4 ms·

What you consider "insanity" was functional and useful at one point and may still be useful in some projects. I see systems in the wild running DOS (rarer and

What you consider "insanity" was functional and useful at one point and may still be useful in some projects. I see systems in the wild running DOS (rarer and rarer) because there is still functional hardware that does not have modern OS support. The OpenSSL codebase is a legacy codebase, for sure. That said, it's a pretty consistent one (even with all the macros). I don't actively hunt for bugs, but I know the codebase enough that when one or two exploit came out in the past, I knew the relative area where things were impacted. Also, writing one's own memory allocation library isn't that far fetched, especially if you want to encapsulate platform quirks at a specific layer. I don't think it made the transition to Mozilla owned Firefox, but Navigator (the predecessor) had it's own encapsulation of memory management because, in part, all the platforms and architectures it would compile for.

appplication 3y ago
A legitimate question I have, why can’t these legacy machines running DOS just run a legacy version of OpenSSL? I understand there’s probably security concerns etc, but if security is such a big concern why would anyone still be running DOS? And why would anyone on DOS feel entitled to software updates in 2023? I just have a hard time wrapping my head around the need for to provide any consideration for ultra legacy code like this.
- SomeRndName11 3y ago
  Well FreeDOS is not a legacy OS, it is actively maintained one. Besides, DOS is the simplestg hard RTOS, due to being single-task, zero protection, close to the metal system.
  - patmorgan23 3y ago
    So bump a major version and only do security fixes for the old one.
- cesarb 3y ago
  > A legitimate question I have, why can’t these legacy machines running DOS just run a legacy version of OpenSSL? Compatibility. OpenSSL is at its core a networking protocol library, and legacy versions of OpenSSL will not understand the only versions of the protocols accepted by modern systems.
jiggawatts 3y ago
Do watch the BSD team's video presentation, they cover everything you've said. I don't want to re-iterate too much of it, but the gist was: "If Microsoft won't support DOS or Win16, why should the two part-time volunteers support it!?" The OpenSSL team clearly did not have the time or budget to both maintain that many platforms and maintain the security of supported platforms. If "some projects" or "some vendors" want to support esoteric platforms they can fork LibreSSL and add support at their own expense instead of at the expense of the larger community using SSL libraries at-scale on modern platforms for production workloads worth trillions of dollars to the economy. I 100% agree with the BSD team's points and their approach, and whatever contrary argument you make has to also explain away Heartbleed, which was at the time the worst security vulnerability in history. It's like arguing that: "Sure, the Wuhan Lab of Coronaviruses may have had some biosecurity lapses, but just because the world's biggest pandemic originated form there doesn't automatically mean those practices were a problem!" (Or if you disagree with the lab-leak hypothesis, substitute unsanitary animal handling practices at the Wuhan Markets.)

appplication 3y ago

A legitimate question I have, why can’t these legacy machines running DOS just run a legacy version of OpenSSL? I understand there’s probably security concerns etc, but if security is such a big concern why would anyone still be running DOS? And why would anyone on DOS feel entitled to software updates in 2023? I just have a hard time wrapping my head around the need for to provide any consideration for ultra legacy code like this.

SomeRndName11 3y ago
Well FreeDOS is not a legacy OS, it is actively maintained one. Besides, DOS is the simplestg hard RTOS, due to being single-task, zero protection, close to the metal system.
- patmorgan23 3y ago
  So bump a major version and only do security fixes for the old one.
cesarb 3y ago
> A legitimate question I have, why can’t these legacy machines running DOS just run a legacy version of OpenSSL? Compatibility. OpenSSL is at its core a networking protocol library, and legacy versions of OpenSSL will not understand the only versions of the protocols accepted by modern systems.

jiggawatts 3y ago

Do watch the BSD team's video presentation, they cover everything you've said. I don't want to re-iterate too much of it, but the gist was: "If Microsoft won't support DOS or Win16, why should the two part-time volunteers support it!?" The OpenSSL team clearly did not have the time or budget to both maintain that many platforms and maintain the security of supported platforms. If "some projects" or "some vendors" want to support esoteric platforms they can fork LibreSSL and add support at their own expense instead of at the expense of the larger community using SSL libraries at-scale on modern platforms for production workloads worth trillions of dollars to the economy. I 100% agree with the BSD team's points and their approach, and whatever contrary argument you make has to also explain away Heartbleed, which was at the time the worst security vulnerability in history. It's like arguing that: "Sure, the Wuhan Lab of Coronaviruses may have had some biosecurity lapses, but just because the world's biggest pandemic originated form there doesn't automatically mean those practices were a problem!" (Or if you disagree with the lab-leak hypothesis, substitute unsanitary animal handling practices at the Wuhan Markets.)