4 ms·
OpenSSL is known to be broken. All this bickering over language misses the real problem. The actual solution is that open source, widely used code is a target
by KingLancelot 4y ago
OpenSSL is known to be broken.
All this bickering over language misses the real problem.
The actual solution is that open source, widely used code is a target for hackers.
By using one library used everywhere for everything, you’re painting a target on your own back.
The real solution is we need the software ecosystem to have more competition and decentralization.
Use alternative crypto libraries.
If you want a drop in replacement, use LibreSSL which was forked and cleaned up by the OpenBSD guys due to HeartBleed.
But the long term solution, is more competition by using smaller, more specialized libraries, or even writing your own.
- nicoburns 4y ago> The actual solution is that open source, widely used code is a target for hackers. The long term solution is likely using languages which are A. Memory safe, and B. make formal verification viable. Being widely used and open source isn't an issue if there are no exploitable bugs in the code.
- KingLancelot 4y agoI see a lot of people pushing memory safe languages, far more people than actually write systems code. What is your primary language?
- pjmlp 4y agoMany of those people have experience writing systems programming code before UNIX and C got widespread outside Bell Labs. Mac OS was originally written in Object Pascal + Assembly, just to cite one example from several.
- KingLancelot 4y ago
- pjmlp 4y ago
- dang 4y agoPlease don't break the site guidelines just because another comment is bad. That only makes things worse. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dang 4y agoWe've banned this account for breaking the site guidelines. Please don't create accounts to do that with. If you've decided you want to use HN as intended, that's fine, but in that case please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and be sure you're sticking to the rules.
- nicoburns 4y agoMy primary language is JavaScript, but I use Rust when I need to write more low-level (or higher performance) code. I certainly haven't been writing kernel code or anything like that, but I think it's fair to say that I practice what I preach when it comes to using memory safe languages.
- hn_acc_2 4y agoThere are a limited number of people willing to spend a limited amount of time fuzzing, reviewing, and scrutinizing crypto libraries. The more libraries exist, the more their efforts are divided, and the total scrutiny each library receives decreases. How would this help the problem?
- klqwr 4y agoI find it quite brave to trust the OpenBSD guys by default. Historically, they have way too many forked huge projects (Apache, gcc, patched clang, ...) to understand them in depth. OpenSMPTD had its fair share of exploits. sudo had its fair share of exploits.