4 ms·
Someone has to pay for something to be what he says. Maybe the almighty Google or Facebook or Apple someone should fork over some bucks to support a correctly c
by coldcode 13y ago
Someone has to pay for something to be what he says. Maybe the almighty Google or Facebook or Apple someone should fork over some bucks to support a correctly constructed alternative. Open source may be "free" but building something complex and correct is not free to build. Given that openssl had about 2K donated per year it's really a hobby project. It's not like Linus works on Linux while flipping hamburgers for a living.
- aroch 13y agoApple has SecureTransport[1] and it is open source[2], it had the goto fail bug from earlier this year. Shoving money at the problem isn't necessarily the answer. The problem is the TLS spec is a confusing, arcane spec riddled with tons of gratuitous addons and extensions. Implementing all or even most of it without error/bus is simply a very hard problem [1]: https://developer.apple.com/library/mac/documentation/security/Reference/secureTransportRef/Reference/reference.html https://developer.apple.com/library/mac/documentation/securi... [2]: http://opensource.apple.com/source/libsecurity_ssl/libsecurity_ssl-55003/lib/SecureTransport.h http://opensource.apple.com/source/libsecurity_ssl/libsecuri...
- phkamp 13y agoIt's absolutely true, good programming costs money and somebody has to pay[1], but given the amount of money floating through TLS protected connections, that should be a solveable problem, once people realize it is there. But I think the major problem with OpenSSL is that it never had anything resembling architectural leadership: Things just got bolted on to the side and hung from any convenient nail people could find. PS: Yes, I wrote that piece. [1] https://www.varnish-cache.org/docs/trunk/phk/dough.html https://www.varnish-cache.org/docs/trunk/phk/dough.html