4 ms·

So... * it's broken on other platforms * they broke features in their releases (no QA/testing?) * they're making a new API based on requirements of their own

by illumen 12y ago

So... * it's broken on other platforms * they broke features in their releases (no QA/testing?) * they're making a new API based on requirements of their own programs that doesn't provide many of the OpenSSL features. * they're using CVS, no public code reviews available. There's no evidence some of the changes were reviewed by someone other than who made the commit. (OpenSSL now does reviews) * no public audit available. * they have some hateful note about hipsters on their web page as an excuse after 5 months to not make it readable. So unprofessional it hurts. * Most changes were done five months ago, with not much at all done for two months. * The test/ directory has very few changes at all. No extra tests have been added. * I can't find a release plan, architecture documentation, or any documentation a serious software project should have. (OpenSSL is working on these though) Finally... their official distribution website doesn't use SSL. That's a major security issue of the face palm variety. Not. Inspiring. Confidence. The OpenSSL project on the other hand has been doing some good work. Please see the projects road map from July to see what they are changing. https://www.openssl.org/about/roadmap.html https://www.openssl.org/about/roadmap.html

kome 12y ago
> they have some hateful note about hipsters on their web page as an excuse after 5 months to not make it readable. So unprofessional it hurts. Are you talking about this http://www.libressl.org/ http://www.libressl.org/ ? That's one of the most readable webpage ever.
- DanBC 12y ago
  On iOS the font used to be a horrible script - really hard to read. Currently it's comic sans (or a clone of it). I personally fucking love the site and wish wish wish more people would stop throwing weird stuff in websites. I do think the dig at hipsters is pointlessly antagonistic. Isn't there an evangelism guide for people in open source projects?
  - pgeorgi 12y ago
    > evangelism guide for people in open source projects There are, tons of them. OpenBSD traditionally doesn't give a fuck, and backs up that attitude by shipping solid products. Not exactly surprising given the history of the project (started by de raadt after being kicked out of NetBSD for being hard to work with). If external reviews, github pull requests and documentation galore are important to the GP, they better stop using OpenSSH, which is developed using the same unfathomable development methods as libressl.
  - masklinn 12y ago
    > On iOS the font used to be a horrible script - really hard to read. That is odd, it is perfectly readable on my phone. > Currently it's comic sans (or a clone of it). Chalkboard: http://www.identifont.com/differences?first=Comic+Sans&second=Chalkboard&q=Go http://www.identifont.com/differences?first=Comic+Sans&secon...
- hiphopyo 12y ago
  > Are you talking about this http://www.libressl.org/ http://www.libressl.org/ ? That's one of the most readable webpage ever. Oh indeed. Somebody needs to check out http://motherfuckingwebsite.com/ http://motherfuckingwebsite.com/ :-)
mmagin 12y ago
Uhh, on your final point, they have signed checksums with the releases.
- mmebane 12y ago
  > they have signed checksums with the releases Which might be OK for making sure the download isn't corrupted, but are useless for defending against an attacker, since the checksums themselves are hosted on a non-HTTPS site.
  - fluidcruft 12y ago
    Um. You can't forge signed checksums unless you have their private key...
  - erhardm 12y ago
    You're supposed to check the signature with the key you got "out of band". That means good security practice. Even if you get the key from a SSL/TLS enabled site, you can't guarantee it's the right one, CAs can be compromised. The checksum is to let you check if the download is corrupted and the signature is to check against the key you already have. Other forms of checking are just false sense of security.
    - mmebane 12y ago
      Of course. I somehow missed the signed part, and now I feel stupid.
  - xorcist 12y ago
    An attacker wouldn't MITM your download, they would take control over your mirror and serve bad copies. Hence the signatures. SSL secured downloads would be pretty much snake oil for ensuring file integrity end-to-end. You will find the same practice pretty much everywhere among the larger projects.
  - DArcMattr 12y ago
    Then there's also this: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/signify.1?query=signify&arch=i386 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...
vezzy-fnord 12y ago
* It's broken on other platforms, because those platforms are unable to provide sufficient primitives. LibreSSL directly inspired the introduction of a long-needed getrandom(2) syscall in Linux, and the LibreSSL-portable release still works on a decent number of platforms that will definitely be growing. Did you forget this is an early project? If anything, LibreSSL will ensure that other platforms get off their asses and actually do something about security, as OpenBSD has been trying to yell about for so long. * In case you missed the memo, LibreSSL wasn't stable back then (nor is it still, AFAIK). Of course things will break, it was still development releases and pre-alpha testing. You can't fix a mess without inevitably breaking someone's workflow. * They're making an API that will improve on the cruft of the old one, and actually be reasonably sane. Being agnostic of implementation internals will mean easier language bindings. They also explicitly stated it's meant to be independent of LibreSSL and can be adapted to other stacks. * Stop bikeshedding about version control. It gets old. OpenBSD has had probably the most proactive security auditing and code review practices out of any other project in nearly two decades: http://www.openbsd.org/security.html http://www.openbsd.org/security.html. Code review isn't some magic process, it's a practice that can be done using a variety of methods. No doubt independent audits will emerge as soon as LibreSSL nears sufficient finalization. The LibreSSL website is only a brochure. It's made to be "unprofessional" on purpose. The developers have a technical, no-bullshit and take-no-prisoners attitude. And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from.
- DanBC 12y ago
  > And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from. The stuff about the "hipsters" comment is not about being mean, it's about needlessly pointlessly being mean. This stuff matters. It matters because it creates division for no gain. Why not just use comic sans and make no comment? Why not use fixed-width?
  - forgottenpass 12y ago
    Why not just use comic sans and make no comment? Why not use fixed-width? It might be bad manners to spill the beans, but it's a very deliberate move. The comic sans and hipster jab let them identify the people who want to bikeshed presentation instead of content.
xnull2guest 12y ago
* Nah, the BSD guys are removing their dependency on OpenSSL, which is terribly broken for a number of reasons. They are not offering to replace OpenSSL for everyone on every platform. That's not their goal. They've said this from the beginning. But not all is lost for you (the non-BSD guy complaining that BSD codes doesn't work outside BSD). Eventually the code will make it downstream. And they've dedicated a lot of thought to how to do that in a more secure manner than OpenSSL. Inspiring. * They kept the core functionality intact. Were you going to use heartbeats over TCP? Do you know even know what it is? How many of those on-by-default-workarounds were you using? Yeah they removed features. But for crypto code the lack of a rats nest is a feature. * They are maintaining compatibility with the old API for legacy code and developing a more sane API. Do you have something constructive to say about how an API might look for interop with your favorite flavor of software? Great! To the mailing list with you! * This was a tear down of code, not a reimplementation from scratch. But yeah, I agree. People should be looking over LibreSSL much more closely than OpenSSL. Sounds like that's something you would be interested in? ;) * It's open source? And there are discussions on the mailing list? What kind of public audit did you have in mind? * Don't really think hipster comments have much to do with LibreSSL's quality? * Can you point to evidence of the claim that not much has been changed in the last two months? Can you point to things you would have liked to see change? * No extra tests are needed, as they removed features. As features get added, yeah they're going to need to add some tests. * They don't exactly sit around in conference rooms and write reports for upper management. Have you checked out their mailing list? Aren't their packages signed and CVS transported over SSL? It's not like the code/packages are compromised. Otherwise, yeah I agree. It would be nice to have secure hateful hipster notes. ;). Kidding aside there's no reason not to add SSL. They should get on that. I'm thankful that someone is doing something about OpenSSL, which is a blight. I'm sorry I can't personally afford to do more to help. Criticality is a positive thing, especially with regard to crypto/security code. But aren't you being a little smidge cynical?
- illumen 12y ago
  The claim not much has changed can be substantiated by reading the article, and by looking in CVS. Modern code review tools provide public conversation of the code in question, and allow people to sign off on it. Is LibreSSL doing this? How can I trace a change or branch to a discussion (if there are even branches)? How are others supposed to easily look into their changes? They say this is a problem in the article we are talking about with their 12,000+ line diffs. What kind of audit? The traditional kind. Like the third party one the OpenSSL people are funding. Extra tests would be good if they are rewriting functions, which according to the article is what they did past month one. Is their test plan do a release and see what happens? I can't tell, since I can't see a test plan anywhere. If you're changing a function, and not doing so with even basic tests, and are holding your development practices up as 'best practice' you are lying. I'm being cynical because I care. They aren't doing many things the OpenSSL project themselves were taken to task for. As well, the OpenSSL project has now taken on many of the practices that LibreSSL are doing, but also they're doing much more (see their roadmap https://www.openssl.org/about/roadmap.html https://www.openssl.org/about/roadmap.html). To let LibreSSL get away with being careless is kind of silly when they are holding it up as being better.
deleted 12y ago
[deleted]

by illumen 12y ago

kome 12y ago

> they have some hateful note about hipsters on their web page as an excuse after 5 months to not make it readable. So unprofessional it hurts. Are you talking about this http://www.libressl.org/ http://www.libressl.org/ ? That's one of the most readable webpage ever.

DanBC 12y ago
On iOS the font used to be a horrible script - really hard to read. Currently it's comic sans (or a clone of it). I personally fucking love the site and wish wish wish more people would stop throwing weird stuff in websites. I do think the dig at hipsters is pointlessly antagonistic. Isn't there an evangelism guide for people in open source projects?
- pgeorgi 12y ago
  > evangelism guide for people in open source projects There are, tons of them. OpenBSD traditionally doesn't give a fuck, and backs up that attitude by shipping solid products. Not exactly surprising given the history of the project (started by de raadt after being kicked out of NetBSD for being hard to work with). If external reviews, github pull requests and documentation galore are important to the GP, they better stop using OpenSSH, which is developed using the same unfathomable development methods as libressl.
- masklinn 12y ago
  > On iOS the font used to be a horrible script - really hard to read. That is odd, it is perfectly readable on my phone. > Currently it's comic sans (or a clone of it). Chalkboard: http://www.identifont.com/differences?first=Comic+Sans&second=Chalkboard&q=Go http://www.identifont.com/differences?first=Comic+Sans&secon...
hiphopyo 12y ago
> Are you talking about this http://www.libressl.org/ http://www.libressl.org/ ? That's one of the most readable webpage ever. Oh indeed. Somebody needs to check out http://motherfuckingwebsite.com/ http://motherfuckingwebsite.com/ :-)

mmagin 12y ago

Uhh, on your final point, they have signed checksums with the releases.

mmebane 12y ago
> they have signed checksums with the releases Which might be OK for making sure the download isn't corrupted, but are useless for defending against an attacker, since the checksums themselves are hosted on a non-HTTPS site.
- fluidcruft 12y ago
  Um. You can't forge signed checksums unless you have their private key...
- erhardm 12y ago
  You're supposed to check the signature with the key you got "out of band". That means good security practice. Even if you get the key from a SSL/TLS enabled site, you can't guarantee it's the right one, CAs can be compromised. The checksum is to let you check if the download is corrupted and the signature is to check against the key you already have. Other forms of checking are just false sense of security.
  - mmebane 12y ago
    Of course. I somehow missed the signed part, and now I feel stupid.
- xorcist 12y ago
  An attacker wouldn't MITM your download, they would take control over your mirror and serve bad copies. Hence the signatures. SSL secured downloads would be pretty much snake oil for ensuring file integrity end-to-end. You will find the same practice pretty much everywhere among the larger projects.
- DArcMattr 12y ago
  Then there's also this: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/signify.1?query=signify&arch=i386 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...

vezzy-fnord 12y ago

* It's broken on other platforms, because those platforms are unable to provide sufficient primitives. LibreSSL directly inspired the introduction of a long-needed getrandom(2) syscall in Linux, and the LibreSSL-portable release still works on a decent number of platforms that will definitely be growing. Did you forget this is an early project? If anything, LibreSSL will ensure that other platforms get off their asses and actually do something about security, as OpenBSD has been trying to yell about for so long. * In case you missed the memo, LibreSSL wasn't stable back then (nor is it still, AFAIK). Of course things will break, it was still development releases and pre-alpha testing. You can't fix a mess without inevitably breaking someone's workflow. * They're making an API that will improve on the cruft of the old one, and actually be reasonably sane. Being agnostic of implementation internals will mean easier language bindings. They also explicitly stated it's meant to be independent of LibreSSL and can be adapted to other stacks. * Stop bikeshedding about version control. It gets old. OpenBSD has had probably the most proactive security auditing and code review practices out of any other project in nearly two decades: http://www.openbsd.org/security.html http://www.openbsd.org/security.html. Code review isn't some magic process, it's a practice that can be done using a variety of methods. No doubt independent audits will emerge as soon as LibreSSL nears sufficient finalization. The LibreSSL website is only a brochure. It's made to be "unprofessional" on purpose. The developers have a technical, no-bullshit and take-no-prisoners attitude. And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from.

DanBC 12y ago
> And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from. The stuff about the "hipsters" comment is not about being mean, it's about needlessly pointlessly being mean. This stuff matters. It matters because it creates division for no gain. Why not just use comic sans and make no comment? Why not use fixed-width?
- forgottenpass 12y ago
  Why not just use comic sans and make no comment? Why not use fixed-width? It might be bad manners to spill the beans, but it's a very deliberate move. The comic sans and hipster jab let them identify the people who want to bikeshed presentation instead of content.

xnull2guest 12y ago

* Nah, the BSD guys are removing their dependency on OpenSSL, which is terribly broken for a number of reasons. They are not offering to replace OpenSSL for everyone on every platform. That's not their goal. They've said this from the beginning. But not all is lost for you (the non-BSD guy complaining that BSD codes doesn't work outside BSD). Eventually the code will make it downstream. And they've dedicated a lot of thought to how to do that in a more secure manner than OpenSSL. Inspiring. * They kept the core functionality intact. Were you going to use heartbeats over TCP? Do you know even know what it is? How many of those on-by-default-workarounds were you using? Yeah they removed features. But for crypto code the lack of a rats nest is a feature. * They are maintaining compatibility with the old API for legacy code and developing a more sane API. Do you have something constructive to say about how an API might look for interop with your favorite flavor of software? Great! To the mailing list with you! * This was a tear down of code, not a reimplementation from scratch. But yeah, I agree. People should be looking over LibreSSL much more closely than OpenSSL. Sounds like that's something you would be interested in? ;) * It's open source? And there are discussions on the mailing list? What kind of public audit did you have in mind? * Don't really think hipster comments have much to do with LibreSSL's quality? * Can you point to evidence of the claim that not much has been changed in the last two months? Can you point to things you would have liked to see change? * No extra tests are needed, as they removed features. As features get added, yeah they're going to need to add some tests. * They don't exactly sit around in conference rooms and write reports for upper management. Have you checked out their mailing list? Aren't their packages signed and CVS transported over SSL? It's not like the code/packages are compromised. Otherwise, yeah I agree. It would be nice to have secure hateful hipster notes. ;). Kidding aside there's no reason not to add SSL. They should get on that. I'm thankful that someone is doing something about OpenSSL, which is a blight. I'm sorry I can't personally afford to do more to help. Criticality is a positive thing, especially with regard to crypto/security code. But aren't you being a little smidge cynical?

illumen 12y ago
The claim not much has changed can be substantiated by reading the article, and by looking in CVS. Modern code review tools provide public conversation of the code in question, and allow people to sign off on it. Is LibreSSL doing this? How can I trace a change or branch to a discussion (if there are even branches)? How are others supposed to easily look into their changes? They say this is a problem in the article we are talking about with their 12,000+ line diffs. What kind of audit? The traditional kind. Like the third party one the OpenSSL people are funding. Extra tests would be good if they are rewriting functions, which according to the article is what they did past month one. Is their test plan do a release and see what happens? I can't tell, since I can't see a test plan anywhere. If you're changing a function, and not doing so with even basic tests, and are holding your development practices up as 'best practice' you are lying. I'm being cynical because I care. They aren't doing many things the OpenSSL project themselves were taken to task for. As well, the OpenSSL project has now taken on many of the practices that LibreSSL are doing, but also they're doing much more (see their roadmap https://www.openssl.org/about/roadmap.html https://www.openssl.org/about/roadmap.html). To let LibreSSL get away with being careless is kind of silly when they are holding it up as being better.

deleted 12y ago

[deleted]