3 ms·

I don't even really understand what this is saying. Is it a critique that LibreSSL faces undue criticism? Probably, everyone was running around yelling about l

I don't even really understand what this is saying. Is it a critique that LibreSSL faces undue criticism? Probably, everyone was running around yelling about libressl security like a chicken with it's head chopped off. It's a brand new fork under heavy development that just started compiling on Linux a few days prior. What, did people expect it to be production-ready just because OpenSSL is? it seems to me, as an opportunistic venture to take the meager funding and attention away from OpenSSL during its time of crisis If we're making claims of bad faith, lets go with a much less conspiratorial thought: Some blogger oversold a bug they found because they wanted the self promotion of finding a security-related bug in the thing seen as OpennSSL done right built the guys that take security seriously. Sure, that's not a charitable reading of events, so I don't subscribe to it myself. But, where is the openbsd mailing list report of this bug before the blog post went up? If he went to the mailing list first, it would have solved faster and without unnecessary commotion. Everything written on LibreSSL's linux port is infuriating. It's no surprise that openbsd is seen as insular and hard to work with. They're misinterpreted, misrepresented, and have really weird expectations set of them by people that don't even run openbsd. If I worked on openbsd I'd be real ornery too!

personZ 12y ago
If we're making claims of bad faith, lets go with a much less conspiratorial thought: Some blogger oversold a bug they found because they wanted the self promotion of finding a security-related bug in the thing seen as OpennSSL done right built the guys that take security seriously. Probably true, though that's of the "live by the sword" variety. It's like being a grammar critic: one had better exercise perfect grammar or expect to hear about it. One of the major talking points of the LibreSSL initiative is a 4 year old bug in OpenSSL if you use a non-standard, non-default mode and multithread access. There are zero demonstrated exploits of it, it is by most analysis at most responsible for dropped connections, so it is far less concerning than even this "oversold" bug. That is the bug that the LibreSSL team always talks about, railing about a "critical security vulnerability that sat unfixed for 4 years". It has been referenced multiple times throughout this discussion. So again, what goes around comes around. Someone criticized a product that claims to be version 2.0, and which is based on long-proven, long-existing code, and found a pretty extraordinary fault that looped back to the LibreSSL team simply removing functionality they didn't think was relevant. Alright, in reality it just isn't a big deal, but it is what a team sets themselves up for when they criticize others with seeming impunity.
- forgottenpass 12y ago
  "live by the sword" You keep saying that as if their hubris gives others a free pass on how they represent or respond to open bsd. To me, jumping on them just looks hollow and petty.

personZ 12y ago

If we're making claims of bad faith, lets go with a much less conspiratorial thought: Some blogger oversold a bug they found because they wanted the self promotion of finding a security-related bug in the thing seen as OpennSSL done right built the guys that take security seriously. Probably true, though that's of the "live by the sword" variety. It's like being a grammar critic: one had better exercise perfect grammar or expect to hear about it. One of the major talking points of the LibreSSL initiative is a 4 year old bug in OpenSSL if you use a non-standard, non-default mode and multithread access. There are zero demonstrated exploits of it, it is by most analysis at most responsible for dropped connections, so it is far less concerning than even this "oversold" bug. That is the bug that the LibreSSL team always talks about, railing about a "critical security vulnerability that sat unfixed for 4 years". It has been referenced multiple times throughout this discussion. So again, what goes around comes around. Someone criticized a product that claims to be version 2.0, and which is based on long-proven, long-existing code, and found a pretty extraordinary fault that looped back to the LibreSSL team simply removing functionality they didn't think was relevant. Alright, in reality it just isn't a big deal, but it is what a team sets themselves up for when they criticize others with seeming impunity.

forgottenpass 12y ago
"live by the sword" You keep saying that as if their hubris gives others a free pass on how they represent or respond to open bsd. To me, jumping on them just looks hollow and petty.