3 ms·
I was surprised it is still in such bad state even after "rewrite" for 3.0.
by PunchyHamster 10mo ago
I was surprised it is still in such bad state even after "rewrite" for 3.0.
- timschmidt 10mo agoI am not surprised at all, because instead of throwing their support behind the LibreSSL folks who audited the OpenSSL codebase after Heartbleed and found deep design and implementation issues, Linux Foundation and member orgs including most of Silicon Valley decided that OpenSSL just needed more funding. Felt like good money after bad on day 1.
- tptacek 10mo agoThe problem with the OpenSSL 3 codebase isn't security; many organizations, including the OpenSSL team itself, have been responsible for pulling out of the security rut OpenSSL was in when Heartbleed happened. The OpenSSL 3 problem is something else.
- timschmidt 10mo ago[flagged]
- zxcvasd 10mo ago[dead]
- PunchyHamster 10mo agoso, incompetence of people writing it
- tptacek 10mo agoIf you don't have anything meaningful to say, you can just not comment.
- groby_b 10mo agoAnd once you realize that Management + Finance + Marketing outnumber engineering at OpenSSL [1], you know the money is put to good use, too. [1]: https://openssl-corporation.org/about/leadership/ https://openssl-corporation.org/about/leadership/
- timschmidt 10mo agoIf I were cynical, I'd think that the inscrutable code and resultant security issues were a feature desired by those management and finance types, not a bug. The purpose of a system being what it does, and all.
- whizzter 10mo agoSeems plenty of the people occur multiple times, so there's more engineers... if only barely :|
- groby_b 10mo agoIf you value somebody so much you show them multiple times, I'm going to assume they're outsized weight in terms of influence and cost, too.