2 ms·

You try to make the free software project look like an obnoxious enterprise that would exploit a time of uncertainty to show off and bolster their status, for r

by personZ 12y ago

You try to make the free software project look like an obnoxious enterprise that would exploit a time of uncertainty to show off and bolster their status, for revenue. During the wide media exposure of OpenSSL's heartbleed vulnerability, Theo quite cleverly forked off LibreSSL, started a campaign for funding, and aggressively and viciously attacked the existing codebase. http://arstechnica.com/information-technology/2014/04/openssl-code-beyond-repair-claims-creator-of-libressl-fork/ http://arstechnica.com/information-technology/2014/04/openss... Yes, it absolutely appears to be exploiting uncertainty for their own benefit. Both in exposure and status ("I'm here to save the day"), but also in funding. Theo, and I assume others, are paid by such funding, so it isn't quite so benevolent. Sticking "free software" in the description doesn't suddenly remove all normal human motivations.

Aqueous 12y ago
Yep - they could have just easily acted like team players instead of egoistic contrarians and joined efforts with the OpenSSL team to help improve OpenSSL along with the original developers. If they did that you'd probably see a lot less criticism today. Instead, they chose to be assholes - and this is their come-uppance. Nothing says "This codebase is beyond repair" quite like forking a codebase and repairing it.
- vezzy-fnord 12y ago
  Acting like a team player doesn't get shit done. That's not how human relations in free software development work. The improvements of OpenSSL that the LibreSSL team envisioned required such massive code overhauls and deletion of legacy functionality, plus certain modules for FIPS support that were detrimental to security, that there was likely no way to do it all upstream.
  - deleted 12y ago
    [deleted]
clarry 12y ago
So you choose to ignore the history of a project which has had security as one of its top goals since around when the project was born. You choose to ignore the fact that these people have in the past fixed or removed lots of bad code (even using mean words in commit messages and possibly on the mailing lists) because that is in line with their goals. Attacking bad code is in line with their goals, and that is what they have done for almost 20 years. If they do not do it, the goal of being the most secure operating system is unattainable. So when the media interviews Theo about it, is Theo being the attention whore? Did Theo offend you somehow? Did you read the article you linked? I did not make this decision... in our larger development group, it made itself. You willfully choose to ignore reality and interpret it against the OpenBSD project. Why all the hate? They are trying to make better software. And everyone does benefit (so long as OpenBSD stays afloat, which costs money). Maybe you should look for origins of libressl, and also watch Bob's talk, which was mentioned here.

by personZ 12y ago

Aqueous 12y ago

Yep - they could have just easily acted like team players instead of egoistic contrarians and joined efforts with the OpenSSL team to help improve OpenSSL along with the original developers. If they did that you'd probably see a lot less criticism today. Instead, they chose to be assholes - and this is their come-uppance. Nothing says "This codebase is beyond repair" quite like forking a codebase and repairing it.

vezzy-fnord 12y ago
Acting like a team player doesn't get shit done. That's not how human relations in free software development work. The improvements of OpenSSL that the LibreSSL team envisioned required such massive code overhauls and deletion of legacy functionality, plus certain modules for FIPS support that were detrimental to security, that there was likely no way to do it all upstream.
- deleted 12y ago
  [deleted]

clarry 12y ago

So you choose to ignore the history of a project which has had security as one of its top goals since around when the project was born. You choose to ignore the fact that these people have in the past fixed or removed lots of bad code (even using mean words in commit messages and possibly on the mailing lists) because that is in line with their goals. Attacking bad code is in line with their goals, and that is what they have done for almost 20 years. If they do not do it, the goal of being the most secure operating system is unattainable. So when the media interviews Theo about it, is Theo being the attention whore? Did Theo offend you somehow? Did you read the article you linked? I did not make this decision... in our larger development group, it made itself. You willfully choose to ignore reality and interpret it against the OpenBSD project. Why all the hate? They are trying to make better software. And everyone does benefit (so long as OpenBSD stays afloat, which costs money). Maybe you should look for origins of libressl, and also watch Bob's talk, which was mentioned here.