4 ms·

Somehow, I don't see removing FIPS or Windows support being in the best interest of the community as a whole. For startups wanting to have a product that requi

Somehow, I don't see removing FIPS or Windows support being in the best interest of the community as a whole. For startups wanting to have a product that requires some level of FIPS support, starting with a decent base makes things easier. Windows support? There are more than a couple of applications out there running on Windows that make use of OpenSSL. Theo's quote -- "99.99% of the community does not care for VMS support, and 98% do not care for Windows support." -- is, at least to me, narrow minded in the scope of what he defines as "community" -- unless he specifically means the OpenBSD community.

ahknight 13y ago
He does.
- jmspring 13y ago
  It would have been helpful if the article called this out. It could probably be implied, but forking/correcting/renaming left it a tad ambiguous.
maaku 13y ago
Except, for example, FIPS support mandates availability of operating modes which are broken by design.
- jmspring 13y ago
  There are ways of crafting the software that could make sure the broken operating modes aren't necessarily part of the FIPS build profile. More than one company I have worked at built on top of OpenSSL and went for FIPS compliance. Sometimes, if you want to be able to qualify for contracts that require things like FIPS, building off a base is better than starting from complete scratch.
xarball 13y ago
I'm sure they have all the best intentions for sharing the wisdom they learn here. But right now OpenSSL is a VERY VERY messy and dangerous library. The OpenBSD devs need to get a working implementation, that catches up on 15 years of refactoring and clarity in (optimistically) 2 months -- or risk the bulk of the world's sensitive information leaking yet again (perhaps even sooner, depending on what is discovered!) It seems that with the kind of things they're finding, there are a lot lesser understood vulnerabilities in the code. With the kind of standardization they're working on, a Windows port will be a LOT easier and a LOT simpler after they're finished. Best let them make haste, tear out everything that's leaky, unclear, or dangerous -- and with that will come a lot of simplification and fixes for the entire implementation. Once it's clean, focus on a Ports. The code is too bloated to even consider ports right now. Quite frankly you might even be safer using Microsoft's SSL/TLS and other crypto implementation for the time being... (Only time will tell!)

ahknight 13y ago

He does.

jmspring 13y ago
It would have been helpful if the article called this out. It could probably be implied, but forking/correcting/renaming left it a tad ambiguous.

maaku 13y ago

Except, for example, FIPS support mandates availability of operating modes which are broken by design.

jmspring 13y ago
There are ways of crafting the software that could make sure the broken operating modes aren't necessarily part of the FIPS build profile. More than one company I have worked at built on top of OpenSSL and went for FIPS compliance. Sometimes, if you want to be able to qualify for contracts that require things like FIPS, building off a base is better than starting from complete scratch.

xarball 13y ago

I'm sure they have all the best intentions for sharing the wisdom they learn here. But right now OpenSSL is a VERY VERY messy and dangerous library. The OpenBSD devs need to get a working implementation, that catches up on 15 years of refactoring and clarity in (optimistically) 2 months -- or risk the bulk of the world's sensitive information leaking yet again (perhaps even sooner, depending on what is discovered!) It seems that with the kind of things they're finding, there are a lot lesser understood vulnerabilities in the code. With the kind of standardization they're working on, a Windows port will be a LOT easier and a LOT simpler after they're finished. Best let them make haste, tear out everything that's leaky, unclear, or dangerous -- and with that will come a lot of simplification and fixes for the entire implementation. Once it's clean, focus on a Ports. The code is too bloated to even consider ports right now. Quite frankly you might even be safer using Microsoft's SSL/TLS and other crypto implementation for the time being... (Only time will tell!)