6 ms·

LibreSSL – the first 30 days

76 points by lysium 12y ago

alexnewman 12y ago
Worth watching http://www.youtube.com/watch?v=GnBbhXBDmwU http://www.youtube.com/watch?v=GnBbhXBDmwU
jocmeh 12y ago
It's even worse than I thought it was. Lots worse. Amazing job by the OpenBSD guys though.
jcr 12y ago
Previous discussion from yesterday: https://news.ycombinator.com/item?id=7761041 https://news.ycombinator.com/item?id=7761041
- lysium 12y ago
  Thank you for the link; I've searched for the submission, but obviously not thoroughly enough.
alwillis 12y ago
Thanks for putting in the time and effort. It makes we wonder the state of other code we rely on from that era.
- cschmidt 12y ago
  Yes, if it was the custom malloc that allowed memory issues to go undetected, what else is doing that?
  - SwellJoe 12y ago
    The Squid codebase had a custom malloc in it for a while for some operating systems, but on systems with competent malloc it used the OS implementation. I doubt that malloc remains today (I believe Squid has been somewhat rewritten in C++, with a more modern approach to memory allocation, since I was working on it). There was a time about 15 years ago, when many UNIX variants had sub-optimal malloc, or other core libraries, and custom implementations were common in large Open Source projects (as well as commercial products). Those operating systems are mostly gone (Solaris remains, kinda, and there's still some big iron running those old beasts), but I haven't seen a newish project using a custom malloc or other core library in years. I couldn't name the projects that made that choice back then, but I remember seeing it very frequently, when I used to read a lot more C source than I do, today.
    - Someone 12y ago
      Webkit has a custom allocator. See http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/bmalloc.h http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., and, via, http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/Cache.cpp http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/VMAllocate.h http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., which seems to use mmap and a SYSCALL macro. That doesn't seem to build on the system's alloc. According to https://www.webkit.org/quality/leakhunting.html https://www.webkit.org/quality/leakhunting.html, it may even have multiple ones: "Get a fresh WebKit build, ideally a Debug build as this turns off the various custom allocators in WebKit." It wouldn't surprise me to find custom allocations in many other large projects that may be memory constrained (postgres, open office, gcc, clang, you name it) at some size, the extra burden of a custom allocator isn't that large relative to the size of a project.
      - chrisrohlf 12y ago
        Yes, exactly this. Many large programs have custom allocators for performance and most of them are simple primitives built on top of chunked up pages returned by mmap/VirtualAlloc. The examples of this are all over. This obsession with shaming the OpenSSL developers for wrapping malloc is approaching unhealthy levels.
  - chrisrohlf 12y ago
    Im not sure why this misunderstanding of the code continues to persist. It is not a custom malloc. It is a custom API for reusing chunks of a specific size previously returned by malloc.
XorNot 12y ago
So, this is just like a bazillion jpegs of a powerpoint presentation? Why not send it to a PDF printer and cutdown that filesize (and not make it take an age to open in a browser)?
- dudus 12y ago
  I believe the reason can be seen on: http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.html http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.htm... "This page scientifically designed to annoy web hipsters"
- Spittie 12y ago
  > and not make it take an age to open in a browser The whole page is ~484kb, which in this day is not much at all (many pages serve more css than that). I do like to complain about big pages as well, but I can't say this is one of those. But I agree, a pdf would be sweet. My biggest complain with the site is that it doesn't work great on a mobile device (very small links, can't press on a slide to go to the next, and Firefox mobile open the page in "full size" mode with only half a slide visible without zooming back).
  - XorNot 12y ago
    Whole page yes - try clicking on those slides to browse through them at readable size. You still get "stutter->load".
voidlogic 12y ago
Wow, OpenSSL smells so bad, I don't even really trust LibreSSL, at least not for a few years. This is no fault of the great devs trying to clean it up, but more a reflection of how I feel about anything security essential being written in C with a day 1 focus on security. I personally will stay on the path of using the Go built-in SSL library. Sure there are theoretical issues, but no real ones, I trust that real ones will be handled promptly as they appear and everything is well reviewed and unit tested (and of course is written in a memory safe language). I realize this isn’t an option for the non-gophers, but for gophers... yeah. Maybe when Go (hopefully soon) can be compiled to shared libraries this will be an option for non-Go projects. These guys are doing heroic work, kudos to them. This is not garbage I would want to have to take out.
- voidlogic 12y ago
  I'm a little surprised at the down votes as I don't think anything I said was factually incorrect.. are people offended that I think writing something like an SSL library in C is a bad idea perhaps?
  - voltagex_ 12y ago
    It's possibly because the Go libraries are much newer, although age didn't help OpenSSL in this case.
  - binarycrusader 12y ago
    They're dismissive of your comments because you don't understand that most OS systems programming realistically has to be done in C. If you want to create a library like OpenSSL that every consumer in every language can use, C is your only practical choice.
    - wtetzner 12y ago
      Well, hopefully in the not-too-distant future, Rust will be a good choice for these kinds of projects.
dudus 12y ago
Maybe it's time to put a kickstarter page up for this stuff
orik 12y ago
If OpenSSL software foundation is a for profit operation, why are tech companies funding it(1) instead of LibreSSL? 1: http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ http://arstechnica.com/information-technology/2014/04/tech-g...
iopq 12y ago
Thank you for this. I already forgot how the Internet looked like in the 90s.

76 points by lysium 12y ago

alexnewman 12y ago

Worth watching http://www.youtube.com/watch?v=GnBbhXBDmwU http://www.youtube.com/watch?v=GnBbhXBDmwU

jocmeh 12y ago

It's even worse than I thought it was. Lots worse. Amazing job by the OpenBSD guys though.

jcr 12y ago

Previous discussion from yesterday: https://news.ycombinator.com/item?id=7761041 https://news.ycombinator.com/item?id=7761041

lysium 12y ago
Thank you for the link; I've searched for the submission, but obviously not thoroughly enough.

alwillis 12y ago

Thanks for putting in the time and effort. It makes we wonder the state of other code we rely on from that era.

cschmidt 12y ago
Yes, if it was the custom malloc that allowed memory issues to go undetected, what else is doing that?
- SwellJoe 12y ago
  The Squid codebase had a custom malloc in it for a while for some operating systems, but on systems with competent malloc it used the OS implementation. I doubt that malloc remains today (I believe Squid has been somewhat rewritten in C++, with a more modern approach to memory allocation, since I was working on it). There was a time about 15 years ago, when many UNIX variants had sub-optimal malloc, or other core libraries, and custom implementations were common in large Open Source projects (as well as commercial products). Those operating systems are mostly gone (Solaris remains, kinda, and there's still some big iron running those old beasts), but I haven't seen a newish project using a custom malloc or other core library in years. I couldn't name the projects that made that choice back then, but I remember seeing it very frequently, when I used to read a lot more C source than I do, today.
  - Someone 12y ago
    Webkit has a custom allocator. See http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/bmalloc.h http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., and, via, http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/Cache.cpp http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/VMAllocate.h http://trac.webkit.org/browser/trunk/Source/bmalloc/bmalloc/..., which seems to use mmap and a SYSCALL macro. That doesn't seem to build on the system's alloc. According to https://www.webkit.org/quality/leakhunting.html https://www.webkit.org/quality/leakhunting.html, it may even have multiple ones: "Get a fresh WebKit build, ideally a Debug build as this turns off the various custom allocators in WebKit." It wouldn't surprise me to find custom allocations in many other large projects that may be memory constrained (postgres, open office, gcc, clang, you name it) at some size, the extra burden of a custom allocator isn't that large relative to the size of a project.
    - chrisrohlf 12y ago
      Yes, exactly this. Many large programs have custom allocators for performance and most of them are simple primitives built on top of chunked up pages returned by mmap/VirtualAlloc. The examples of this are all over. This obsession with shaming the OpenSSL developers for wrapping malloc is approaching unhealthy levels.
- chrisrohlf 12y ago
  Im not sure why this misunderstanding of the code continues to persist. It is not a custom malloc. It is a custom API for reusing chunks of a specific size previously returned by malloc.

XorNot 12y ago

So, this is just like a bazillion jpegs of a powerpoint presentation? Why not send it to a PDF printer and cutdown that filesize (and not make it take an age to open in a browser)?

dudus 12y ago
I believe the reason can be seen on: http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.html http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.htm... "This page scientifically designed to annoy web hipsters"
Spittie 12y ago
> and not make it take an age to open in a browser The whole page is ~484kb, which in this day is not much at all (many pages serve more css than that). I do like to complain about big pages as well, but I can't say this is one of those. But I agree, a pdf would be sweet. My biggest complain with the site is that it doesn't work great on a mobile device (very small links, can't press on a slide to go to the next, and Firefox mobile open the page in "full size" mode with only half a slide visible without zooming back).
- XorNot 12y ago
  Whole page yes - try clicking on those slides to browse through them at readable size. You still get "stutter->load".

voidlogic 12y ago

Wow, OpenSSL smells so bad, I don't even really trust LibreSSL, at least not for a few years. This is no fault of the great devs trying to clean it up, but more a reflection of how I feel about anything security essential being written in C with a day 1 focus on security. I personally will stay on the path of using the Go built-in SSL library. Sure there are theoretical issues, but no real ones, I trust that real ones will be handled promptly as they appear and everything is well reviewed and unit tested (and of course is written in a memory safe language). I realize this isn’t an option for the non-gophers, but for gophers... yeah. Maybe when Go (hopefully soon) can be compiled to shared libraries this will be an option for non-Go projects. These guys are doing heroic work, kudos to them. This is not garbage I would want to have to take out.

voidlogic 12y ago
I'm a little surprised at the down votes as I don't think anything I said was factually incorrect.. are people offended that I think writing something like an SSL library in C is a bad idea perhaps?
- voltagex_ 12y ago
  It's possibly because the Go libraries are much newer, although age didn't help OpenSSL in this case.
- binarycrusader 12y ago
  They're dismissive of your comments because you don't understand that most OS systems programming realistically has to be done in C. If you want to create a library like OpenSSL that every consumer in every language can use, C is your only practical choice.
  - wtetzner 12y ago
    Well, hopefully in the not-too-distant future, Rust will be a good choice for these kinds of projects.

dudus 12y ago

Maybe it's time to put a kickstarter page up for this stuff

orik 12y ago

If OpenSSL software foundation is a for profit operation, why are tech companies funding it(1) instead of LibreSSL? 1: http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ http://arstechnica.com/information-technology/2014/04/tech-g...

iopq 12y ago

Thank you for this. I already forgot how the Internet looked like in the 90s.