4 ms·
If OpenSSL were a GUI (2022)
- adamsvystun 2y agothe only thing this proves is that you can make any tool’s UX look terrible by putting all settings as one big blob.
- wodenokoto 2y agoOne big blob? There are over 40 tabs.
- tptacek 2y agoThe OpenSSL command line is more or less a test driver / reference for the library. It's a little weird to criticize its UX. Also: it's pretty easy to make something look bananas if you surface every obscure option in its main screen!
- teruakohatu 2y ago> The OpenSSL command line is more or less a test driver / reference for the library hmmm, not sure about that. Its the main (only?) interface if an individual wants to mess with certificates or generate them. It is often reported ACME/LE took off because it is easier to configure an ACME client than the annual wrestling with openssl. But if openssl had been easy for common user tasks maybe LE would have taken longer to be adopted. ffmpeg also has a notoriously difficult CLI interface. Today you can just ask a LLM to generate you a command, the consequences are low if it gets it slightly wrong. The consequences of getting openssl wrong could not be obvious immediately and result in a lot of debugging down the line.
- throwup238 2y agoLE took off because everyone was charging ridiculous amounts for certificates and few people needed the verification that comes with that. ISRG created ACME for LE.
- tpmoney 2y agoOne of my personal frustrations with SSL as implemented in most systems is the conflation between encrypted communication and verified communication. SSH sort of got this right with ToFU as a default behavior but I think a lot of the resistance and difficulty in adopting SSL for encrypted intranet communication comes from the need to do the CA and cert signing song and dance. If you could turn on encryption without needing to do ID validation by default it would make things easier for people I know that encrypted communication without knowing that your talking to the right person is somewhat useless, but it works for SSH most of the time, there’s no reason it couldn’t work well for https and encrypted db connections etc.
- wolf550e 2y agoI recommend https://cryptography.io/en/latest/ https://cryptography.io/en/latest/ as a way to use openssl library instead of the command line.
- teruakohatu 2y agoThat actually looks very useful. Thanks.
- larusso 2y agoI think you are right. On the other hand it’s the fact that a lot of tutorials / getting started guides etc include some ssl invocations to execute a specific command for key/cert creation. And a user wishing to adjust and maybe understand things gets thrown at a man page that is so overloaded. Similar to git. But git’s cli at least has a clear setup with optional vs mandatory values. I always disliked commandline interfaces with mandatory option fields.
- tuwtuwtuwtuw 2y agoWhere do I find the UI for it then?
- epistasis 2y agoI don't think it's a critique of the library; calling the x509 specification complex enough to be magic seems accurate. Honestly I love the UI presented: concise, shows all the options, a fantastic summary of the CLI without having to scroll a massive man page or website. I'd love this for all the super complex CLI tools I need to use, as a visual cheatsheet on where to search in the man page.
- behringer 2y agoI'd love this for all the cli tools. Instead we'll get more boot managers and desktop managers.
- bckr 2y agoConsider helping make such a thing!
- AlotOfReading 2y agoI wrote a personal tool to do this automatically by parsing '--help' after I couldn't remember the tar options for the millionth time. Turns out the programs that have complicated, undiscoverable interfaces also tend to omit useful options from automatically discoverable documentation, so it wasn't especially reliable.
- BoingBoomTschak 2y agoReminds me of a similar wish for argv introspection I had at some point (e.g. https://github.com/ImageMagick/ImageMagick/issues/7688 https://github.com/ImageMagick/ImageMagick/issues/7688) that went nowhere. I hardcoded curl this way.
- gyomu 2y agoI’ve always found it a shame that the UNIX philosophy seemed to stop at system/command line tools and no one ever took the further step to apply it to user interfaces. UIs generated in systematic, composable ways emerging naturally from all the plumbing (pipes, option flags, etc) we already have in place.
- theandrewbailey 2y ago(2022) ... But I doubt OpenSSL has changed enough to make this out-of-date.
- tivert 2y agoI'm looking forward to "If Python Were a GUI."
- LeoPanthera 2y agoWell... https://docs.python.org/3/library/idle.html https://docs.python.org/3/library/idle.html
- blooalien 2y agoAlso, Jupyter(Lab,Notebook,QtConsole,etc), Marimo, Spyder, and a bunch of other good GUI-like options. :)
- cyberax 2y agoI don't know why, but three systems make me google the correct command line options every time I need to use them: 1. OpenSSL 2. Systemd 3. PGP I have no idea why, but their command line interface is just somehow confusing.
- bruckie 2y agoAnd FFmpeg. :)
- sumanthvepa 2y agoHuh. That's exactly my experience. I suspect that its a combination of three things: first, they are not frequently used, second, their CLI is very complex, third, their design violates normal CLI conventions in weird ways. I don't have the same problem with things like docker or git, which are arguably more complex.
- barrettondricka 2y agoPro (Newbie) tip: use a GUI for git (like lazygit or VS Code Source Control). Git is one of the few complicated CLI tools that actually works well as a GUI, so take full advantage of it.
- sumanthvepa 2y agoVery interesting! I was on another thread where the user stated that they preferred the git CLI to using a git GUI, because the GUI imposed another layer of conceptual complexity on top of an already complex tool. May I ask what git GUI you use? lazygit?
- brabel 2y agoI used IntelliJ and emacs' magit. I don't know what "extra layer of conceptual complexity" they're talking about, it's very straightfoward to me (admitedly, I knew the CLI well enough before I started using GUIs so maybe I had already internalized whatever concepts they're think about).
- Helmut10001 2y agoThese were the only commands I ever needed and I found them pretty straight forward. With LLMs today at your hand, command line is the king, ux was yesterday. Check expiration of web address manually: openssl s_client \ -servername service.local.mytld.com \ -connect service.local.mytld.com:443 | openssl x509 -noout -dates Check SSL cert: openssl s_client \ -showcerts -connect service.local.mytld.com:443 </dev/null Check local SSL cert from disk: openssl x509 -noout -text -in wildcard.local.mytld.com.fullchain
- kopirgan 2y agoNow let's do ls
- Joel_Mckay 2y ago"GUI make simple things easy, and difficult things impossible" Sooner or later everyone must go CLI =3
- kopirgan 2y agoYeah it is kind of silly to believe check boxes, radio buttons and drop downs somehow make things easier. They don't especially when the options are anyway complex, mutual incompatible or even dangerous if clicked random! I can't fly the Boeing 747 with digital controls anymore than I could a WW2 era hydraulic one. Added later: I should have said 787 - the 747 is almost WW2 era itself!
- slt2021 2y agonow we need similar GUI, just for ffmpeg
- mtillman 2y agoMy favorite part is the punchline: “This is incomplete. It covers about 80% of one corner of OpenSSL's functionality. The certificate policy options have a lot more knobs that I didn't include.”
- mrtksn 2y agoIs this fair though? Most common tasks have tutorials all over the net, so creating a GUI should consider these use cases instead of piling every option on the main UI. Many of these things are also just options that are right for one system and the user will use always the same parameters, therefore you should be able to hide this in the settings instead of showing everything at the same time all the time.
- dang 2y agoRelated: If OpenSSL were a GUI - https://news.ycombinator.com/item?id=31697636 https://news.ycombinator.com/item?id=31697636 - June 2022 (234 comments)
- fzeindl 2y agoAt every enterprise job I have been in, there was always a quagmire around renewing or exchanging certificates. The corresponding tasks always required disproportionately many high-level meetings and discussions for their actual simplicity. I always attributed this directly to the complexity of the OpenSSL command and the fact that these tasks include hard deadlines because of certificate runtime. The complex discussions which ultimately result in some simple commands mirror the OpenSSL CLI: you have to understand and articulate precisely what you need. That being said I wonder some of the options (like "this file is a CER", PEM vs DER private key, etc.) couldn't be replaced by auto detection.
- userbinator 2y agoX.509 certificates are not simple, the majority of the complexity being in the extensions, and OpenSSL's x509 command can be used for many different purposes. I am reminded of an old saying in the GUI vs CLI war: "what you see is all you get", and in this case, you get a lot.
- sussmannbaka 2y agoI sort of don’t hate this! Push these around a bit and that looks pretty usable to me.
- nejsjsjsbsb 2y agoIs there a command line to UI converter? That feeds off CLI autocomplete? Would be awesome for discovery.
- GoblinSlayer 2y agoIt's not really hypothetical, putty settings dialog has similar complexity, but is implemented as a settings tree and designed to fit ergonomically on 640*480 screen.
- KronisLV 2y agoActually, the example has way better discoverability than most CLI software, especially if every option had tooltips illustrating what it's for in more detail. For an actually good example of adjacent software, have a look at Keystore Explorer: https://keystore-explorer.org/ https://keystore-explorer.org/ I do manage my own CA for some development servers with it, way less of a headache than trying to remember a bunch of arbitrary commands (though obviously not well suited for any sort of automation, which I don't need in that specific use case). For an example of a pleasant CLI with some good discoverability, I've always liked Docker's approach, where the commands are organized in a tree and entering a command without any arguments will print its usage in a useful format: https://docs.docker.com/reference/cli/docker/ https://docs.docker.com/reference/cli/docker/ $>docker Usage: docker [OPTIONS] COMMAND A self-sufficient runtime for containers Common Commands: run Create and run a new container from an image exec Execute a command in a running container ps List containers build Build an image from a Dockerfile pull Download an image from a registry push Upload an image to a registry images List images login Log in to a registry logout Log out from a registry search Search Docker Hub for images version Show the Docker version information info Display system-wide information ...
- aargh_aargh 2y agoI've found this tool handy for faster-than-man explanations of various CLI invocations: https://explainshell.com/ https://explainshell.com/ Sadly, it hasn't been updated in years.
- bardsore 2y agoSomething about the cookie banner on this site hijacks my history so I can't go backwards.
- alyandon 2y agoTangentially related, if you generate certificates infrequently enough that you always have to look up openssl command line options check out https://github.com/chris2511/xca/ https://github.com/chris2511/xca/. It's basically keepass but for certs instead of passwords.
- nyreed 2y agoThis may be a nice example of the benefits and drawbacks of GUI vs CLI software. Sure OpenSSL has myriad inscrutable options, but the majority of these probably aren't going to be used by 90% of people. Yet including them in a CLI gives less clutter/overhead versus what they would in a GUI. They can just stay out of the way for the people who need them. I guess the same could be said of an "Advanced Features" second page of a GUI though.
- pl4nty 2y agoI host a usable web app for this idea, including a full CLI via WebAssembly to illustrate the trade-offs https://openssl.tplant.com.au/ https://openssl.tplant.com.au/
- pl4nty 2y agoI host a usable web app like this, including a complete CLI via WebAssembly. it's surprisingly useful for teaching, kind of like CyberChef https://openssl.tplant.com.au/ https://openssl.tplant.com.au/