6 ms·

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of cours

by sarahj 12y ago

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications. Of course it has its problems, and there is nothing wrong with adding more competition in this space. But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing and documentation) not silly music video jabs.

deleted 12y ago
[deleted]
nailer 12y ago
They've already done massive amounts of work already - adding missing checks, documenting a metric ton of magic numbers, removing VMS support, fixing year 2038 bugs, removing insecure cypher support, removing less secure replacements for secure OS inbuilts, unused code, and more, see http://opensslrampage.org http://opensslrampage.org. On a side note, I was really hoping for the name to be OpenTLS (consistent with OpenBSD and OpenSSH, which are also OpenBSD maintained projects) or ValhallaTLS
- gtirloni 12y ago
  Was all that rejected by the OpenSSL team though?
- beefhash 12y ago
  OpenTLS was already taken: http://www.opentls.org/ http://www.opentls.org/ -- it's dead, but still taken.
slight 12y ago
If anyone can make openssl trustworthy it's OpenBSD.
thebackwardsman 12y ago
Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.
- bananas 12y ago
  I'd hope that I speak for the majority here when I say that OpenSSL has had its chance. This is the beauty of open source, nothing more. We can take this and make it better.
  - thebackwardsman 12y ago
    Count the number of vulnerabilities in OpenSSL over the last few years, relative to the size of its code base. A single vulnerability, albeit bad this year, results in a fork and the attitude of "it had its chance." LibreSSL inherits all of the undiscovered vulnerabilities in its huge code base. I hope your harsh criticism carries over to its code base once these flaws are discovered here too. That's the beauty of open source.
    - rakoo 12y ago
      number ok known vulnerabilities you mean ? The problem is that a security software brick is not satisfactory when it works, but when you can be sure there are no problems. Given the very low quality of the code and the high amount of bloat, few people actually trust it. They have to trust third-parties and external certifications and the word on the street, and this is not enough for that kind of dependency.
    - copergi 12y ago
      >Count the number of vulnerabilities in OpenSSL over the last few years, relative to the size of its code base. A single vulnerability You might want to take your own advice. There have been tons of vulnerabilities in openssl, not one. >LibreSSL inherits all of the undiscovered vulnerabilities in its huge code base. That would be why it is being gutted and audited. That's the whole point.
  - simias 12y ago
    Quite frankly unless LibreSSL manages to raise more than 2000$ a year (what the OpenSSL fundation makes, apparently) I fail to see how they hope to avoid encountering the same kind of problems OpenSSL did (and still does). And given that the OpenBSD projects had to beg for donations to reach a 150k$ goal, if memory serves, I doubt they'll be able to sink a tremendous amount of money into LibreSSL. If you can't pay people to work on the project full time, properly test and audit the code, sooner or later something will go wrong. And then we'll see people over here commenting along the lines of "my god those people are incompetent/irresponsible, they hope to get a free pass because it's free and open source, etc..." Also, until I see a first release of the lib it's just marketing as far as I'm concerned, after all the OpenBSD foundation announced OpenCVS in 2004...
alexcroox 12y ago
Agreed, the tone of the page and the footer prevents me from taking these guys seriously, especially in this area (even more so with recent events).
- tikums 12y ago
  Which goes to show that you're not the intended end-consumer of this product and don't know their credentials. They are not newcomers to this space. If their tone is off-putting, maybe you should stop relying on OpenSSH too.
- DonHopkins 12y ago
  At least they succeeded in their goal of annoying web hipsters. Why don't you sell your fixie on craigslist and donate some money anyway, please?
  - DanBC 12y ago
    Do you think your tone will encourage anyone to donate?
    - DonHopkins 12y ago
      Well, I donated because I was glad it annoyed him, so I assume other people might, too. ;)
- antocv 12y ago
  The tone and the footer encouraged me to actually donate even what little I have to this project. The footer is a smack in the face to all those responsive bootstrap modern crap marketing websites - while this, table based layout, single page html provides more information and works in every device, with every resolution. Everything just included. As it should be. This page probably took as much time to write as the sentences in the page - instead of fucking around with html initializr responsive themes, colors and oh god make it stop.
- Joeboy 12y ago
  Were you about to donate your time and money to the project, up until you saw the footer?
sergiotapia 12y ago
I still can't believe such a fundamental backbone of the web runs on $2000/year. This is a -worldwide- service, and it runs on peanuts. It's flabbergasting. Please donate today if you can. https://www.openssl.org/support/donations.html https://www.openssl.org/support/donations.html
- CHY872 12y ago
  No. It needs corporate involvement, from Google, Red Hat, Amazon, Verisign etc. Lend minds, not money. By all means fund people to write it, but like it's not you who should be contributing, it's the corporations who rely on it.
  - higherpurpose 12y ago
    Google and Amazon should be donating to LibreSSL, too. They may have no intention of using it in the next few years, but I'm sure they'd like for a solid alternative to be out there, so they can use it just in case they do change their minds, just like Google recently did with the switch from NSS to OpenSSL, just before Heartbleed happened. It would've been smart of them to donate to OpenSSL starting a few years back, so that by the time they decided to quit NSS, they would've been sure OpenSSL is pretty solid, and would've also discovered the Heartbleed bug much earlier. They could not repeat the same mistake twice by donating to LibreSSL right now.
    - worr 12y ago
      Google already donates to LibreSSL; they annually donate to OpenBSD. That money goes towards projects like LibreSSL.
copergi 12y ago
>OpenSSL has provided years of free software, supporting thousands of sites and applications. And has done it so poorly that it has been a security nightmare the whole time. Just because something is given away, doesn't mean the world is obligated to be thankful for it. Giving away crap doesn't make it not stink.

by sarahj 12y ago

deleted 12y ago

[deleted]

nailer 12y ago

They've already done massive amounts of work already - adding missing checks, documenting a metric ton of magic numbers, removing VMS support, fixing year 2038 bugs, removing insecure cypher support, removing less secure replacements for secure OS inbuilts, unused code, and more, see http://opensslrampage.org http://opensslrampage.org. On a side note, I was really hoping for the name to be OpenTLS (consistent with OpenBSD and OpenSSH, which are also OpenBSD maintained projects) or ValhallaTLS

gtirloni 12y ago
Was all that rejected by the OpenSSL team though?
beefhash 12y ago
OpenTLS was already taken: http://www.opentls.org/ http://www.opentls.org/ -- it's dead, but still taken.

slight 12y ago

If anyone can make openssl trustworthy it's OpenBSD.

thebackwardsman 12y ago

Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.

bananas 12y ago
I'd hope that I speak for the majority here when I say that OpenSSL has had its chance. This is the beauty of open source, nothing more. We can take this and make it better.
- thebackwardsman 12y ago
  Count the number of vulnerabilities in OpenSSL over the last few years, relative to the size of its code base. A single vulnerability, albeit bad this year, results in a fork and the attitude of "it had its chance." LibreSSL inherits all of the undiscovered vulnerabilities in its huge code base. I hope your harsh criticism carries over to its code base once these flaws are discovered here too. That's the beauty of open source.
  - rakoo 12y ago
    number ok known vulnerabilities you mean ? The problem is that a security software brick is not satisfactory when it works, but when you can be sure there are no problems. Given the very low quality of the code and the high amount of bloat, few people actually trust it. They have to trust third-parties and external certifications and the word on the street, and this is not enough for that kind of dependency.
  - copergi 12y ago
    >Count the number of vulnerabilities in OpenSSL over the last few years, relative to the size of its code base. A single vulnerability You might want to take your own advice. There have been tons of vulnerabilities in openssl, not one. >LibreSSL inherits all of the undiscovered vulnerabilities in its huge code base. That would be why it is being gutted and audited. That's the whole point.
- simias 12y ago
  Quite frankly unless LibreSSL manages to raise more than 2000$ a year (what the OpenSSL fundation makes, apparently) I fail to see how they hope to avoid encountering the same kind of problems OpenSSL did (and still does). And given that the OpenBSD projects had to beg for donations to reach a 150k$ goal, if memory serves, I doubt they'll be able to sink a tremendous amount of money into LibreSSL. If you can't pay people to work on the project full time, properly test and audit the code, sooner or later something will go wrong. And then we'll see people over here commenting along the lines of "my god those people are incompetent/irresponsible, they hope to get a free pass because it's free and open source, etc..." Also, until I see a first release of the lib it's just marketing as far as I'm concerned, after all the OpenBSD foundation announced OpenCVS in 2004...

alexcroox 12y ago

Agreed, the tone of the page and the footer prevents me from taking these guys seriously, especially in this area (even more so with recent events).

tikums 12y ago
Which goes to show that you're not the intended end-consumer of this product and don't know their credentials. They are not newcomers to this space. If their tone is off-putting, maybe you should stop relying on OpenSSH too.
DonHopkins 12y ago
At least they succeeded in their goal of annoying web hipsters. Why don't you sell your fixie on craigslist and donate some money anyway, please?
- DanBC 12y ago
  Do you think your tone will encourage anyone to donate?
  - DonHopkins 12y ago
    Well, I donated because I was glad it annoyed him, so I assume other people might, too. ;)
antocv 12y ago
The tone and the footer encouraged me to actually donate even what little I have to this project. The footer is a smack in the face to all those responsive bootstrap modern crap marketing websites - while this, table based layout, single page html provides more information and works in every device, with every resolution. Everything just included. As it should be. This page probably took as much time to write as the sentences in the page - instead of fucking around with html initializr responsive themes, colors and oh god make it stop.
Joeboy 12y ago
Were you about to donate your time and money to the project, up until you saw the footer?

sergiotapia 12y ago

I still can't believe such a fundamental backbone of the web runs on $2000/year. This is a -worldwide- service, and it runs on peanuts. It's flabbergasting. Please donate today if you can. https://www.openssl.org/support/donations.html https://www.openssl.org/support/donations.html

CHY872 12y ago
No. It needs corporate involvement, from Google, Red Hat, Amazon, Verisign etc. Lend minds, not money. By all means fund people to write it, but like it's not you who should be contributing, it's the corporations who rely on it.
- higherpurpose 12y ago
  Google and Amazon should be donating to LibreSSL, too. They may have no intention of using it in the next few years, but I'm sure they'd like for a solid alternative to be out there, so they can use it just in case they do change their minds, just like Google recently did with the switch from NSS to OpenSSL, just before Heartbleed happened. It would've been smart of them to donate to OpenSSL starting a few years back, so that by the time they decided to quit NSS, they would've been sure OpenSSL is pretty solid, and would've also discovered the Heartbleed bug much earlier. They could not repeat the same mistake twice by donating to LibreSSL right now.
  - worr 12y ago
    Google already donates to LibreSSL; they annually donate to OpenBSD. That money goes towards projects like LibreSSL.

copergi 12y ago

>OpenSSL has provided years of free software, supporting thousands of sites and applications. And has done it so poorly that it has been a security nightmare the whole time. Just because something is given away, doesn't mean the world is obligated to be thankful for it. Giving away crap doesn't make it not stink.