3 ms·
I don't think the changes they are doing at the moment have much security value. They aren't working on fixing OpenSSL security flaws. They are obliterating all
by Wilya 12y ago
I don't think the changes they are doing at the moment have much security value. They aren't working on fixing OpenSSL security flaws. They are obliterating all the layers of cross-platform compatibility that make the code more complex, and removing everything OpenBSD isn't likely to use.
They are transforming a local copy of openssl that tracks upstream changes to their own fork, that probably won't reunite with the upstream version anytime soon.
In the process, they are obviously likely to find some bugs (and they already have fixed one or two harmless ones), but I think they are more interested in building a clean fork for themselves than in fixing the upstream openssl.
- jgrahamc 12y agoBut they are doing stuff like this: 1. Let's remove OPENSSL_cleanse: http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib/libssl?id=6fec7be36425adfd2b48f3695d24a03f6287d4fe http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib... 2. Crap. Let's put it back again: http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib/libssl?id=e51513a6c7d3dd499dd4a8a5767951ccfadab599 http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib... That plus the 'tone' of the commits makes me wary of these changes.
- clarry 12y agoDid you actually read the second diff you linked? They did not put anything back again. They removed even more junk. It is all deletions. I'm getting tired of all the people who complain about the humour, tone or style in the commit messages. If you have serious concerns, why not read the diffs and comment on the actual changes? This is how real problems get noticed and corrected. But some things were in fact removed and put back again, because it turns out some ports depended on it. Sometimes you just don't notice what a few thousand other applications depend on before you remove some code.
- jgrahamc 12y agoYou're right. I'm wrong about number 2. Mea culpa.
- edwintorok 12y agoAlso look at the manpage for explicit_bzero: http://www.openbsd.org/cgi-bin/man.cgi?query=bzero&sektion=3 http://www.openbsd.org/cgi-bin/man.cgi?query=bzero&sektion=3 It already does what OpenSSL_cleanse is meant to do, so using it makes sense.
- danielweber 12y agoYou are seeing this because they are working in public. Any of us would look like fools if you saw our intermediate work product.
- dobbsbob 12y agoOpenSMTPD, OpenNTPD and OpenSSH are avail for other platforms. They will strip OpenSSL down to essentials, spend months auditing what's left then when satisfied it is reliable software porting to other platforms can begin. It's only been a week