5 ms·

The OpenBSD people sure are abrasive, but they deserve a ton of praise for taking on a tough task that no one else was willing to do, and for fixing the damn me

The OpenBSD people sure are abrasive, but they deserve a ton of praise for taking on a tough task that no one else was willing to do, and for fixing the damn mess. Between FIPS, the NIST and the OpenSSL foundation it's amazing that crypto even works.

shawn-furyan 12y ago
I've got to say that I like the abrasiveness. The security industry is rife with imposters and pretenders. All of the artifice and bogus claims make it very easy for people, organizations, industries... hell, governments to be misled into devoting huge amounts of resources into propping up what amounts to security theater, which is generally actively harmful. Abrasiveness and a willingness to ruffle the feathers of purveyors of bogus security is a public service.
- danielweber 12y ago
  There is hardly a shortage of abrasiveness in the security industry. That said, I find zero things wrong with OpenBSD's work to make LibreSSL. If anyone doesn't like it, I'll offer them their money back.
  - higherpurpose 12y ago
    "Fortunately" (and I don't mean to encourage it), the abrasive people in the crypto community are like that when they tend to be right - and don't want "newbies" to do stupid dangerous mistakes, so their tone comes out a little aggressive by default. But yeah, it could be improved. The community should work together on solving issues the right way.
    - _delirium 12y ago
      Fortunately or unfortunately, there are also a reasonable number of abrasive people who tend not to be right, so I'm not sure it's a good marker either way. There's a whole rock-star persona around people who make consulting careers out of trying to position themselves as security badasses, and not all of them are.
      - newman314 12y ago
        I include amongst these, security/network guys that disable ICMP because they read it in a book somewhere. Leads to a lot of facepalming when you are actually trying to get something done.
        ghshephard 12y ago
        Particularly now that ICMP is actually a requirement for IPv6 networks to actually function.
        jradd 12y ago
        This hits too close too home.
  - shawn-furyan 12y ago
    I don't think that the first statement is correct. OpenBSD is not nearly so visible as RSA, Norton, Verisign, et. al., and those brands are heavily invested in the theatrical aspects of security to the point of emphasizing appearances over actual security. The part of the industry that is visible to the general public, and even probably most of the technical community are brands such as those, and you can't trust them. What BSD is doing here is saying, "You know that thing that all of those brands told you [and industry, and the government] is important? It doesn't improve security at all, and so we're going to ridicule the practice so that maybe it will get a stink that travels beyond our tiny realm of influence." That's more valuable than politeness, because politeness doesn't create a stink, and OpenBSD is not well enough known to effect change without making a stink. Addendum: To summarize my view of the situation, I think that the reason that a lot of the people that we think of as "good" security people are abrasive is that it's sooo much easier and more profitable to promise security than it is to deliver it. This means that the security industry is overflowing with bullshit and bad information. Since there's so much bullshit, the "good" security people have to be very quick, curt, and categorical about labeling the bullshit since most of us are almost completely incapable of distinguishing bullshit from delicious, nutritious food, and so are all too willing to lap it up. [sorry for the grossness, but I think that this must be what the situation feels like to "good" security people] [Edit 2:31 PM CDT to add Addendum] [Edited 2:45 PM CDT for clarity]
    - Florin_Andrei 12y ago
      > RSA, Norton, Verisign, et. al., and those brands are heavily invested in the theatrical aspects of security to the point of emphasizing appearances over actual security. I think appearance over function is true ever since politics and advertising were invented.
  - ballard 12y ago
    The problem is that being abrasive without displaying a clear, correct opinion won't lead to greater influence. The latter stance is the important bit. Security projects need adversarial discussions to keep them honest, but that's a special case.
- ballard 12y ago
  Abrasiveness and being opinionated are mostly orthogonal. I think this is more of a correct opinion (to reduce whale blubber) than intentionally pissing people off.
ef47d35620c1 12y ago
That's part of the culture. It's nothing personal. Don't take it to heart if what they say offends you.
- deleted 12y ago
  [deleted]
deleted 12y ago
[deleted]
- ephemeralgomi 12y ago
  I know you're trolling, but some people might not, so I thought it might be helpful to point out that they are actually discovering and fixing vulnerabilities. For example, CVE-2010-5298: http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free...
Spooky23 12y ago
This stance is counterproductive in my eyes. Lots of security standards, including state/local government and some healthcare environments require FIPS compliance. FIPS isn't perfect, but screens out low-quality crypto implementations that most organizations lack the expertise to evaluate. Dual_EC and that ilk is obviously a serious problem, but FIPS validation addresses other pertinent problems -- like my doctor's office securing my private data with a more trivially flawed/bogus encryption implementation.
- antocv 12y ago
  Its one thing to certify a doctor and another to certify software. There are formal proofs for software. FIPS doesnt work with software, it takes 6 months just to pass the process?? What does FIPS mean if after the 6th month another heartbleed is found? FIPS remains but the product is useless.
- danielweber 12y ago
  As they said, someone else is perfectly free (it's a BSD license) to use their work to build a libfips.
- x0x0 12y ago
  Nonsense. What would you do if you where the NSA and you've now been repeatedly caught lying, bribing (RSA dual ec), and backdooring (dual ec) security software? At this point, you have a problem: working for the nsa probably taints you in the eyes of many, and nobody (rightly) trust you. But what nation states do have is money and bribery. So you do two things: you attempt to subvert (oh, your brother got busted for dui? We know the judge and can make those charges go away or he can do a dime in state; feeling cooperative now?) developers, and you can do your best to make the code shit and as complex as possible in the hopes that if it's awful enough, somewhere in there is a security issue. Since you can afford to buy as many devs as needed, you can probably find them. I saw the phrase coined on here and unfortunately don't recall the source, but the future of backdoors is probably bugdoors. So Libressl -- rip out shit code, reduce complexity, remove unnecessary algorithms and implementations to further remove complexity -- is the necessary fix. Every option in a program increases net complexity, typically in a factorial manner, and complicates testing. What we need is simple, tested, secure code that handles the minimal use cases for web browsers and web servers. It doesn't need to support dead oses, dead compilers, or the government's wish list of complexity inducing certifications.
forgottenpass 12y ago
The OpenBSD people sure are abrasive I've said it before, all "opinionated software" is abrasive, the scale is really how much you notice it based on if you like the faces and decisions involved. It'd be non-controversial to the HN crowd, but there are plenty of developers are happy to trash any GPL/share-alike project on the same grounds.
- ternaryoperator 12y ago
  >all "opinionated software" is abrasive I don't know you, so this is not directed at you. However, this is the kind of line I hear from abrasive people defending their unwillingness to temper what they say. It's perfectly possible to have opinionated software (take JUnit or TeX, for example) that simply performs its task in an opinionated way without its authors belittling competitors or being disrespectful to others whose work doesn't fulfill their view of how things should be.
personZ 12y ago
but they deserve a ton of praise for taking on a tough task that no one else was willing to do There seemed to be some serious momentum behind getting proper resources and financing in place for a real effort that the project deserves, but all of that dissolved when this team started making a lot of sound and fury about their fork of something purportedly "beyond fixing". Aside from several incidents of spite-driven commits that were simply wrong (and dangerous), it is unfortunate that so many people who worked so hard on such an important project are treated so poorly, everyone rushing to condemn the code as was.
- dwc 12y ago
  I tend to think the reason that support dissolved was that many people, myself included, think OpenBSD will do a better job of responsible maintenance. I have no good reason to think throwing money at OpenSSL would actually improve anything that matters. Much more likely we'd just get more of what we've been getting.
deleted 12y ago
[deleted]
_pmf_ 12y ago
"Fixing" it in a way that guarantees that the changes will not be pulled back into OpenSSL has the following problems: * the fork will lag behind when new features are introduced into OpenSSL * the fork will lag behind when new fixes for OpenSSL are implemented This creates a permanent maintenance burden for the LibreSSL maintainers; sure they have attention now, but in 3 months nobody will give a shit any more.
- rlpb 12y ago
  Unless the rest of the world switches to using LibreSSL by default, (eg. for security reasons). Then the situation could reverse. Given the state of the OpenSSL codebase, I think this has a greater chance of happening than most other forks.
- _cipher_ 12y ago
  > "Fixing" it in a way that guarantees that the changes will not be pulled back into OpenSSL has the following problems: > * the fork will lag behind when new features are introduced into OpenSSL > * the fork will lag behind when new fixes for OpenSSL are implemented > This creates a permanent maintenance burden for the LibreSSL maintainers; sure they have attention now, but in 3 months nobody will give a shit any more. So, it's gonna be apache all over again. Where they maintained their own fork, with no security patches applied. Or perhaps like OpenSSH, where a linux user is forced to `./configure && make && make install'. I'm trusting your opinion, after careful reviewing of all your commits. :) /irony off

shawn-furyan 12y ago

I've got to say that I like the abrasiveness. The security industry is rife with imposters and pretenders. All of the artifice and bogus claims make it very easy for people, organizations, industries... hell, governments to be misled into devoting huge amounts of resources into propping up what amounts to security theater, which is generally actively harmful. Abrasiveness and a willingness to ruffle the feathers of purveyors of bogus security is a public service.

danielweber 12y ago
There is hardly a shortage of abrasiveness in the security industry. That said, I find zero things wrong with OpenBSD's work to make LibreSSL. If anyone doesn't like it, I'll offer them their money back.
- higherpurpose 12y ago
  "Fortunately" (and I don't mean to encourage it), the abrasive people in the crypto community are like that when they tend to be right - and don't want "newbies" to do stupid dangerous mistakes, so their tone comes out a little aggressive by default. But yeah, it could be improved. The community should work together on solving issues the right way.
  - _delirium 12y ago
    Fortunately or unfortunately, there are also a reasonable number of abrasive people who tend not to be right, so I'm not sure it's a good marker either way. There's a whole rock-star persona around people who make consulting careers out of trying to position themselves as security badasses, and not all of them are.
    - newman314 12y ago
      I include amongst these, security/network guys that disable ICMP because they read it in a book somewhere. Leads to a lot of facepalming when you are actually trying to get something done.
      - ghshephard 12y ago
        Particularly now that ICMP is actually a requirement for IPv6 networks to actually function.
      - jradd 12y ago
        This hits too close too home.
- shawn-furyan 12y ago
  I don't think that the first statement is correct. OpenBSD is not nearly so visible as RSA, Norton, Verisign, et. al., and those brands are heavily invested in the theatrical aspects of security to the point of emphasizing appearances over actual security. The part of the industry that is visible to the general public, and even probably most of the technical community are brands such as those, and you can't trust them. What BSD is doing here is saying, "You know that thing that all of those brands told you [and industry, and the government] is important? It doesn't improve security at all, and so we're going to ridicule the practice so that maybe it will get a stink that travels beyond our tiny realm of influence." That's more valuable than politeness, because politeness doesn't create a stink, and OpenBSD is not well enough known to effect change without making a stink. Addendum: To summarize my view of the situation, I think that the reason that a lot of the people that we think of as "good" security people are abrasive is that it's sooo much easier and more profitable to promise security than it is to deliver it. This means that the security industry is overflowing with bullshit and bad information. Since there's so much bullshit, the "good" security people have to be very quick, curt, and categorical about labeling the bullshit since most of us are almost completely incapable of distinguishing bullshit from delicious, nutritious food, and so are all too willing to lap it up. [sorry for the grossness, but I think that this must be what the situation feels like to "good" security people] [Edit 2:31 PM CDT to add Addendum] [Edited 2:45 PM CDT for clarity]
  - Florin_Andrei 12y ago
    > RSA, Norton, Verisign, et. al., and those brands are heavily invested in the theatrical aspects of security to the point of emphasizing appearances over actual security. I think appearance over function is true ever since politics and advertising were invented.
- ballard 12y ago
  The problem is that being abrasive without displaying a clear, correct opinion won't lead to greater influence. The latter stance is the important bit. Security projects need adversarial discussions to keep them honest, but that's a special case.
ballard 12y ago
Abrasiveness and being opinionated are mostly orthogonal. I think this is more of a correct opinion (to reduce whale blubber) than intentionally pissing people off.

ef47d35620c1 12y ago

That's part of the culture. It's nothing personal. Don't take it to heart if what they say offends you.

deleted 12y ago
[deleted]

deleted 12y ago

[deleted]

ephemeralgomi 12y ago
I know you're trolling, but some people might not, so I thought it might be helpful to point out that they are actually discovering and fixing vulnerabilities. For example, CVE-2010-5298: http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free...

Spooky23 12y ago

This stance is counterproductive in my eyes. Lots of security standards, including state/local government and some healthcare environments require FIPS compliance. FIPS isn't perfect, but screens out low-quality crypto implementations that most organizations lack the expertise to evaluate. Dual_EC and that ilk is obviously a serious problem, but FIPS validation addresses other pertinent problems -- like my doctor's office securing my private data with a more trivially flawed/bogus encryption implementation.

antocv 12y ago
Its one thing to certify a doctor and another to certify software. There are formal proofs for software. FIPS doesnt work with software, it takes 6 months just to pass the process?? What does FIPS mean if after the 6th month another heartbleed is found? FIPS remains but the product is useless.
danielweber 12y ago
As they said, someone else is perfectly free (it's a BSD license) to use their work to build a libfips.
x0x0 12y ago
Nonsense. What would you do if you where the NSA and you've now been repeatedly caught lying, bribing (RSA dual ec), and backdooring (dual ec) security software? At this point, you have a problem: working for the nsa probably taints you in the eyes of many, and nobody (rightly) trust you. But what nation states do have is money and bribery. So you do two things: you attempt to subvert (oh, your brother got busted for dui? We know the judge and can make those charges go away or he can do a dime in state; feeling cooperative now?) developers, and you can do your best to make the code shit and as complex as possible in the hopes that if it's awful enough, somewhere in there is a security issue. Since you can afford to buy as many devs as needed, you can probably find them. I saw the phrase coined on here and unfortunately don't recall the source, but the future of backdoors is probably bugdoors. So Libressl -- rip out shit code, reduce complexity, remove unnecessary algorithms and implementations to further remove complexity -- is the necessary fix. Every option in a program increases net complexity, typically in a factorial manner, and complicates testing. What we need is simple, tested, secure code that handles the minimal use cases for web browsers and web servers. It doesn't need to support dead oses, dead compilers, or the government's wish list of complexity inducing certifications.

forgottenpass 12y ago

The OpenBSD people sure are abrasive I've said it before, all "opinionated software" is abrasive, the scale is really how much you notice it based on if you like the faces and decisions involved. It'd be non-controversial to the HN crowd, but there are plenty of developers are happy to trash any GPL/share-alike project on the same grounds.

ternaryoperator 12y ago
>all "opinionated software" is abrasive I don't know you, so this is not directed at you. However, this is the kind of line I hear from abrasive people defending their unwillingness to temper what they say. It's perfectly possible to have opinionated software (take JUnit or TeX, for example) that simply performs its task in an opinionated way without its authors belittling competitors or being disrespectful to others whose work doesn't fulfill their view of how things should be.

personZ 12y ago

but they deserve a ton of praise for taking on a tough task that no one else was willing to do There seemed to be some serious momentum behind getting proper resources and financing in place for a real effort that the project deserves, but all of that dissolved when this team started making a lot of sound and fury about their fork of something purportedly "beyond fixing". Aside from several incidents of spite-driven commits that were simply wrong (and dangerous), it is unfortunate that so many people who worked so hard on such an important project are treated so poorly, everyone rushing to condemn the code as was.

dwc 12y ago
I tend to think the reason that support dissolved was that many people, myself included, think OpenBSD will do a better job of responsible maintenance. I have no good reason to think throwing money at OpenSSL would actually improve anything that matters. Much more likely we'd just get more of what we've been getting.

deleted 12y ago

[deleted]

_pmf_ 12y ago

"Fixing" it in a way that guarantees that the changes will not be pulled back into OpenSSL has the following problems: * the fork will lag behind when new features are introduced into OpenSSL * the fork will lag behind when new fixes for OpenSSL are implemented This creates a permanent maintenance burden for the LibreSSL maintainers; sure they have attention now, but in 3 months nobody will give a shit any more.

rlpb 12y ago
Unless the rest of the world switches to using LibreSSL by default, (eg. for security reasons). Then the situation could reverse. Given the state of the OpenSSL codebase, I think this has a greater chance of happening than most other forks.
_cipher_ 12y ago
> "Fixing" it in a way that guarantees that the changes will not be pulled back into OpenSSL has the following problems: > * the fork will lag behind when new features are introduced into OpenSSL > * the fork will lag behind when new fixes for OpenSSL are implemented > This creates a permanent maintenance burden for the LibreSSL maintainers; sure they have attention now, but in 3 months nobody will give a shit any more. So, it's gonna be apache all over again. Where they maintained their own fork, with no security patches applied. Or perhaps like OpenSSH, where a linux user is forced to `./configure && make && make install'. I'm trusting your opinion, after careful reviewing of all your commits. :) /irony off