3 ms·

* It's broken on other platforms, because those platforms are unable to provide sufficient primitives. LibreSSL directly inspired the introduction of a long-nee

* It's broken on other platforms, because those platforms are unable to provide sufficient primitives. LibreSSL directly inspired the introduction of a long-needed getrandom(2) syscall in Linux, and the LibreSSL-portable release still works on a decent number of platforms that will definitely be growing. Did you forget this is an early project? If anything, LibreSSL will ensure that other platforms get off their asses and actually do something about security, as OpenBSD has been trying to yell about for so long. * In case you missed the memo, LibreSSL wasn't stable back then (nor is it still, AFAIK). Of course things will break, it was still development releases and pre-alpha testing. You can't fix a mess without inevitably breaking someone's workflow. * They're making an API that will improve on the cruft of the old one, and actually be reasonably sane. Being agnostic of implementation internals will mean easier language bindings. They also explicitly stated it's meant to be independent of LibreSSL and can be adapted to other stacks. * Stop bikeshedding about version control. It gets old. OpenBSD has had probably the most proactive security auditing and code review practices out of any other project in nearly two decades: http://www.openbsd.org/security.html http://www.openbsd.org/security.html. Code review isn't some magic process, it's a practice that can be done using a variety of methods. No doubt independent audits will emerge as soon as LibreSSL nears sufficient finalization. The LibreSSL website is only a brochure. It's made to be "unprofessional" on purpose. The developers have a technical, no-bullshit and take-no-prisoners attitude. And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from.

DanBC 12y ago
> And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from. The stuff about the "hipsters" comment is not about being mean, it's about needlessly pointlessly being mean. This stuff matters. It matters because it creates division for no gain. Why not just use comic sans and make no comment? Why not use fixed-width?
- forgottenpass 12y ago
  Why not just use comic sans and make no comment? Why not use fixed-width? It might be bad manners to spill the beans, but it's a very deliberate move. The comic sans and hipster jab let them identify the people who want to bikeshed presentation instead of content.
- anonbanker 12y ago
  We get it; as a hipster, you find it offensive. we all get it.
illumen 12y ago
Where is their release plan? The files don't say alpha anywhere. Version control matters when you don't know who actually made the change. Are the changes signed? No. Besides, my main point was a lack of openness about code reviews. They're not public, and there's no evidence they are even done. An accessible readable website happens to be important to people, and is a legal requirement in Canada. Documentation is important, and there is none on their website. How do we know what changes they made? Documentation is part of software, and they have none. Fail. If they want to be jerks and bash other projects, they should be able to take crits themselves. They clearly state in the article that there hasn't been much activity for periods of time. You can see yourself by looking at the project history in CVS.
- vezzy-fnord 12y ago
  How are OpenBSD bashing other projects? The only person bashing projects here is you, for spreading FUD and disinfo like "LibreSSL hasn't seen nearly any commits for 2 months and most of the work was done 5 months ago", because clearly you have no idea how to navigate a source directory and only looked at the top level. See: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ssl/ http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/..., for example. The documentation is largely identical with OpenSSL's currently, I presume. This will change once the new ressl API is introduced. No extra tests have been added because there are no new major components that need testing yet. For changes, you look at their source repository? Take your personal vendettas elsewhere.
- jholman 12y ago
  > An accessible readable website ... is a legal requirement in Canada. Could you help me out with a pointer in the right direction to find/understand this legal requirement? I did a little googling, and could only find evidence of laws that restrict the government itself.

DanBC 12y ago

> And of course, next time we hear of OpenBSD having more difficulties, people will jump about Theo de Raadt being mean. I'm starting to understand where he comes from. The stuff about the "hipsters" comment is not about being mean, it's about needlessly pointlessly being mean. This stuff matters. It matters because it creates division for no gain. Why not just use comic sans and make no comment? Why not use fixed-width?

forgottenpass 12y ago
Why not just use comic sans and make no comment? Why not use fixed-width? It might be bad manners to spill the beans, but it's a very deliberate move. The comic sans and hipster jab let them identify the people who want to bikeshed presentation instead of content.
anonbanker 12y ago
We get it; as a hipster, you find it offensive. we all get it.

illumen 12y ago

Where is their release plan? The files don't say alpha anywhere. Version control matters when you don't know who actually made the change. Are the changes signed? No. Besides, my main point was a lack of openness about code reviews. They're not public, and there's no evidence they are even done. An accessible readable website happens to be important to people, and is a legal requirement in Canada. Documentation is important, and there is none on their website. How do we know what changes they made? Documentation is part of software, and they have none. Fail. If they want to be jerks and bash other projects, they should be able to take crits themselves. They clearly state in the article that there hasn't been much activity for periods of time. You can see yourself by looking at the project history in CVS.

vezzy-fnord 12y ago
How are OpenBSD bashing other projects? The only person bashing projects here is you, for spreading FUD and disinfo like "LibreSSL hasn't seen nearly any commits for 2 months and most of the work was done 5 months ago", because clearly you have no idea how to navigate a source directory and only looked at the top level. See: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/ssl/ http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/..., for example. The documentation is largely identical with OpenSSL's currently, I presume. This will change once the new ressl API is introduced. No extra tests have been added because there are no new major components that need testing yet. For changes, you look at their source repository? Take your personal vendettas elsewhere.
jholman 12y ago
> An accessible readable website ... is a legal requirement in Canada. Could you help me out with a pointer in the right direction to find/understand this legal requirement? I did a little googling, and could only find evidence of laws that restrict the government itself.