6 ms·

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyo

Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating system (they lead, others followed), the entire team deserves to be well-off dicks. It's to me the ultimate highlight of OSS's funding problem. People make millions/billions of dollars off of this software, and nobody ever contributes any of that back to the shoulders they stood on to make that happen.

tedivm 12y ago
Personally I think two healthy forks of OpenSSL is far, far better than one. I also think that the OpenBSD team is going to take some time before it reaches it's goals, and more importantly before it's in a stable enough point where people can start working on porting their version to other platforms. I don't think it makes sense to leave OpenSSL to wither while that happens, especially since it's an actively used product. That being said I'm far, far more confident in the OpenBSD team than I am the OpenSSL one.
Touche 12y ago
Actually if I'm giving someone a donation, charity, then whether they are or are not a dick is a perfectly valid part of the decision. And to me how you run a project is as important as the quality of the final result.
- pessimizer 12y ago
  You don't have to have a reason to not donate to something, so the color of their shoes is also a perfectly valid part of the decision. The important question is whether it's a good reason. If you rank the style of his speech as a more important issue than having secure software (unless you think that the style of speech will negatively effect the software), I'd wonder how a single person's personality got so high on your list of priorities. It sounds a bit like voting for a president because he's the guy you feel you'd most enjoy having a beer with: short-sighted.
  - vidarh 12y ago
    If you think that Theo's abrasiveness will affect the success of LibreSSL as a project, then it is is relevant. It is naive and shortsighted to dismiss non-technical reasons. Often they can be as important as the technical reasons, or even more.
Florin_Andrei 12y ago
> And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. Yeah, but people who give money usually tend to see that as a valid reason.
- angersock 12y ago
  Seems to have worked out for Torvalds and good chunks of the Web ecosystem.
  - akerl_ 12y ago
    Most of the "Linus being a dick" examples are him being a dick to developers, and several of those cases are "him being a dick to developers because they did something that affects users". That's the kind of thing that's good for PR more than bad for it, because when Linus rages at a developer for breaking things, a large portion of users think "Linus has my back".
    - gnuvince 12y ago
      And that's not the case with Theo?
      - Florin_Andrei 12y ago
        Oh, c'mon, give it a rest. Linus, while not necessarily mild-mannered, "gets" people. Theo sounds a lot like a socially clueless ubergeek. They are both abrasive superficially, but Linus is aware of the "meta", or strategic, level in human interactions, and knows when to back off; Theo is blind to it. That much is obvious even from a cursory glance.
- dfc 12y ago
  Theo's "outspokeness" is believed to be the reason that DARPA canceled a million dollar development grant. https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_cancellation https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_ca...
jmdn28 12y ago
That reminds me of TrueCrypt and the TrueCrypt Audit Project.
mhurron 12y ago
> Just give the money to the OpenBSD team Unless OpenBSD decides to change, that is the way to fund OpenSSH. Currently you don't get to decide how your donations are spent by them, OpenSSH isn't it's own spinoff funded group.
eliteraspberrie 12y ago
Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? One reason may be that donations to the OpenBSD Foundation are not tax-deductible in the US.
lomnakkus 12y ago
Maybe I'm misremembering, but SSH wasn't crappy, it was just proprietary. (I'm no fan of proprietary software, but let's at least be honest here.)
- protomyth 12y ago
  you are correct, http://en.wikipedia.org/wiki/OpenSSH http://en.wikipedia.org/wiki/OpenSSH "OpenSSH was created by the OpenBSD team as an alternative to the original SSH software by Tatu Ylönen, which is now proprietary software. Although source code is available for the original SSH, various restrictions are imposed on its use and distribution. OpenSSH was created as a fork of Björn Grönvall's OSSH that itself was a fork of Tatu Ylönen's original free SSH 1.2.12 release, which was the last one having a license suitable for forking."
tptacek 12y ago
OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with why funds are being applied to audit and not to "just have OpenBSD rewrite everything".
- gaadd33 12y ago
  Isn't there two sets of money going towards OpenSSL? One set is for hiring 2 full time developers (which seems like the money that should go towards OpenBSD) and then the other set is going to OCAP for a security audit.
- sigzero 12y ago
  I would trust Theo's team over the OpenSSL team any day of the week.
  - tptacek 12y ago
    That's great, but neither LibreSSL nor the Linux Foundation open audit project has anything whatsoever to do with the OpenSSL team.
  - deleted 12y ago
    [deleted]
- marcosdumay 12y ago
  A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs. A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography. Anyway, they should send money to both. Both are important, and those companies make so much money using free software, they shouldn't be choosing the projects with that fine granularity. The problem is that they won't, and as much as kyledrake does not like the answer, it's because of Theo. Yes, it's a stupid decision, but it does not make it less real.
avar 12y ago
Is it possible to give them more granular donations? I want to support OpenSSH and LibreSSL, but I don't cae about OpenBSD. The reason I don't donate to them is that I feel like most of my donation will be going towards something I don't care about.
- protomyth 12y ago
  Its one and the same, plus if you care about LibreSSL and OpenSSH than you need to care about OpenBSD because of the assumptions that code makes and what needs to added to the ported code to make it safe on other platforms.
  - gonzo 12y ago
    Horse feathers. Consider that ntp.org is being funded, not OpenBSD (and their inferior OpenNTP). NTP is infrastructure. OpenBSD is not. Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project). OpenSSL is infrastructure. OpenSSH got some funding, because it is widely used. It is infrastructure, not 3-5 people scratching an itch in a project.
    - protomyth 12y ago
      > Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project). > OpenSSH got some funding, because it is widely used. It is infrastructure, not 3-5 people scratching an itch in a project. I'm not sure what to say as I think you missed my point by a mile. Giving money to OpenSSH or LibreSSL is giving money to OpenBSD, it is the same people and same foundation. OpenSSH and, now, LibreSSL are project written to OpenBSD first and then ported. Ported platforms that don't have the libraries these projects expect (which are developed for OpenBSD) have those functions ported[1]. They are the same project with parts ported to other platforms. I have no clue what the 3-5 people comment is even about. 1) with some exceptions such as generation of entropy since only the OS can do that well.
rodgerd 12y ago
> Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? Given their work is avowdly OpenBSD-only and portability has to be added on in the case of e.g. OpenSSH it would seem a dead-end for anyone who wants broader platform support.
- protomyth 12y ago
  Strange characterization given OpenSSH is everywhere so it isn't a dead-end.
- axman6 12y ago
  They've explicitly said that they are seeking to reduce the surface area for bugs by initially removing cross platform compatibility, and then exposing what primitives the OS needs to supply to make it possible to port. This seems like a much much saner approach to me than trying to work through every quirk in every operating system known to man in the one project itself. Any OS that doesn't implement any of the primitives can legally go and take OpenBSD's implementation and use it if necessary (and hopefully contribute money or code back to them). I'm not sure why you brought up OpenSSH, since it's by far the most widely used SSh implementation in the world...
  - XorNot 12y ago
    The point is that no one wants to fund a team who won't produce a final working product for the system they're running. Linux Foundation wants things which run on Linux. Trying to figure out how you fund the BSD version + porting effort leads to a weird incentive scheme.

tedivm 12y ago

Personally I think two healthy forks of OpenSSL is far, far better than one. I also think that the OpenBSD team is going to take some time before it reaches it's goals, and more importantly before it's in a stable enough point where people can start working on porting their version to other platforms. I don't think it makes sense to leave OpenSSL to wither while that happens, especially since it's an actively used product. That being said I'm far, far more confident in the OpenBSD team than I am the OpenSSL one.

Touche 12y ago

Actually if I'm giving someone a donation, charity, then whether they are or are not a dick is a perfectly valid part of the decision. And to me how you run a project is as important as the quality of the final result.

pessimizer 12y ago
You don't have to have a reason to not donate to something, so the color of their shoes is also a perfectly valid part of the decision. The important question is whether it's a good reason. If you rank the style of his speech as a more important issue than having secure software (unless you think that the style of speech will negatively effect the software), I'd wonder how a single person's personality got so high on your list of priorities. It sounds a bit like voting for a president because he's the guy you feel you'd most enjoy having a beer with: short-sighted.
- vidarh 12y ago
  If you think that Theo's abrasiveness will affect the success of LibreSSL as a project, then it is is relevant. It is naive and shortsighted to dismiss non-technical reasons. Often they can be as important as the technical reasons, or even more.

Florin_Andrei 12y ago

> And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. Yeah, but people who give money usually tend to see that as a valid reason.

angersock 12y ago
Seems to have worked out for Torvalds and good chunks of the Web ecosystem.
- akerl_ 12y ago
  Most of the "Linus being a dick" examples are him being a dick to developers, and several of those cases are "him being a dick to developers because they did something that affects users". That's the kind of thing that's good for PR more than bad for it, because when Linus rages at a developer for breaking things, a large portion of users think "Linus has my back".
  - gnuvince 12y ago
    And that's not the case with Theo?
    - Florin_Andrei 12y ago
      Oh, c'mon, give it a rest. Linus, while not necessarily mild-mannered, "gets" people. Theo sounds a lot like a socially clueless ubergeek. They are both abrasive superficially, but Linus is aware of the "meta", or strategic, level in human interactions, and knows when to back off; Theo is blind to it. That much is obvious even from a cursory glance.
dfc 12y ago
Theo's "outspokeness" is believed to be the reason that DARPA canceled a million dollar development grant. https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_cancellation https://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_ca...

jmdn28 12y ago

That reminds me of TrueCrypt and the TrueCrypt Audit Project.

mhurron 12y ago

> Just give the money to the OpenBSD team Unless OpenBSD decides to change, that is the way to fund OpenSSH. Currently you don't get to decide how your donations are spent by them, OpenSSH isn't it's own spinoff funded group.

eliteraspberrie 12y ago

Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? One reason may be that donations to the OpenBSD Foundation are not tax-deductible in the US.

lomnakkus 12y ago

Maybe I'm misremembering, but SSH wasn't crappy, it was just proprietary. (I'm no fan of proprietary software, but let's at least be honest here.)

protomyth 12y ago
you are correct, http://en.wikipedia.org/wiki/OpenSSH http://en.wikipedia.org/wiki/OpenSSH "OpenSSH was created by the OpenBSD team as an alternative to the original SSH software by Tatu Ylönen, which is now proprietary software. Although source code is available for the original SSH, various restrictions are imposed on its use and distribution. OpenSSH was created as a fork of Björn Grönvall's OSSH that itself was a fork of Tatu Ylönen's original free SSH 1.2.12 release, which was the last one having a license suitable for forking."

tptacek 12y ago

OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption). "Theo's a dick" has nothing to do with why funds are being applied to audit and not to "just have OpenBSD rewrite everything".

gaadd33 12y ago
Isn't there two sets of money going towards OpenSSL? One set is for hiring 2 full time developers (which seems like the money that should go towards OpenBSD) and then the other set is going to OCAP for a security audit.
sigzero 12y ago
I would trust Theo's team over the OpenSSL team any day of the week.
- tptacek 12y ago
  That's great, but neither LibreSSL nor the Linux Foundation open audit project has anything whatsoever to do with the OpenSSL team.
- deleted 12y ago
  [deleted]
marcosdumay 12y ago
A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs. A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography. Anyway, they should send money to both. Both are important, and those companies make so much money using free software, they shouldn't be choosing the projects with that fine granularity. The problem is that they won't, and as much as kyledrake does not like the answer, it's because of Theo. Yes, it's a stupid decision, but it does not make it less real.

avar 12y ago

Is it possible to give them more granular donations? I want to support OpenSSH and LibreSSL, but I don't cae about OpenBSD. The reason I don't donate to them is that I feel like most of my donation will be going towards something I don't care about.

protomyth 12y ago
Its one and the same, plus if you care about LibreSSL and OpenSSH than you need to care about OpenBSD because of the assumptions that code makes and what needs to added to the ported code to make it safe on other platforms.
- gonzo 12y ago
  Horse feathers. Consider that ntp.org is being funded, not OpenBSD (and their inferior OpenNTP). NTP is infrastructure. OpenBSD is not. Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project). OpenSSL is infrastructure. OpenSSH got some funding, because it is widely used. It is infrastructure, not 3-5 people scratching an itch in a project.
  - protomyth 12y ago
    > Consider that OpenSSL is being funded, not OpenBSD ( and their unusable at this point libressl project). > OpenSSH got some funding, because it is widely used. It is infrastructure, not 3-5 people scratching an itch in a project. I'm not sure what to say as I think you missed my point by a mile. Giving money to OpenSSH or LibreSSL is giving money to OpenBSD, it is the same people and same foundation. OpenSSH and, now, LibreSSL are project written to OpenBSD first and then ported. Ported platforms that don't have the libraries these projects expect (which are developed for OpenBSD) have those functions ported[1]. They are the same project with parts ported to other platforms. I have no clue what the 3-5 people comment is even about. 1) with some exceptions such as generation of entropy since only the OS can do that well.

rodgerd 12y ago

> Why does everyone have this aversion to giving the OpenBSD team the funding they deserve? Given their work is avowdly OpenBSD-only and portability has to be added on in the case of e.g. OpenSSH it would seem a dead-end for anyone who wants broader platform support.

protomyth 12y ago
Strange characterization given OpenSSH is everywhere so it isn't a dead-end.
axman6 12y ago
They've explicitly said that they are seeking to reduce the surface area for bugs by initially removing cross platform compatibility, and then exposing what primitives the OS needs to supply to make it possible to port. This seems like a much much saner approach to me than trying to work through every quirk in every operating system known to man in the one project itself. Any OS that doesn't implement any of the primitives can legally go and take OpenBSD's implementation and use it if necessary (and hopefully contribute money or code back to them). I'm not sure why you brought up OpenSSH, since it's by far the most widely used SSh implementation in the world...
- XorNot 12y ago
  The point is that no one wants to fund a team who won't produce a final working product for the system they're running. Linux Foundation wants things which run on Linux. Trying to figure out how you fund the BSD version + porting effort leads to a weird incentive scheme.