4 ms·

I think people are wildly missing the point here. This GUI mock-up is not about improving usability, it's a comment on the hideous complexity of OpenSSL. The vi

I think people are wildly missing the point here. This GUI mock-up is not about improving usability, it's a comment on the hideous complexity of OpenSSL. The visible tab's options represent, in the words of the author, "80% of one corner of OpenSSL’s functionality". There are 45 tabs shown. On my monitor, this one tab is over two pages long. If the other tabs average out to a similar length, there would be around 100 pages of options available. That is too much complexity for a single security-critical program.

ajsnigrutin 4y ago
OpenSSL is a "swiss army knife" for all things security... making a bad (mock) gui makes it look a lot more terrible than it really is. Imagine the same gui for bash settings, ffmpeg or even just a browser (just look at the size of about:config!) Most people do just one of a few operations, where they copy-paste the commands found online, as they do with windows registry, firefox about:config or ffmpeg, so it's no different than that.
- jyrkesh 4y ago
  > ffmpeg You mean like this? https://iangetz.com/projects/ffmpeg-builder/ https://iangetz.com/projects/ffmpeg-builder/ I'm a CLI guy, but `openssl` is insanely complex and I think it would benefit the ecosystem immensely if someone built a wrapper CLI that made it easier to complete the small handful of popular use cases that 90% of us have to go to Google to remember.
  - fugalfervor 4y ago
    I have seen many tutorials using CloudFlare's `cfssl` as an alternative.
  - ajsnigrutin 4y ago
    That is just a small subset of ffmpeg commands, here's the full list: https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a3a50 https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a... If you make a GUI out of this, it will be a pain in the ass... and ugly! Luckily, there are many ffmpeg frontends, that select just a tiny subset of commands that are most often needed (like yours and many others), and the same things exist for openssl, eg: https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/
    - alexb_ 4y ago
      >if you make a GUI out of this, it will be a pain in the ass I guarantee you, 10000%, that it will still be more usable than CLI is without having to google everything. FFMPEG is so complex that doing anything with it feels like talking in some ancient archaic code known only to the video tech wizards, and a GUI would absolutely make that better.
  - qubidt 4y ago
    That covers a tiny fraction of ffmpeg's actual interface
- ikiris 4y ago
  > imagine the same gui for ffmpeg... I think they call that VLC
  - efreak 4y ago
    VLC doesn't use ffmpeg, it uses libavcodec.
    - ikiris 4y ago
      Do me a favor and tell me what the path is on their github registry, and be less ridiculously pedantic.
      - imtringued 4y ago
        The entire point is that libavcodec exposes a different interface. You wouldn't build a GUI for ffmpeg, you'd build one for libavcodec unless your actual goal is generating ffmpeg commands.
- AdamH12113 4y ago
  I don't think a Swiss army knife approach is a good idea for security software to begin with. It's a good way to generate cruft and lock yourself into questionable design decisions due to Hyrum's Law. It's not great for auditability, either. FFmpeg is a practically an entire non-linear video editor in a CLI tool. That is indeed a lot of complexity, but the stakes are low -- if you screw up an FFmpeg command, you've lost some encoding time, not your entire password database. (I get the impression a lot of FFmpeg's functionality wouldn't serialize well, either, but I'm far from an expert on that.) Nobody on Earth ever has or ever will like the Windows registry. No comment on Firefox.
qwertox 4y ago
I was hoping that it was interactive, showing all tabs and all options. But I like what I'm seeing there.
deleted 4y ago
[deleted]
Beltalowda 4y ago
> That is too much complexity for a single security-critical program. Looking at this x509 page, a lot of these options kind of seem like "required complexity" to me. There's a few things that aren't really needed (like the string conversion stuff) and a few things that could be condensed in one option (the "Print [..]" options can be one "print [list-of-fields]"), but those are relatively minor things. The thing is, SSL/TLS is kinda complicated, but that's not really OpenSSL's fault.
- AdamH12113 4y ago
  Sure, I'm willing to accept that the X.509 is inherently complicated and there's not much OpenSSL could do to simplify it. But that seems like a good reason not to add support for 44 other major operations to the software...
  - Beltalowda 4y ago
    TLS is more than just x509. If you want a tool that "just generates certificates" then it's easy, but if you want an advanced management tool that can do all sorts of things then you will end up with something complex because TLS is complex with a lot of different parts. And yeah, the openssl tool could be designed a lot better, but much of this is a matter of UX and managing complexity, not so much reducing it.
  - a2800276 4y ago
    Why not? It's a collection of 44 tooks each doing one thing well :)
- Ekaros 4y ago
  Also fun thing is that openssl doesn't even properly handle all of the cases and complexities of x509. Like subject altnames and what can be included in there by certain specifications and standards.
tptacek 4y ago
It is. You're not meant to be using it directly. Some of what's in OpenSSL is just glorified test drivers. OpenSSL is complicated in large part because it is the de facto reference implementation for a lot of cryptography.

ajsnigrutin 4y ago

OpenSSL is a "swiss army knife" for all things security... making a bad (mock) gui makes it look a lot more terrible than it really is. Imagine the same gui for bash settings, ffmpeg or even just a browser (just look at the size of about:config!) Most people do just one of a few operations, where they copy-paste the commands found online, as they do with windows registry, firefox about:config or ffmpeg, so it's no different than that.

jyrkesh 4y ago
> ffmpeg You mean like this? https://iangetz.com/projects/ffmpeg-builder/ https://iangetz.com/projects/ffmpeg-builder/ I'm a CLI guy, but `openssl` is insanely complex and I think it would benefit the ecosystem immensely if someone built a wrapper CLI that made it easier to complete the small handful of popular use cases that 90% of us have to go to Google to remember.
- fugalfervor 4y ago
  I have seen many tutorials using CloudFlare's `cfssl` as an alternative.
- ajsnigrutin 4y ago
  That is just a small subset of ffmpeg commands, here's the full list: https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a3a50 https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a... If you make a GUI out of this, it will be a pain in the ass... and ugly! Luckily, there are many ffmpeg frontends, that select just a tiny subset of commands that are most often needed (like yours and many others), and the same things exist for openssl, eg: https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/
  - alexb_ 4y ago
    >if you make a GUI out of this, it will be a pain in the ass I guarantee you, 10000%, that it will still be more usable than CLI is without having to google everything. FFMPEG is so complex that doing anything with it feels like talking in some ancient archaic code known only to the video tech wizards, and a GUI would absolutely make that better.
- qubidt 4y ago
  That covers a tiny fraction of ffmpeg's actual interface
ikiris 4y ago
> imagine the same gui for ffmpeg... I think they call that VLC
- efreak 4y ago
  VLC doesn't use ffmpeg, it uses libavcodec.
  - ikiris 4y ago
    Do me a favor and tell me what the path is on their github registry, and be less ridiculously pedantic.
    - imtringued 4y ago
      The entire point is that libavcodec exposes a different interface. You wouldn't build a GUI for ffmpeg, you'd build one for libavcodec unless your actual goal is generating ffmpeg commands.
AdamH12113 4y ago
I don't think a Swiss army knife approach is a good idea for security software to begin with. It's a good way to generate cruft and lock yourself into questionable design decisions due to Hyrum's Law. It's not great for auditability, either. FFmpeg is a practically an entire non-linear video editor in a CLI tool. That is indeed a lot of complexity, but the stakes are low -- if you screw up an FFmpeg command, you've lost some encoding time, not your entire password database. (I get the impression a lot of FFmpeg's functionality wouldn't serialize well, either, but I'm far from an expert on that.) Nobody on Earth ever has or ever will like the Windows registry. No comment on Firefox.

qwertox 4y ago

I was hoping that it was interactive, showing all tabs and all options. But I like what I'm seeing there.

deleted 4y ago

[deleted]

Beltalowda 4y ago

> That is too much complexity for a single security-critical program. Looking at this x509 page, a lot of these options kind of seem like "required complexity" to me. There's a few things that aren't really needed (like the string conversion stuff) and a few things that could be condensed in one option (the "Print [..]" options can be one "print [list-of-fields]"), but those are relatively minor things. The thing is, SSL/TLS is kinda complicated, but that's not really OpenSSL's fault.

AdamH12113 4y ago
Sure, I'm willing to accept that the X.509 is inherently complicated and there's not much OpenSSL could do to simplify it. But that seems like a good reason not to add support for 44 other major operations to the software...
- Beltalowda 4y ago
  TLS is more than just x509. If you want a tool that "just generates certificates" then it's easy, but if you want an advanced management tool that can do all sorts of things then you will end up with something complex because TLS is complex with a lot of different parts. And yeah, the openssl tool could be designed a lot better, but much of this is a matter of UX and managing complexity, not so much reducing it.
- a2800276 4y ago
  Why not? It's a collection of 44 tooks each doing one thing well :)
Ekaros 4y ago
Also fun thing is that openssl doesn't even properly handle all of the cases and complexities of x509. Like subject altnames and what can be included in there by certain specifications and standards.

tptacek 4y ago

It is. You're not meant to be using it directly. Some of what's in OpenSSL is just glorified test drivers. OpenSSL is complicated in large part because it is the de facto reference implementation for a lot of cryptography.