didn't support SANs). My experiment is basically: A config file, which can be overridden by the environment or CLI options, for the common certificate generation arguments. So the simple use case is: rgca cert new --san users.example.com www.example.com It can also run pre and post scripts to, say update your serial/index in git, and deploy keys to the server, say you are rekeying every 30 days... Interested in feedback. https://github.com/linsomniac/rgca https://github.com/linsomniac/rgca

qwertox 4y ago

I've finally found some time to play with WireGuard and have been doing so for nearly a month now for about 5 hours a week. Many things were really easy and clear, in contrast to OpenVPN, though it lacks some hooks I'd like to have. For example something like OpenVPN's `client-connect` and `client-disconnect` script triggers. Also it looks like one can't reduce the handshake interval. And the issue with DynDNS where it doesn't reconnect to a new IP if it changes (though there are acceptable workarounds for this). I'm currently looking at how I can replace my site-to-site OpenVPN setup with it, where the issue is that I don't have physical access to the remote site, so the slightest mistake can end up being a real problem.

tptacek 4y ago
WireGuard is much, much better than OpenVPN, and almost nobody should still be deploying OpenVPN, but this is about OpenSSL, not OpenVPN.

gsich 4y ago

This looks actually good.

tptacek 4y ago

This is funny, but the OpenSSL CLI is in large part just a series of utility/driver/diagnostic programs for library functionality that isn't expected to be used on a standalone basis. It's the industry standard for generating certificates, but that's because the industry doesn't understand certificates; most people should be using nothing but certbot and mkcert. What bugs me a little is the idea that you might want a well-designed version of what the OpenSSL CLI offers. Bad idea! You want tools designed to do one thing well, not one tool that offers a thin layer of getopt() over a low-level cryptography API.

georgyo 4y ago
Mkcert and certbot are new utilities. OpenSSL predates them by decades. Before acme, someone had to create a CSR manually, often using OpenSSL. Also, should therw be a separate tool to debug and inspect ssl certs and connection? How many individual tools should there be?
- sreevisakh 4y ago
  Perhaps it's worth mentioning XCA [1] at this point. It's a GUI based on openssl that provides an intuitive UI for managing keys, certs (root CA, intermediate CA, server and client) and CSR. It existed before acme and mkcert. What I liked in XCA was that it made it easy to review all parameters related to the operations it managed. [1] https://hohnstaedt.de/xca/index.php https://hohnstaedt.de/xca/index.php
  - Ayesh 4y ago
    I continue to use it even today for small root stores I manage for internal networks. Very clean and intuitive UI that gets the job done well. Also using Kleopatra for GPG keys.
  - urda 4y ago
    +1 XCA. It is a fantastic way to manage your own root CA.
- tptacek 4y ago

johnklos 4y ago

Side note: the cookies preference pop-up on that site is absolutely evil. Anyone who actually chooses something like that is an asshole. It's funny that someone who writes an article about how crazy of a GUI OpenSSL would have to have would also have a form that someone needs to fill out to opt-out of bullshit tracking. It's almost as if... Never mind. This Carl Tashian person is just shitty.

fein 4y ago
Was this recently disabled? I'm on mobile right now (android) and tried reloading in desktop mode, but to no avail. I never saw this prompt. The way you describe it almost seems like a joke, as in "If GDPR were a GUI".
- johnklos 4y ago
  There's a "chat" floating icon in the lower right corner on the desktop web page, and along with that there's a floating checkmark above that. If you click on the checkmark, you can see the "This site uses cookies", "Continue to site", "Policies | Preferences", "Do not sell my personal information" window.
pmontra 4y ago
The controls in that pop up are definitely worse than the ones in the OpenSSL GUI mockup. The boolean switches suffer from the same problem of many light switches: which is the on position and which is the off one? The radio buttons in the mock up are impossible to mistake. Accept ( ) Do not accept (*) would do.
- deleted 4y ago
  [deleted]

jasonhansel 4y ago

Honestly: this is what I dislike about OpenSSL. There are so many different knobs you can turn that I'm not sure how to use it securely, or whether specific options increase or decrease security. Its documentation seems to assume a lot of background knowledge about cryptography and the technologies involved, making it particularly tricky to get things right or figure out how to perform even simple workflows safely.

forinti 4y ago

Every time I have to use Bouncy Castle, it feels like everything has changed. Crypto is a muddle of protocols, formats, and algorithms.

j1elo 4y ago

What this tells me is that a tool that follows the "huge swiss army knife" style instead of "do just one thing and do it well", ought to have an extra option that provides Profiles for the most common use cases. Otherwise for most non-expert people (but who end up needing to use the tool anyways for whatever reason), who I'd wager is the majority of users, the tool is close to useless due to the sheer amount of knobs. Just provide some profiles, for the love of $DEITY!

vonwoodson 4y ago

I love how simple this is for newcomers. With this tool we can finally get folks managing their own privacy and stop asking poor developers to implement “same defaults”

jeroenhd 4y ago

That's a funny spoof for a GUI. I don't know what design language was used here, but it's pretty outdated by now. Windows (for domain admins) has similar tools to OpenSSL. How do you use that, you may ask? Simple: wizards. There's a wizard to create a CA. There's a wizard to create a CSR. There's a wizard to sign said CSR. There are probably wizards to set up custom wizards. When you turn OpenSSL into a step-by-step process (with the subcommand chosen by the button that spawns the wizard, as well as a separate wizard for the "mini CA") it becomes quite manageable. Just stuff each part into a separate page and filter out any options that might be irrelevant based on earlier choices. You'd end up with a seven to eight step wizard for most operations and I doubt you'd be as confused. OpenSSL is forty tools in one executable.

easrng 4y ago
That's one of the pre-OSX Mac UI styles.

userbinator 4y ago

As someone who doesn't use OpenSSL often enough to remember all the options, this actually looks very useful to have (with the exception of the help and list options). That said, the pixelated tabs and controls combined with an antialiased font look really weird. I suppose it could be called the "fake retro" aesthetic.

makecheck 4y ago

Brings back memories; the Apple Platinum look appeared around the time when 90% of the UI was black-and-white or at least boring so it really seemed to instantly transform the Mac into a professional-looking tool. I can’t wait until they release it (oh wait, they did, decades ago; now we just have — whatever — the Mac is now).

asveikau 4y ago
In hindsight I'm not sure if I prefer Platinum over System 7. They both looked good and evoke nostalgia.

knowaveragejoe 4y ago

All criticism of OpenSSL aside, I would like to see other tools represented in a similar fashion. If nothing else it is more intuitive for me to look at this and understand what is possible than a man page.

neycoda 4y ago

That is awesome. I'm glad I don't have to use it as a GUI and that I can have all those options nicely tucked away until I need to look something up that I haven't memorized from frequent usage yet.

codegangsta 4y ago

This better explains how ruthlessly focused UI design needs to be. User Interface design needs to know the person on the other side, what their motives are and what makes them feel like they have superpowers. OpenSSL is a system. A GUI needs to bridge the gap between the system and the user, and it can’t be done in one implementation, because the types of user is super diverse. Makes the whole act of UI design increasingly challenging and fun all at the same time

paulryanrogers 4y ago
OpenSSL is an expert tool. And one that should probably be three or more specialized tools instead. Then three+ expert UIs built on them. Any simpler UIs should probably just consume a stable API of those more specialized tools/libraries. This is kind of happening with the various forks and alternative tooling taking over. But not soon even IMO. Anyway, a girl can dream.

drawingthesun 4y ago

This got me thinking, is there any program that converts cli tool to gui?!? It would perhaps take a cli program as its input, and outputs a gui version of the input program? I know this is a bad idea! But still, the gui in the article looks kinda cool.

noasaservice 4y ago
To give that idea serious credence would mean being able to parse the inputs and outputs, and make the togglable settings on each. When it's a simple number, that's not hard. When it's a file, it's a lot harder, since there's a lot of non-file files (fifo's, directories, symlinks, hard symlinks, network locations, mountpoints, etc). And don't forget that you can pipe stuff in anything that looks like a file. It sounds simple, but for things like ffmpeg or openssl, the possibilities are just stupid complex.

spaetzleesser 4y ago

Now let’s do a GUI for all git options!

shp0ngle 4y ago

I wish there was one for ffmpeg.... wait maybe there is one? edit: no there isn't

KronisLV 4y ago

I... kind of like it? Not the fact that using such a GUI would be almost impossible, like the humorous example of an "engineer oriented UI" in the Silicon Valley series https://www.reddit.com/r/SiliconValleyHBO/comments/4nvvnl/pied_pipers_easytouse_tools/ https://www.reddit.com/r/SiliconValleyHBO/comments/4nvvnl/pi... which might be confusing for most people. But rather the fact that all of the complexity the software has is laid bare, so that nobody could mistakenly assume that it's just a small utility that does just one thing. But rather, that it's a system with a large surface area and plenty of things that it attempts to do. Somehow the example also has better discoverability of what's available to use, than reading manpages or help documentation ever would. So I guess, why not? Hide 80% of the GUI under context sensitive menus and options and you'll actually have something usable. For an example of a good GUI in this space, see KeyStore Explorer: https://keystore-explorer.org/ https://keystore-explorer.org/ Somehow, if you look at the screenshots, it actually feels more discoverable for the average user than using a CLI tool might be: https://keystore-explorer.org/screenshots.html https://keystore-explorer.org/screenshots.html (especially if you talk about the Java CLI tools in the space) The problems with GUIs are largely the fact that they don't really map nicely to CLI commands and usually cannot be automated themselves - the ideal software would have a GUI that's optionally available, but would offer you the underlying CLI commands when you're about to do something (implying that the UI would be separate from the logic, being optional). The best example that I can think of this is Zenmap, a GUI for nmap: https://nmap.org/zenmap/ https://nmap.org/zenmap/ So in the GUI you might pick: Target: some_ip_address Profile: Intense scan plus UDP (dropdown) And get the following output: nmap -sS -sU -T4 -A -v some_ip_address Whether you execute the command through the UI or add it to some script, that's up to you. Some other software that comes to mind: - Kdenlive: shows you what the encoder command for rendering videos will be - SourceTree (or other Git GUIs): shows you what commands you're attempting to execute - MySQL Workbench/pgAdmin: shows you what SQL will be executed I think that's the perfect approach to having your cake and eating it too.

hardware2win 4y ago

Wow, this is incredibly good way of showing complexity of things Within a few secs i had somewhat not bad awarness of how big this thing can be I would want to see more If x were a gui

jokoon 4y ago

I once tried to encrypt something with pip install cryptography, for personal purposes and to learn. I can't remember that I managed to do it properly, but as I asked on IRC, I was warned that there was a lot of probability of doing it wrong. I guess I will keep trusting 7zip (who had a crypto flaw at some point).