16 ms·

LibreSSL

254 points by janvdberg 13y ago

MonsieurHoho 13y ago
I don't get the point of this fork. Usually when a project is forked, it means that people want to keep the code base but disagree with the way the project is managed. After heartbleed everybody blamed OpenSSL's bloated code base and it became apparent that many contributions came from volunteers with very few financing. By forking the project, LibreSSL will keep the problematic code legacy and split the community. Maybe I am missing something, but it looks like opportunism here...
- AlexMeesters 13y ago
  > After heartbleed everybody blamed OpenSSL's bloated code base < And this is exactly what they are fixing. OpenSSL's response was to fix heartbleed and move on, not fixing the more broad problem of to much code cruft that led to the bug. IMHO they are right to fork it, OpenSSL's lack of reaction to this is a raise for concern. I am sure Theo( de Raadt) and its team can tackle this, making the code base much much leaner, reducing the risks of bugs similar to heartbleed. And there is really no excuse for OpenSSL to deny that. Also i think OpenSSL has to much technical debt to be efficient in tackling a cleanup like this.
EGKW 13y ago
What's with the link to YouTube under "OpenSSL"? Supposed to be a joke? Or just a hair in the link soup?
- tete 13y ago
  The OpenBSD folks love all kinds of music: http://openbsd.com/lyrics.html http://openbsd.com/lyrics.html
tete 13y ago
Everyone clicked on OpenSSL yet? ;)
DiabloD3 13y ago
Comic Sans? Really? Edit: To those downvoting, yes, I saw the footer. This doesn't excuse their childish behavior. I will not be donating to this project if this is the level of seriousness they have for it.
- anaphor 13y ago
  Maybe you should consider donating
  - stephen_g 13y ago
    To me it comes off as pretty childish - turned me off donating really...
    - Crito 13y ago
      Why would you consciously permit yourself to be biased by the appearance of their webpage in such a way?
- rurounijones 13y ago
  Blatantly done on purpose to: A) In the smallprint: "This page scientifically designed to annoy web hipsters." (Mission accomplished) B) Make it obvious that this is a temporary site (In case the disclaimer wasn't enough) And if you really want to see the lengths they went to to annoy web people, look at the source
- adamnemecek 13y ago
  Read the fine print > This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags
- keyle 13y ago
  I was about to post the exact same question. And if that's supposed to promote donations... (?!) Ask yourself if a founder dresses as a clown to get funding.
claudius 13y ago
It seems that is is indeed the official site (as linked-to on http://www.openbsdfoundation.org/ http://www.openbsdfoundation.org/), just in case there are any doubts…for no reason whatsoever.
rurounijones 13y ago
Since this is related. I have a question: How can they know that they have not broken something in their flensing without any automated testing since no tests is one of the big problems with OpenSSL?
- mrmincent 13y ago
  I believe they are compiling the openbsd packages with it, so I guess it is a decent set to test against.
  - rurounijones 13y ago
    Ah, so compile openbsd packages against it then run the tests for those packages. Sort-of-integration testing. Gotchya
- clarry 13y ago
  Believe it or not, there are other ways to spot problems besides automated testing, which wouldn't catch every problem anyway (that's why we need human audits like the one OpenBSD is doing). Yes, software existed before TDD and ADHD. That's not to say tests don't help. If you are interested, why don't you contribute?
edent 13y ago
Somewhat ironic that https://www.libressl.org/ https://www.libressl.org/ doesn't work, no?
- anaphor 13y ago
  Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.
  - phlo 13y ago
    StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used to reveal data from other, encrypted streams. As for the second: if only sensitive data is encrypted, all encrypted streams automatically become "interesting" to a potential eavesdropper. If, however, everything is encrypted, all streams become equal again. The cost of storing all communications becomes much higher, and the ratio of cost and reward of decrypting a single captured stream worsens (as you may either reveal sensitive or non-sensitive data). [1] https://www.startssl.com/ https://www.startssl.com/ [2] http://www.instantssl.com/ssl-certificate-products/free-ssl-certificate.html http://www.instantssl.com/ssl-certificate-products/free-ssl-...
    - watwut 13y ago
      If you have to pay for revocation, then it is not free certificate. It is just certificate with fees postponed. It is not the same thing. Not sure how you, but when I buy things I do not consider only initial price, but also additional fees. If we want SSL used everywhere, browsers need accept self signed certificates in less obtuse way or there need to be other way to get really free ones.
      - 13y ago
chuckreynolds 13y ago
comic sans? really?
- Dosenpfand 13y ago
  >This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags
deleted 13y ago
[deleted]
lifthrasiir 13y ago
It should rename to LibibreSSL instead, so that one can link the library with `-libressl`. Other than that, I appreciate this effort (no pun intended).
- SwellJoe 13y ago
  Why wouldn't they just make it available for linking as "ibressl" rather than naming the project that? LibibreSSL is unwieldy to put it mildly, and meaningless without the context of the original name.
  - deleted 13y ago
    [deleted]
sarahj 13y ago
I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing and documentation) not silly music video jabs.
- deleted 13y ago
  [deleted]
- nailer 13y ago
  They've already done massive amounts of work already - adding missing checks, documenting a metric ton of magic numbers, removing VMS support, fixing year 2038 bugs, removing insecure cypher support, removing less secure replacements for secure OS inbuilts, unused code, and more, see http://opensslrampage.org http://opensslrampage.org. On a side note, I was really hoping for the name to be OpenTLS (consistent with OpenBSD and OpenSSH, which are also OpenBSD maintained projects) or ValhallaTLS
  - gtirloni 13y ago
    Was all that rejected by the OpenSSL team though?
  - beefhash 13y ago
    OpenTLS was already taken: http://www.opentls.org/ http://www.opentls.org/ -- it's dead, but still taken.
- slight 13y ago
  If anyone can make openssl trustworthy it's OpenBSD.
- thebackwardsman 13y ago
  Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.
pikimeister 13y ago
It's indeed a great effort. Lets just hope that it delivers what is promising and doesn't bring other sorts of vulnerabilities due to the new implementation/code.
- sigzero 13y ago
  I, for one, would be extremely surprised if that happened. They are very thorough (even considering incomplete docs as a bug to be fixed).
mangia 13y ago
Please use Comic sans font.... Oh wait !
vayarajesh 13y ago
Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags
- okamiueru 13y ago
  Mine doesn't show up in comic sans. However, the link to OpenSSL is to We're Not Gonna Take It (http://www.youtube.com/watch?v=mRCGDUsdRDU http://www.youtube.com/watch?v=mRCGDUsdRDU)... This all seems like a joke to me.
  - vayarajesh 13y ago
    Check the footer (last line) of the page.. its just a page for donation to get rid of comic sans :)
  - Rafert 13y ago
    The OpenBSD Foundation donation page mentions and links back to this site...
- seszett 13y ago
  While it is funny, I think using Comic Sans is actually more hipstery than ranting against it, which is too mainstream today (the same goes for blink tags).
  - vayarajesh 13y ago
    There is a pro-type / mordern-type version of comic sans http://comicneue.com/ http://comicneue.com/ :)
    - jarin 13y ago
      I added it to homebrew-cask :) https://github.com/caskroom/homebrew-fonts https://github.com/caskroom/homebrew-fonts brew tap caskroom/fonts brew cask install font-comic-neue
Xylakant 13y ago
I'm curious what they mean by "free", they put it in bold caps. Since it's a fork of OpenSSL that probably implies that the OpenSSL license remains attached to the code at least until all of the relevant code has either been rewritten or removed.
marlin 13y ago
OpenBSD folks, what is your obsession with CVS????
- logn 13y ago
  I can't speak for them, but I think if you're not sold on git/mercurial then you have CVS and SVN as obvious choices. And those two aren't that different (pros/cons explained: http://www.pushok.com/software/svn-vscvs.html http://www.pushok.com/software/svn-vscvs.html ... edit: that's a very old link)
  - Grue3 13y ago
    Contains stuff like "SVN not yet so widly used, as the result there are places where it support still not implemented." Very old indeed.
- mrweasel 13y ago
  Why are people so obsessed with getting the OpenBSD developers to move from CVS? If it works for them and do what they need there's no need to move.
  - boklm 13y ago
    Because people might be interested to review their changes, and CVS makes that very difficult.
    - mrweasel 13y ago
      How so? CVS do make branching and merging rather annoying, but I don't see how reviewing changes becomes difficult. It's a lot easier to track the changes to the entire OpenBSD source three, compared to the Linux kernel. Git and Mercurial are extremely nice tools, but the flow of patches and branches quickly become rather hard to follow. CVS doesn't have most of the features that newer tools have, so there's stuff you simply can't do, but it is extremely easy to follow the code.
antirez 13y ago
I imagine supporting non-POSIX operating systems, or not exactly conforming ones, to have its challenges, but is it really hard to make this stuff working in Linux and Open/NET/Free BSD from day one? It seems to me a better approach to start this way, without to mention that the potential developers base you get if you support Linux ASAP can be larger.
- Bluerise 13y ago
  They don't care about that. Their main interest is to have a library conforming to OpenBSD standards.
- rodgerd 13y ago
  OpenSSH also deliberately trashed cross-platform compatability. This makes it amusing whenever someone flounces off to OpenBSD because they think systemd should have been written portably.
  - copergi 13y ago
    Yeah, fuck those openbsd guys and their totally not portable openssh that you can't run on anything but openbsd!
    - rodgerd 13y ago
      Portable OpenSSH is a seperately run project, for the hard of thinking.
- Sanddancer 13y ago
  OpenBSD cares about their own first and foremost. OpenSSH has a similar porting team, and has since the beginning, and there have been no problems there.
  - antirez 13y ago
    "OpenBSD cares about their own first and foremost.". This is their choice, but their impact in the security of IT is much smaller this way because most servers are running Linux. It is surely a great result to have an operating system like OpenBSD that can be proud of the security level reached and the small amount of vulnerabilities over the years, however if you analyze the computer security problem from a vendor-neutral standpoint, there is more at it than the availability of niche secure systems.
abcd_f 13y ago
> removed MacOS, Netware, OS/2, VMS and Windows build machinery What are the plans for native Windows support? I don't know what they mean by "The right Portability team in place", but it'd be a joke if the lib would require CygWin or some other external portability scaffolding. And without proper Windows support LibreSSL will simply fragment OpenSSL user base. I guess it's still better than nothing, but it definitely won't be an OpenSSL "replacement."
- bananas 13y ago
  Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.
  - abcd_f 13y ago
    There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them. If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.
    - bananas 13y ago
      Well I disagree. Whilst it's a natural choice for portability, when you port to a proprietary platform such as windows you lose a lot of the support and portability guarantees that POSIX gives you and the calling conventions and standards of many libraries. At this point it's advisable to pick a holistic 3rd party abstraction over this such as something right from APR to Qt that will abstract the platform specific implementation away. Some people write a lot of stuff plugged into Win32 without considering the CSPs and pull in OpenSSL without thought. Their funeral. As my father said: "when in France, talk French or hire a translator".
      - huhtenberg 13y ago
binaryapparatus 13y ago
While most of us just talk, this guys actually did something of great importance. Hell yeah they have all the rights to step on some toes and make fun as they see fit. I'd always salute doing stuff vs being politically correct.
mehrdada 13y ago
One annoying thing about OpenSSL is its license. I hope The Better Replacement™ fixes that as well (especially if its name gets to contain the string "Libre"), and it is not going to happen by forking OpenSSL.
- the_mitsuhiko 13y ago
  Just don't link it with GPL stuff and you're fine.
- Sanddancer 13y ago
  This is the problem with any sort of viral license in Free/Open/Libre software. Different people have different notions as to the best way of distributing it. An advertising clause is pretty minor compared to the rights you have to give away to use certain other "Libre" software.
- claudius 13y ago
  They are already placing completely rewritten files under ‘better’ licenses, so the license switch might happen file-by-file over a long period of time.
  - gioele 13y ago
    Is that strategy possible at all? Are there cases tested in courts (both US and EU) that assert that the file-by-file licence replacement really works?
    - mehrdada 13y ago
      Why wouldn't it? The author of the file will be the copyright holder by the virtue of authoring it. If she does not get rid of it, she still remains the copyright holder. Copyright does not switch owners purely by the virtue of distribution with another piece of work. IANAL.
      - gioele 13y ago
greatsuccess 13y ago
Its official: the emporer has no clothes
codecondo 13y ago
I was going to ASK HN, when are we going to see a replacement for OpenSSL; you know, the company that has much more field experience, or even understanding of how SSL operates. I then thought to myself, that'd be going too far..and nobody is really going to try and make an alternative. Oh boy..
greatsuccess 13y ago
Before you guys get too high and mighty. Refactoring openSSL is pretty fucking trivial. Fixing these bugs is also massively fucking trivial. Whats not trivial is that we as a community are using bug-ridden zero day software all the time, and we dont know because our profession is essentially a joke. Before you write the next clever comment think about that. You and by extension, I and by extension WE, are a total fucking joke.
broodbucket 13y ago
As someone without the Microsoft fonts using a browser that doesn't support the blink tag, I've totally missed out on the experience :(
- einrealist 13y ago
  I cannot even read the text on iPad.
- DonHopkins 13y ago
  Please, have some mercy on the rest of humanity and just donate anyway!!! I just sent them some money. Now I can sleep at night.
lmedinas 13y ago
A fork is not the solution for world problems period.
vayarajesh 13y ago
They should donate to replace comic sans with this much morder version of comic sans http://comicneue.com/ http://comicneue.com/
facepalm 13y ago
I'm assuming it is a parody (because of the font)? In any case forking OpenSSL seems like a knee jerk reaction?
- arcatek 13y ago
  "This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"
  - facepalm 13y ago
    Shouldn't they rather worry about making SSL secure? I don't think I like their attitude.
    - rymate1234 13y ago
      They are, that's why they haven't spent much time on the website.
thomseddon 13y ago
Does anyone have a link to repo in which it's being developed?
- woodson 13y ago
  http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/
Confusion 13y ago
Has anyone seen an explanation for why this effort isn't being undertaken together with the OpenSSL team?
- zorbo 13y ago
  I haven't seen an explanation for it, but one reasonable guess would be momentum. If you want to get work done, you don't want to have to wade through red-tape and bureaucracy to get it done. You don't want to work on something with the risk of it being shot-down by the current maintainers. This is not a criticism of the OpenSSL team, it's just a fact of life that it's often easier to "start fresh" than to try to change an already established routine. I also suspect that part of the reason is because OpenBSD just doesn't work well with others.
- rurounijones 13y ago
  Considering the fact that the OpenBSD guys are complaining about the OpenSSL guys competance in their commits I don't think they WANT them near the new fork.
- erikb 13y ago
  I would appreciate so much to see a link to corresponding discussions/blog posts in the security communities.
eyan 13y ago
oooh. lots of whiners here.
bosky101 13y ago
Ironic, that this website does not use SSL. ~B
jbergstroem 13y ago
Since libressl.org doesn't seem to contain this information, hopefully someone here perhaps knows more about it: Is it possible to donate specifically to subprojects? As a previous donator to the OpenBSD foundation, being able to do so would hopefully aid receivers of those funds not only use time (timing) as one way to measure the potential success of libressl. Attitude and font choice aside, I can't help somewhat feel that one could explore better ways to funnel interest, commitment and donations to a project such as this; especially since it sparked as a result of heartbleed.
fab13n 13y ago
With close to years of C under my belt, I believe it's a major error, today, to write a critical cryptographic library in C. OK, do the codecs in C if it's the only way to meet performance requirements. But the rest must be written in a language that's reasonably analyzable statically, and with adequate abstractions. Seriously, have you looked at the filthy mess of leaky abstractions that OpenSSL's BIO system is? How many bugs could be found and/or planted by a 3-letters agency in that crap? Is there anyone who's comfortable with its #ifdef labyrinths? Finally, I don't think you can retrofit clarity in OpenSSL any better than you could, say, retrofit virus-resilience in a Microsoft OS that hasn't been originally designed for hostile network environments. I used to believe OpenSSL was made messy in order to sell consulting hours, since Snowden I have a more paranoid hypothesis.
- dtech 13y ago
  They're making a fork of OpenSSL, and removing all the cruft. Porting it to a completely different language would be an error. There are several alternatives to OpenSSL available and/or popping up right now. They might or might not be a better choice for new developments. But refactoring OpenSSL (where a lot of currently used software depends upon) is certainly not a dumb decision.
  - fab13n 13y ago
    Agreed, there's no realistic way to port OpenSSL to a new language. What I'm saying is, I think a clean-up fork of OpenSSL will divide the workforce per project, without dramatically improving security. So it's not "dumb", but I expect the net result to be negative. At least a clean reimplementation featuring XXI-th century technologies would have a non-zero chance to produce something great.
    - sigzero 13y ago
      I don't agree at all. I am betting that once LibreSSL is "done" it will get adopted heavily and the community will have a cleaner and more secure code base to work from going forward.
antocv 13y ago
"No we dont need help with making web pages" its just a bunch of html very simple 1990s tags and it still looks and works much better than any html5 css3 bootstrap fanboy page Ive ever seen. Awesomeness
- mykhal 13y ago
  does not work wery well for instance for me or html validator..
- adamman 13y ago
  You must be trolling. The site is ugly and I'm sure they would agree. That clearly is not the focus of their work.
  - scintill76 13y ago
    "This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags." They know. I find simple HTML like http://cr.yp.to/ http://cr.yp.to/ to be refreshing sometimes, albeit not "pretty." But with the font and blink tag (powered by CSS), they've gone out of their way to make it a bit ugly. At least they drew a line and don't have headache-inducing colors or animations.
nottrobin 13y ago
Site straining under the load of HN visitors?
TacticalCoder 13y ago
I may have a stupid question but... While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself? It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA hashes and so people can't really "mess" with the history of a DVCS like Git: too many people noticed a critical file having no business being modified being, well... Modified. Once again, it was quite a while ago but I'm pretty certain that both the fact that Git was decentralized and that Git was using cryptographically secure hashes was touted as a "Good Thing" [TM] that helped catch the backdooring attempts. Ain't using CVS potentially an issue here?
- gnoway 13y ago
  Git uses SHA-1 hashes, which have not been considered cryptographically secure since 2005. Git and CVS are both just tools. They each provide a server implementation, but it's uncommon to use either of these for write access in large projects. It's more common to wrap CVS or Git with a different frontend like HTTPS or SSH. My guess is that the OpenBSD guys use OpenSSH. This team is fanatical about security and process. I am completely comfortable with them using whichever tools they want.
  - floatboth 13y ago
    Linus Torvalds: "the point is the SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, OK, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get."
  - KMag 13y ago
    SHA-1 has been shown to not be collision-resistant. Correct me if you've heard otherwise, but I believe SHA-1 is still believed to be second-preimage resistant. In other words, with fewer than 2 * * 80 trials, an attacker can generate two files that have the same SHA-1 hash. (In the case of C source files, this probably means embedding a nonsense comment in the middle of each file, probably several hundred to several thousand ASCII characters.) If an attacker can get the very carefully constructed benign file past code review and have the ability to modify the repository, they can substitute the very carefully crafted malicious file for the very carefully crafted benign file without changing the root of the Merkle tree. Assuming that SHA-1 is still second-preimage resistant, it will take an attacker about 2 * * 159 attempts to come up with a file that has the same hash as a legitimate file not carefully constructed by the attacker. So, the weaknesses in SHA-1 probably mean that exploiting those weaknesses in the context of git still requires a mole in the development team. Though, I wouldn't want to bet my life on nobody noticing a big nonsense comment in the middle of a C file or someone figuring out how to construct a reasonably reviewable C file as the carefully crafted benign file. In any case, the weaknesses in SHA-1 still likely pose a significant difficulty in forging a git history without planting a mole in the dev team. It's much better than no cryptographic barriers to forgery.
mykhal 13y ago
libressl.org is inaccessible via ssl - is it some kind of irony or something?
- sigzero 13y ago
  Why would they need that for a temporary web page? And one that has no need to be accessed via ssl? They threw together a page to give you some information and that is all.
petval 13y ago
I like their tools like pfctl, raidctl. Hopefully they create something like sslctl.
- floatboth 13y ago
  OpenSSL is a library, not a program like pf.
  - alex4nder 13y ago
    You know, except for the 'openssl' executable that builds, and a lot of people use.
madospace 13y ago
Dear god.. Y comic sans .. !!!!
halfdan 13y ago
Comic Sans, really?
gpcz 13y ago
I've been thinking recently about Heartbleed, and I was wondering if by writing C code to implement various network and cryptographic protocols, we're acting as human compilers for something that might be better represented in a more abstract format. I know there's some research on this already (the Austin Protocol Compiler), but does anyone here know of any other serious efforts to take the human out of the equation in terms of implementing protocols in C?
- antocv 13y ago
  C is only used because for cryptography we really need to be close to the CPU and memory, going all assembler is an option actually. Anything higher than that and you have to have formal proofs for your compiler as well as your equations.
  - godojo 13y ago
    Don't listen to him, its just for performance, compatibility and portability. There's many other reasons why you might want to use another language, and some do.
- hsivonen 13y ago
  Rust (http://www.rust-lang.org/ http://www.rust-lang.org/) is a serious effort to build a language that's close to metal like C but safe.
  - storrgie 13y ago
    Rust (http://playrust.com/ http://playrust.com/) is a serious effort to build an envrionment that's about survival and gratuitous male nudity.
  - carussell 13y ago
    I think gpcz was suggesting something more along the lines of an entirely new approach to protocol implementation, like VPRI's TCP/IP stack that Jeff Moser describes[1], rather than just swapping out C for something else while keeping the hand-written aspect. > Let's say we want to build the TCP/IP stack of an operating system. A traditional implementation might take 10,000 lines of code. What if you rethought the design from the ground up? What if you could make the IP packet handling code look almost identical to the RFC 791 diagram which defines IP? If the industry as whole could agree on this approach in a move similar to the Dijkstra/structured programming move that happened a few decades back, the sort of verifiable interoperability + security that Meredith Patterson and Sergey Bratus (who you may recognize from Occupy Babel![2]) call for would be closer to reach[3]. 1. Jeff Moser. Towards Moore's Law Software: Part 3 of 3. https://www.youtube.com/watch?v=UzjfeFJJseU https://www.youtube.com/watch?v=UzjfeFJJseU 2. Occupy Babel!. http://www.cs.dartmouth.edu/~sergey/langsec/occupy/ http://www.cs.dartmouth.edu/~sergey/langsec/occupy/ 3. Meredith Patterson. LANGSEC 2011–2016. https://www.youtube.com/watch?v=UzjfeFJJseU https://www.youtube.com/watch?v=UzjfeFJJseU
slashdotaccount 13y ago
https://twitter.com/matthew_d_green/status/456960435845996544 https://twitter.com/matthew_d_green/status/45696043584599654...
- gizzlon 13y ago
  Matthew Green ‏@matthew_d_green Apr 18: "@MiodVallat @cwlcks Well then I withdraw my earlier comments. What happens in BSD when the system RNG lacks entropy? Does it block?"
- dfc 13y ago
  Did you get to the part where Prof. Green says: @MiodVallat @cwlcks Well then I withdraw my earlier comments. What happens in BSD when the system RNG lacks entropy? Does it block?
- X-Istence 13y ago
  Now go read this: https://twitter.com/MiodVallat/status/457169266748715008 https://twitter.com/MiodVallat/status/457169266748715008 And the whole thread ... and problem doesn't exist. --- Same thing was brought up in this HN thread: https://news.ycombinator.com/item?id=7604364 https://news.ycombinator.com/item?id=7604364
cridenour 13y ago
"No we don't want help making web pages, thank you." Seems silly to turn away help.
- clarry 13y ago
  Managing a flock of web devs and telling them all they're doing it wrong would eat up time that could've been spent on the actual code. So it's not actually help.
seanieb 13y ago
Wouldn't the name LibreTLS be more appropriate?
- TheCoreh 13y ago
  Or OpenTLS, to still match the OpenBSD naming convention.
adamtj 13y ago
I just donated my $100. Have you?
- JDShu 13y ago
  No.
deegles 13y ago
Some of the commit comments are entertaining: "Fix some serious pointer-arithmatic-magic-number-unchecked-return eyebleed that I stumbled into here and got stuck with. If modern society can get past selling daughters for cows, surely we can decide to write modern C code in an "application" that is probably 3 lines of shell/python/cgi away from talking to the internet in a lot of places.. (This file still needs a lot more love though) "oh god yuck" deraadt@ ok tedu@" http://freshbsd.org/commit/openbsd/fc55d7f9ab6fcadd0ca2f8231f2559eace1aff53 http://freshbsd.org/commit/openbsd/fc55d7f9ab6fcadd0ca2f8231...
chris_wot 13y ago
I refer everyone to this thread - https://plus.google.com/u/0/+jwildeboer/posts/Tuw81zXqtcC https://plus.google.com/u/0/+jwildeboer/posts/Tuw81zXqtcC "Suggesting to call the fork LibreSSL or LibreTLS just to offend everyone. trololo" And it was so.
euske 13y ago
This is one of the best things that happened in the open source world recently. I like their attitude towards "web hipsters" too. They're serious folks who shut up and write AND READ codes. It's funny that they do this "donate to stop blinking" thing again. They have been doing it for OpenSSH since 2000. cf. http://www.openssh.com/ http://www.openssh.com/

254 points by janvdberg 13y ago

I don't get the point of this fork. Usually when a project is forked, it means that people want to keep the code base but disagree with the way the project is managed. After heartbleed everybody blamed OpenSSL's bloated code base and it became apparent that many contributions came from volunteers with very few financing. By forking the project, LibreSSL will keep the problematic code legacy and split the community. Maybe I am missing something, but it looks like opportunism here...

AlexMeesters 13y ago
> After heartbleed everybody blamed OpenSSL's bloated code base < And this is exactly what they are fixing. OpenSSL's response was to fix heartbleed and move on, not fixing the more broad problem of to much code cruft that led to the bug. IMHO they are right to fork it, OpenSSL's lack of reaction to this is a raise for concern. I am sure Theo( de Raadt) and its team can tackle this, making the code base much much leaner, reducing the risks of bugs similar to heartbleed. And there is really no excuse for OpenSSL to deny that. Also i think OpenSSL has to much technical debt to be efficient in tackling a cleanup like this.

EGKW 13y ago

What's with the link to YouTube under "OpenSSL"? Supposed to be a joke? Or just a hair in the link soup?

tete 13y ago
The OpenBSD folks love all kinds of music: http://openbsd.com/lyrics.html http://openbsd.com/lyrics.html

tete 13y ago

Everyone clicked on OpenSSL yet? ;)

DiabloD3 13y ago

Comic Sans? Really? Edit: To those downvoting, yes, I saw the footer. This doesn't excuse their childish behavior. I will not be donating to this project if this is the level of seriousness they have for it.

anaphor 13y ago
Maybe you should consider donating
- stephen_g 13y ago
  To me it comes off as pretty childish - turned me off donating really...
  - Crito 13y ago
    Why would you consciously permit yourself to be biased by the appearance of their webpage in such a way?
rurounijones 13y ago
Blatantly done on purpose to: A) In the smallprint: "This page scientifically designed to annoy web hipsters." (Mission accomplished) B) Make it obvious that this is a temporary site (In case the disclaimer wasn't enough) And if you really want to see the lengths they went to to annoy web people, look at the source
adamnemecek 13y ago
Read the fine print > This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags
keyle 13y ago
I was about to post the exact same question. And if that's supposed to promote donations... (?!) Ask yourself if a founder dresses as a clown to get funding.

claudius 13y ago

It seems that is is indeed the official site (as linked-to on http://www.openbsdfoundation.org/ http://www.openbsdfoundation.org/), just in case there are any doubts…for no reason whatsoever.

rurounijones 13y ago

Since this is related. I have a question: How can they know that they have not broken something in their flensing without any automated testing since no tests is one of the big problems with OpenSSL?

mrmincent 13y ago
I believe they are compiling the openbsd packages with it, so I guess it is a decent set to test against.
- rurounijones 13y ago
  Ah, so compile openbsd packages against it then run the tests for those packages. Sort-of-integration testing. Gotchya
clarry 13y ago
Believe it or not, there are other ways to spot problems besides automated testing, which wouldn't catch every problem anyway (that's why we need human audits like the one OpenBSD is doing). Yes, software existed before TDD and ADHD. That's not to say tests don't help. If you are interested, why don't you contribute?

edent 13y ago

Somewhat ironic that https://www.libressl.org/ https://www.libressl.org/ doesn't work, no?

anaphor 13y ago
Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.
- phlo 13y ago
  StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used to reveal data from other, encrypted streams. As for the second: if only sensitive data is encrypted, all encrypted streams automatically become "interesting" to a potential eavesdropper. If, however, everything is encrypted, all streams become equal again. The cost of storing all communications becomes much higher, and the ratio of cost and reward of decrypting a single captured stream worsens (as you may either reveal sensitive or non-sensitive data). [1] https://www.startssl.com/ https://www.startssl.com/ [2] http://www.instantssl.com/ssl-certificate-products/free-ssl-certificate.html http://www.instantssl.com/ssl-certificate-products/free-ssl-...
  - watwut 13y ago
    If you have to pay for revocation, then it is not free certificate. It is just certificate with fees postponed. It is not the same thing. Not sure how you, but when I buy things I do not consider only initial price, but also additional fees. If we want SSL used everywhere, browsers need accept self signed certificates in less obtuse way or there need to be other way to get really free ones.
    - 13y ago

chuckreynolds 13y ago

comic sans? really?

Dosenpfand 13y ago
>This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

deleted 13y ago

[deleted]

lifthrasiir 13y ago

It should rename to LibibreSSL instead, so that one can link the library with `-libressl`. Other than that, I appreciate this effort (no pun intended).

SwellJoe 13y ago
Why wouldn't they just make it available for linking as "ibressl" rather than naming the project that? LibibreSSL is unwieldy to put it mildly, and meaningless without the context of the original name.
- deleted 13y ago
  [deleted]

sarahj 13y ago

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing and documentation) not silly music video jabs.

deleted 13y ago
[deleted]
nailer 13y ago
They've already done massive amounts of work already - adding missing checks, documenting a metric ton of magic numbers, removing VMS support, fixing year 2038 bugs, removing insecure cypher support, removing less secure replacements for secure OS inbuilts, unused code, and more, see http://opensslrampage.org http://opensslrampage.org. On a side note, I was really hoping for the name to be OpenTLS (consistent with OpenBSD and OpenSSH, which are also OpenBSD maintained projects) or ValhallaTLS
- gtirloni 13y ago
  Was all that rejected by the OpenSSL team though?
- beefhash 13y ago
  OpenTLS was already taken: http://www.opentls.org/ http://www.opentls.org/ -- it's dead, but still taken.
slight 13y ago
If anyone can make openssl trustworthy it's OpenBSD.
thebackwardsman 13y ago
Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.

pikimeister 13y ago

It's indeed a great effort. Lets just hope that it delivers what is promising and doesn't bring other sorts of vulnerabilities due to the new implementation/code.

sigzero 13y ago
I, for one, would be extremely surprised if that happened. They are very thorough (even considering incomplete docs as a bug to be fixed).

mangia 13y ago

Please use Comic sans font.... Oh wait !

vayarajesh 13y ago

Comic sans?? lol! This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

okamiueru 13y ago
Mine doesn't show up in comic sans. However, the link to OpenSSL is to We're Not Gonna Take It (http://www.youtube.com/watch?v=mRCGDUsdRDU http://www.youtube.com/watch?v=mRCGDUsdRDU)... This all seems like a joke to me.
- vayarajesh 13y ago
  Check the footer (last line) of the page.. its just a page for donation to get rid of comic sans :)
- Rafert 13y ago
  The OpenBSD Foundation donation page mentions and links back to this site...
seszett 13y ago
While it is funny, I think using Comic Sans is actually more hipstery than ranting against it, which is too mainstream today (the same goes for blink tags).
- vayarajesh 13y ago
  There is a pro-type / mordern-type version of comic sans http://comicneue.com/ http://comicneue.com/ :)
  - jarin 13y ago
    I added it to homebrew-cask :) https://github.com/caskroom/homebrew-fonts https://github.com/caskroom/homebrew-fonts brew tap caskroom/fonts brew cask install font-comic-neue

Xylakant 13y ago

I'm curious what they mean by "free", they put it in bold caps. Since it's a fork of OpenSSL that probably implies that the OpenSSL license remains attached to the code at least until all of the relevant code has either been rewritten or removed.

marlin 13y ago

OpenBSD folks, what is your obsession with CVS????

logn 13y ago
I can't speak for them, but I think if you're not sold on git/mercurial then you have CVS and SVN as obvious choices. And those two aren't that different (pros/cons explained: http://www.pushok.com/software/svn-vscvs.html http://www.pushok.com/software/svn-vscvs.html ... edit: that's a very old link)
- Grue3 13y ago
  Contains stuff like "SVN not yet so widly used, as the result there are places where it support still not implemented." Very old indeed.
mrweasel 13y ago
Why are people so obsessed with getting the OpenBSD developers to move from CVS? If it works for them and do what they need there's no need to move.
- boklm 13y ago
  Because people might be interested to review their changes, and CVS makes that very difficult.
  - mrweasel 13y ago
    How so? CVS do make branching and merging rather annoying, but I don't see how reviewing changes becomes difficult. It's a lot easier to track the changes to the entire OpenBSD source three, compared to the Linux kernel. Git and Mercurial are extremely nice tools, but the flow of patches and branches quickly become rather hard to follow. CVS doesn't have most of the features that newer tools have, so there's stuff you simply can't do, but it is extremely easy to follow the code.

antirez 13y ago

I imagine supporting non-POSIX operating systems, or not exactly conforming ones, to have its challenges, but is it really hard to make this stuff working in Linux and Open/NET/Free BSD from day one? It seems to me a better approach to start this way, without to mention that the potential developers base you get if you support Linux ASAP can be larger.

Bluerise 13y ago
They don't care about that. Their main interest is to have a library conforming to OpenBSD standards.
rodgerd 13y ago
OpenSSH also deliberately trashed cross-platform compatability. This makes it amusing whenever someone flounces off to OpenBSD because they think systemd should have been written portably.
- copergi 13y ago
  Yeah, fuck those openbsd guys and their totally not portable openssh that you can't run on anything but openbsd!
  - rodgerd 13y ago
    Portable OpenSSH is a seperately run project, for the hard of thinking.
Sanddancer 13y ago
OpenBSD cares about their own first and foremost. OpenSSH has a similar porting team, and has since the beginning, and there have been no problems there.
- antirez 13y ago
  "OpenBSD cares about their own first and foremost.". This is their choice, but their impact in the security of IT is much smaller this way because most servers are running Linux. It is surely a great result to have an operating system like OpenBSD that can be proud of the security level reached and the small amount of vulnerabilities over the years, however if you analyze the computer security problem from a vendor-neutral standpoint, there is more at it than the availability of niche secure systems.

abcd_f 13y ago

> removed MacOS, Netware, OS/2, VMS and Windows build machinery What are the plans for native Windows support? I don't know what they mean by "The right Portability team in place", but it'd be a joke if the lib would require CygWin or some other external portability scaffolding. And without proper Windows support LibreSSL will simply fragment OpenSSL user base. I guess it's still better than nothing, but it definitely won't be an OpenSSL "replacement."

bananas 13y ago
Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.
- abcd_f 13y ago
  There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them. If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.
  - bananas 13y ago
    Well I disagree. Whilst it's a natural choice for portability, when you port to a proprietary platform such as windows you lose a lot of the support and portability guarantees that POSIX gives you and the calling conventions and standards of many libraries. At this point it's advisable to pick a holistic 3rd party abstraction over this such as something right from APR to Qt that will abstract the platform specific implementation away. Some people write a lot of stuff plugged into Win32 without considering the CSPs and pull in OpenSSL without thought. Their funeral. As my father said: "when in France, talk French or hire a translator".
    - huhtenberg 13y ago

binaryapparatus 13y ago

While most of us just talk, this guys actually did something of great importance. Hell yeah they have all the rights to step on some toes and make fun as they see fit. I'd always salute doing stuff vs being politically correct.

mehrdada 13y ago

One annoying thing about OpenSSL is its license. I hope The Better Replacement™ fixes that as well (especially if its name gets to contain the string "Libre"), and it is not going to happen by forking OpenSSL.

the_mitsuhiko 13y ago
Just don't link it with GPL stuff and you're fine.
Sanddancer 13y ago
This is the problem with any sort of viral license in Free/Open/Libre software. Different people have different notions as to the best way of distributing it. An advertising clause is pretty minor compared to the rights you have to give away to use certain other "Libre" software.
claudius 13y ago
They are already placing completely rewritten files under ‘better’ licenses, so the license switch might happen file-by-file over a long period of time.
- gioele 13y ago
  Is that strategy possible at all? Are there cases tested in courts (both US and EU) that assert that the file-by-file licence replacement really works?
  - mehrdada 13y ago
    Why wouldn't it? The author of the file will be the copyright holder by the virtue of authoring it. If she does not get rid of it, she still remains the copyright holder. Copyright does not switch owners purely by the virtue of distribution with another piece of work. IANAL.
    - gioele 13y ago

greatsuccess 13y ago

Its official: the emporer has no clothes

codecondo 13y ago

I was going to ASK HN, when are we going to see a replacement for OpenSSL; you know, the company that has much more field experience, or even understanding of how SSL operates. I then thought to myself, that'd be going too far..and nobody is really going to try and make an alternative. Oh boy..

greatsuccess 13y ago

Before you guys get too high and mighty. Refactoring openSSL is pretty fucking trivial. Fixing these bugs is also massively fucking trivial. Whats not trivial is that we as a community are using bug-ridden zero day software all the time, and we dont know because our profession is essentially a joke. Before you write the next clever comment think about that. You and by extension, I and by extension WE, are a total fucking joke.

broodbucket 13y ago

As someone without the Microsoft fonts using a browser that doesn't support the blink tag, I've totally missed out on the experience :(

einrealist 13y ago
I cannot even read the text on iPad.
DonHopkins 13y ago
Please, have some mercy on the rest of humanity and just donate anyway!!! I just sent them some money. Now I can sleep at night.

lmedinas 13y ago

A fork is not the solution for world problems period.

vayarajesh 13y ago

They should donate to replace comic sans with this much morder version of comic sans http://comicneue.com/ http://comicneue.com/

facepalm 13y ago

I'm assuming it is a parody (because of the font)? In any case forking OpenSSL seems like a knee jerk reaction?

arcatek 13y ago
"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"
- facepalm 13y ago
  Shouldn't they rather worry about making SSL secure? I don't think I like their attitude.
  - rymate1234 13y ago
    They are, that's why they haven't spent much time on the website.

thomseddon 13y ago

Does anyone have a link to repo in which it's being developed?

woodson 13y ago
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/

Confusion 13y ago

Has anyone seen an explanation for why this effort isn't being undertaken together with the OpenSSL team?

zorbo 13y ago
I haven't seen an explanation for it, but one reasonable guess would be momentum. If you want to get work done, you don't want to have to wade through red-tape and bureaucracy to get it done. You don't want to work on something with the risk of it being shot-down by the current maintainers. This is not a criticism of the OpenSSL team, it's just a fact of life that it's often easier to "start fresh" than to try to change an already established routine. I also suspect that part of the reason is because OpenBSD just doesn't work well with others.
rurounijones 13y ago
Considering the fact that the OpenBSD guys are complaining about the OpenSSL guys competance in their commits I don't think they WANT them near the new fork.
erikb 13y ago
I would appreciate so much to see a link to corresponding discussions/blog posts in the security communities.

eyan 13y ago

oooh. lots of whiners here.

bosky101 13y ago

Ironic, that this website does not use SSL. ~B

jbergstroem 13y ago

Since libressl.org doesn't seem to contain this information, hopefully someone here perhaps knows more about it: Is it possible to donate specifically to subprojects? As a previous donator to the OpenBSD foundation, being able to do so would hopefully aid receivers of those funds not only use time (timing) as one way to measure the potential success of libressl. Attitude and font choice aside, I can't help somewhat feel that one could explore better ways to funnel interest, commitment and donations to a project such as this; especially since it sparked as a result of heartbleed.

fab13n 13y ago

With close to years of C under my belt, I believe it's a major error, today, to write a critical cryptographic library in C. OK, do the codecs in C if it's the only way to meet performance requirements. But the rest must be written in a language that's reasonably analyzable statically, and with adequate abstractions. Seriously, have you looked at the filthy mess of leaky abstractions that OpenSSL's BIO system is? How many bugs could be found and/or planted by a 3-letters agency in that crap? Is there anyone who's comfortable with its #ifdef labyrinths? Finally, I don't think you can retrofit clarity in OpenSSL any better than you could, say, retrofit virus-resilience in a Microsoft OS that hasn't been originally designed for hostile network environments. I used to believe OpenSSL was made messy in order to sell consulting hours, since Snowden I have a more paranoid hypothesis.

dtech 13y ago
They're making a fork of OpenSSL, and removing all the cruft. Porting it to a completely different language would be an error. There are several alternatives to OpenSSL available and/or popping up right now. They might or might not be a better choice for new developments. But refactoring OpenSSL (where a lot of currently used software depends upon) is certainly not a dumb decision.
- fab13n 13y ago
  Agreed, there's no realistic way to port OpenSSL to a new language. What I'm saying is, I think a clean-up fork of OpenSSL will divide the workforce per project, without dramatically improving security. So it's not "dumb", but I expect the net result to be negative. At least a clean reimplementation featuring XXI-th century technologies would have a non-zero chance to produce something great.
  - sigzero 13y ago
    I don't agree at all. I am betting that once LibreSSL is "done" it will get adopted heavily and the community will have a cleaner and more secure code base to work from going forward.

antocv 13y ago

"No we dont need help with making web pages" its just a bunch of html very simple 1990s tags and it still looks and works much better than any html5 css3 bootstrap fanboy page Ive ever seen. Awesomeness

mykhal 13y ago
does not work wery well for instance for me or html validator..
adamman 13y ago
You must be trolling. The site is ugly and I'm sure they would agree. That clearly is not the focus of their work.
- scintill76 13y ago
  "This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags." They know. I find simple HTML like http://cr.yp.to/ http://cr.yp.to/ to be refreshing sometimes, albeit not "pretty." But with the font and blink tag (powered by CSS), they've gone out of their way to make it a bit ugly. At least they drew a line and don't have headache-inducing colors or animations.

nottrobin 13y ago

Site straining under the load of HN visitors?

TacticalCoder 13y ago

I may have a stupid question but... While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself? It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA hashes and so people can't really "mess" with the history of a DVCS like Git: too many people noticed a critical file having no business being modified being, well... Modified. Once again, it was quite a while ago but I'm pretty certain that both the fact that Git was decentralized and that Git was using cryptographically secure hashes was touted as a "Good Thing" [TM] that helped catch the backdooring attempts. Ain't using CVS potentially an issue here?

gnoway 13y ago
Git uses SHA-1 hashes, which have not been considered cryptographically secure since 2005. Git and CVS are both just tools. They each provide a server implementation, but it's uncommon to use either of these for write access in large projects. It's more common to wrap CVS or Git with a different frontend like HTTPS or SSH. My guess is that the OpenBSD guys use OpenSSH. This team is fanatical about security and process. I am completely comfortable with them using whichever tools they want.
- floatboth 13y ago
  Linus Torvalds: "the point is the SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, OK, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get."
- KMag 13y ago
  SHA-1 has been shown to not be collision-resistant. Correct me if you've heard otherwise, but I believe SHA-1 is still believed to be second-preimage resistant. In other words, with fewer than 2 * * 80 trials, an attacker can generate two files that have the same SHA-1 hash. (In the case of C source files, this probably means embedding a nonsense comment in the middle of each file, probably several hundred to several thousand ASCII characters.) If an attacker can get the very carefully constructed benign file past code review and have the ability to modify the repository, they can substitute the very carefully crafted malicious file for the very carefully crafted benign file without changing the root of the Merkle tree. Assuming that SHA-1 is still second-preimage resistant, it will take an attacker about 2 * * 159 attempts to come up with a file that has the same hash as a legitimate file not carefully constructed by the attacker. So, the weaknesses in SHA-1 probably mean that exploiting those weaknesses in the context of git still requires a mole in the development team. Though, I wouldn't want to bet my life on nobody noticing a big nonsense comment in the middle of a C file or someone figuring out how to construct a reasonably reviewable C file as the carefully crafted benign file. In any case, the weaknesses in SHA-1 still likely pose a significant difficulty in forging a git history without planting a mole in the dev team. It's much better than no cryptographic barriers to forgery.

mykhal 13y ago

libressl.org is inaccessible via ssl - is it some kind of irony or something?

sigzero 13y ago
Why would they need that for a temporary web page? And one that has no need to be accessed via ssl? They threw together a page to give you some information and that is all.

petval 13y ago

I like their tools like pfctl, raidctl. Hopefully they create something like sslctl.

floatboth 13y ago
OpenSSL is a library, not a program like pf.
- alex4nder 13y ago
  You know, except for the 'openssl' executable that builds, and a lot of people use.

madospace 13y ago

Dear god.. Y comic sans .. !!!!

halfdan 13y ago

Comic Sans, really?

gpcz 13y ago

I've been thinking recently about Heartbleed, and I was wondering if by writing C code to implement various network and cryptographic protocols, we're acting as human compilers for something that might be better represented in a more abstract format. I know there's some research on this already (the Austin Protocol Compiler), but does anyone here know of any other serious efforts to take the human out of the equation in terms of implementing protocols in C?

antocv 13y ago
C is only used because for cryptography we really need to be close to the CPU and memory, going all assembler is an option actually. Anything higher than that and you have to have formal proofs for your compiler as well as your equations.
- godojo 13y ago
  Don't listen to him, its just for performance, compatibility and portability. There's many other reasons why you might want to use another language, and some do.
hsivonen 13y ago
Rust (http://www.rust-lang.org/ http://www.rust-lang.org/) is a serious effort to build a language that's close to metal like C but safe.
- storrgie 13y ago
  Rust (http://playrust.com/ http://playrust.com/) is a serious effort to build an envrionment that's about survival and gratuitous male nudity.
- carussell 13y ago
  I think gpcz was suggesting something more along the lines of an entirely new approach to protocol implementation, like VPRI's TCP/IP stack that Jeff Moser describes[1], rather than just swapping out C for something else while keeping the hand-written aspect. > Let's say we want to build the TCP/IP stack of an operating system. A traditional implementation might take 10,000 lines of code. What if you rethought the design from the ground up? What if you could make the IP packet handling code look almost identical to the RFC 791 diagram which defines IP? If the industry as whole could agree on this approach in a move similar to the Dijkstra/structured programming move that happened a few decades back, the sort of verifiable interoperability + security that Meredith Patterson and Sergey Bratus (who you may recognize from Occupy Babel![2]) call for would be closer to reach[3]. 1. Jeff Moser. Towards Moore's Law Software: Part 3 of 3. https://www.youtube.com/watch?v=UzjfeFJJseU https://www.youtube.com/watch?v=UzjfeFJJseU 2. Occupy Babel!. http://www.cs.dartmouth.edu/~sergey/langsec/occupy/ http://www.cs.dartmouth.edu/~sergey/langsec/occupy/ 3. Meredith Patterson. LANGSEC 2011–2016. https://www.youtube.com/watch?v=UzjfeFJJseU https://www.youtube.com/watch?v=UzjfeFJJseU

slashdotaccount 13y ago

https://twitter.com/matthew_d_green/status/456960435845996544 https://twitter.com/matthew_d_green/status/45696043584599654...

gizzlon 13y ago
Matthew Green ‏@matthew_d_green Apr 18: "@MiodVallat @cwlcks Well then I withdraw my earlier comments. What happens in BSD when the system RNG lacks entropy? Does it block?"
dfc 13y ago
Did you get to the part where Prof. Green says: @MiodVallat @cwlcks Well then I withdraw my earlier comments. What happens in BSD when the system RNG lacks entropy? Does it block?
X-Istence 13y ago
Now go read this: https://twitter.com/MiodVallat/status/457169266748715008 https://twitter.com/MiodVallat/status/457169266748715008 And the whole thread ... and problem doesn't exist. --- Same thing was brought up in this HN thread: https://news.ycombinator.com/item?id=7604364 https://news.ycombinator.com/item?id=7604364

cridenour 13y ago

"No we don't want help making web pages, thank you." Seems silly to turn away help.

clarry 13y ago
Managing a flock of web devs and telling them all they're doing it wrong would eat up time that could've been spent on the actual code. So it's not actually help.

seanieb 13y ago

Wouldn't the name LibreTLS be more appropriate?

TheCoreh 13y ago
Or OpenTLS, to still match the OpenBSD naming convention.

adamtj 13y ago

I just donated my $100. Have you?

JDShu 13y ago
No.

deegles 13y ago

Some of the commit comments are entertaining: "Fix some serious pointer-arithmatic-magic-number-unchecked-return eyebleed that I stumbled into here and got stuck with. If modern society can get past selling daughters for cows, surely we can decide to write modern C code in an "application" that is probably 3 lines of shell/python/cgi away from talking to the internet in a lot of places.. (This file still needs a lot more love though) "oh god yuck" deraadt@ ok tedu@" http://freshbsd.org/commit/openbsd/fc55d7f9ab6fcadd0ca2f8231f2559eace1aff53 http://freshbsd.org/commit/openbsd/fc55d7f9ab6fcadd0ca2f8231...

chris_wot 13y ago

I refer everyone to this thread - https://plus.google.com/u/0/+jwildeboer/posts/Tuw81zXqtcC https://plus.google.com/u/0/+jwildeboer/posts/Tuw81zXqtcC "Suggesting to call the fork LibreSSL or LibreTLS just to offend everyone. trololo" And it was so.

euske 13y ago

This is one of the best things that happened in the open source world recently. I like their attitude towards "web hipsters" too. They're serious folks who shut up and write AND READ codes. It's funny that they do this "donate to stop blinking" thing again. They have been doing it for OpenSSH since 2000. cf. http://www.openssh.com/ http://www.openssh.com/