5 ms·

Up until recently even OpenSSL's own download page was not HTTPS.

by lpsz 12y ago

rockdoe 12y ago
Just like Mozilla's page, that makes perfect sense as long as the authenticity can be verified via other means, such as PGP signatures. What use is having HTTPS to protect the very thing that you need to implement it. It's a basic chicken and egg problem, replayed every time OpenSSL gets compromised, and successfully circumvented by securing it with something else. Think about it: there's an SSL break and you need to update OpenSSL. What good does it do you to have it available over SSL?
- 0xdeadbeefbabe 12y ago
  Tell that to building haskell from source. It depends on itself.
  - rockdoe 12y ago
    I remember back in the day you used to be able to build gcc with various other compilers to bootstrap yourself. I think gcc now requires gcc features, so you're in the same boat. But anyway, the comparison isn't very good because haskell/gcc don't develop sudden security vulnerabilities that instantly turn existing binaries unusable for getting new ones.
  - cbd1984 12y ago
    The first C++ compiler was written in C++: http://www.stroustrup.com/bs_faq.html#bootstrapping http://www.stroustrup.com/bs_faq.html#bootstrapping However, the first C compiler was not written in C, but in NB, an intermediate step from B to C: http://stackoverflow.com/questions/18125490/how-was-the-first-c-compiler-written http://stackoverflow.com/questions/18125490/how-was-the-firs...
- angry_octet 12y ago
  Because not all vulnerabilities are the same, and not all are total compromises. For example, BEAST was temporarily worked around by switching to use a stream cipher (RC4) instead of a block cipher. Everyone scrambled to update their OpenSSL version, then switched back, or they switched to an AEAD mode TLS 1.2. Not that people shouldn't be using GPG, but only using it means you only protect the paranoid.

5 ms·

Up until recently even OpenSSL's own download page was not HTTPS.

by lpsz 12y ago

Up until recently even OpenSSL's own download page was not HTTPS.

rockdoe 12y ago
Just like Mozilla's page, that makes perfect sense as long as the authenticity can be verified via other means, such as PGP signatures. What use is having HTTPS to protect the very thing that you need to implement it. It's a basic chicken and egg problem, replayed every time OpenSSL gets compromised, and successfully circumvented by securing it with something else. Think about it: there's an SSL break and you need to update OpenSSL. What good does it do you to have it available over SSL?
- 0xdeadbeefbabe 12y ago
  Tell that to building haskell from source. It depends on itself.
  - rockdoe 12y ago
    I remember back in the day you used to be able to build gcc with various other compilers to bootstrap yourself. I think gcc now requires gcc features, so you're in the same boat. But anyway, the comparison isn't very good because haskell/gcc don't develop sudden security vulnerabilities that instantly turn existing binaries unusable for getting new ones.
  - cbd1984 12y ago
    The first C++ compiler was written in C++: http://www.stroustrup.com/bs_faq.html#bootstrapping http://www.stroustrup.com/bs_faq.html#bootstrapping However, the first C compiler was not written in C, but in NB, an intermediate step from B to C: http://stackoverflow.com/questions/18125490/how-was-the-first-c-compiler-written http://stackoverflow.com/questions/18125490/how-was-the-firs...
- angry_octet 12y ago
  Because not all vulnerabilities are the same, and not all are total compromises. For example, BEAST was temporarily worked around by switching to use a stream cipher (RC4) instead of a block cipher. Everyone scrambled to update their OpenSSL version, then switched back, or they switched to an AEAD mode TLS 1.2. Not that people shouldn't be using GPG, but only using it means you only protect the paranoid.