14 ms·
I cannot speak for the people who made this decision. But if you look at the code, you might come to the conclusion that the upstream is not so focused code qu
by clarry 13y ago
I cannot speak for the people who made this decision.
But if you look at the code, you might come to the conclusion that the upstream is not so focused code quality (security!) as one might hope. There is such a jungle of code that can only be justified by the desire for more features, more portability (to crazy ancient platforms too), more speed, more flexibility... it's all more knobs and code where real security bugs can lurk. And code paths that do not get tested properly. You can also find many outright dangerous idioms used throughout. Does that mean the upstream is ignorant, or that they do not care, or that they do not have the man power to fix their aging code? Either way, it's bad.
The OpenBSD developers have different priorities, and they believe they can do better. As such, not being able to blindly pull changes and updates from the upstream developers they do not trust does not look like a significant loss. If new features are to be merged in, it has to be properly reviewed and adapted. Yes, it's more work that way. But the end result is likely better code.
- riffraff 13y agothe talk about portability to crazy ancient platforms is weird. Didn't openbsd ask for 20K$ to keep up a build farm of ancient platforms?
- dobbsbob 13y agohttp://marc.info/?l=openbsd-tech&m=138973312304511&w=2 http://marc.info/?l=openbsd-tech&m=138973312304511&w=2 They use that old equip to find bugs
- calpaterson 13y agoI think they asked for $20k for old hardware (like vax), not old platforms (like VMS).
- clarry 13y agoIt is one thing to make an OS support the hardware and run on a "weird" piece of hardware. But the removed code in OpenSSL is about making it compile and run on systems on which the standard (defacto or specified) APIs do not exist or do not behave like they should, and which have broken compilers that need workarounds. All of these add conditional code paths that won't get the amount of testing they need, and which will only hinder developers when they try to understand and improve the surrounding code. Also, the $20k was for the power bill. Yes, there are some older systems among the powered ones. But there's more, there's really a rack full of hardware running the infrastructure that makes OpenBSD available to us. There's networking gear, there's AC... Dobbsbob makes a good point too. The weird hardware OpenBSD runs on helps find bugs; the untested code paths in OpenSSL add bugs.
- feld 13y agoThose ancient platforms/architectures run OpenBSD, though, not the original OS. Nobody in their right mind should run those dead OSes on the public internet; why bother supporting them in the latest OpenSSL release?