3 ms·
""" A clean-room implementation of TLS v1.2 by Ashwini Oruganti (an especially timely project given recent events). It's an ambituous undertaking, but she's nar
by alexgartrell 12y ago
"""
A clean-room implementation of TLS v1.2 by Ashwini Oruganti (an especially timely project given recent events). It's an ambituous undertaking, but she's narrowing scope by focusing on designing and implementing a "TLS API for humans" and building on top of existing lower level primitives. The project will be written as part of Python's cryptography library.
"""
Not to be a hater, but nothing I've ever experienced in my career has lead me to believe something like this is possible unless you're starting with openssl. Even then, the lack of a code reviewer raises some eyebrows.
- gdb 12y agoYep, it's certainly a risky project, but I'm psyched to be able to fund it. Ashwini's proposal included a well-reasoned review and validation plan. Even if it ends up not being successful, I think she's approaching things from the right angle, and I'll be very glad that she tried.
- scrollaway 12y agoI think it's great you're funding it, and I completely agree it's a risky project. But humanity is only taken further by people with money funding risky enterprises, and in the grand scheme of things a good, clean room tls 1.2 library is absolutely an important building block of our future in computing. Keep it up.
- JoshTriplett 12y agoI would love to see a clean, narrowly scoped replacement for OpenSSL. Please choose an appropriate all-permissive, GPL-compatible license for it; the license of OpenSSL, with advertising clause, causes a huge amount of pain.
- kingkilr 12y agoSeveral of us who work on PyCA Cryptography (https://cryptography.io https://cryptography.io) will be doing code reviews (our docs outline the code review process we use).
- erikano 12y agoOff topic, but I've never seen anyone use Python docstring format to quote text like that on HN. It's actually not a bad idea.
- amirmc 12y agoMore people trying this and learning from previous mistakes (of others) is a good thing. For example, here's a TLS implementation in pure OCaml https://github.com/mirleft/ocaml-tls https://github.com/mirleft/ocaml-tls I'm glad Stripe is helping with things like this. It raises awareness of critical things we all use and encourages others to think about getting involved.