6 ms·

OpenBSD's scorched earth policy regarding OpenSSL is so anti-community it's ridiculous. OpenSSL served the entire internet for years. I'm happy that it's been f

OpenBSD's scorched earth policy regarding OpenSSL is so anti-community it's ridiculous. OpenSSL served the entire internet for years. I'm happy that it's been forked - nice that could even happen at all - and some of the cruft responsible for the recent flood of exploits will be fixed/removed, but the hate just seems petty.

wtbob 12y ago
> OpenSSL served the entire internet for years. Well, it gave the entire Internet a false sense of security for years, at least. > …the hate just seems petty. Have you read some of the cruft that the LibreSSL guys removed? OpenSSL has been a horrid mess. Sometimes you gotta admit that a Yugo is a really, really, really bad car.
- rjaco31 12y ago
  False sense of security? They provided the best SSL stack for years, and for free. Everybody knew for long that OpenSSL was a mess, and the harsh reality is that no one wanted to take care of it beside the few (almost benevolent) OpenSSL developers. So now, the OpenBSD guys come in with their almighty attitude, while they knew about it for years and didn't bother to do anything about it before. No one wanted to do that job before Heartbleed, so yeah, it's really uncalled for to be that rude. We should all be grateful the OpenSSL team did what they did for so long.
  - rurban 12y ago
    You must been living on an island over the last years. "OpenSSL was the best SSL stack for years?" Best no, only fast. PolarSSL (now "mbed TLS") is the best, to the best definition of best. Still better than OpenSSL, which was known to be fast but insecure and poorly managed, are the stacks used the biggest clients: * NSS used by Chrome, Mozilla, et al * GnuTLS used by exim, GNOME, et al. I'm not at all grateful to the OpenSSL team for using horrible software practices and putting their clients into danger.
- _delirium 12y ago
  Even the OpenBSD people seem to think it's a car worth keeping, just in need of an engine overhaul and better maintenance. They didn't throw out OpenSSL and write their own SSL library (like they have with other things), but rather forked it and cleaned it up.
_asummers 12y ago
What's petty about removing bad code? If someone came into your (work or FOSS) project and just started removing code at the clip they were, you'd probably be extremely upset. At best, it would take way too long to get the approvals by the community. They made the decision that with the changes they wanted (and in their opinion needed) to make would not be worth the politics involved. I don't blame them for that decision. As a byproduct, they are now maintainers of their own system, and as shown by OpenSSH, they are very good stewards of critical systems. Then they ported it back to Linux, and got a call added to the kernel. I wouldn't call that petty. I think it would have been better had OpenSSL just been straight up fixed rather than forked, but can you legitimately see a way for that to have happened? To my knowledge, the OpenBSD guys have not hated on the OpenSSL guys in any way, they have hated on the code itself, which was objectively bad code with many latent bugs. Any comments about not knowing how to write secure code resulted from what was produced: insecure code.
- coldpie 12y ago
  > What's petty about removing bad code? Nothing. But no one said anything about removing bad code. Have you looked at that page? Their comments are extremely rude: "So the OpenSSL codebase does “get the time, add it as a random seed” in a bunch of places inside the TLS engine, to try to keep entropy high. I wonder if their moto is “If you can’t solve a problem, at least try to do it badly”." "Old news, but OpenSSL doesn’t give a fuck whether or not memory was freed. It’s all good." It's hostile, unprofessional, and unnecessary. I understand these kinds of comments in a private IRC channel or something, but publicly ridiculing someone else's software, especially mission critical software that's been used for years across many platforms, is uncalled for. It really gave me a bad taste for the LibreSSL project, and all just for some petty sniping.
  - e12e 12y ago
    > It's hostile, unprofessional, and unnecessary. It might be "unprofessional" which is to say, it's not polite (and since they're giving it away - why would it be "professional" -- they're not (necessarily) getting paid for the work) -- but it's not really disproportionately hostile, and most of all, I disagree that it's "unnecessary". As evidenced in part by recent security issues, and in part by what the libressl project has dug up/cut away: the code base was horrid for the purpose (providing authentication and confidentiality). Much worse than merely "not good". I think the (rightfully) hostile attitude helps others realize just how bad things were/are. And I welcome it. I'm sure a few developers are hurt by the comments, but all of your quotes above are pretty much factual and concrete: it's not name calling for the sake of being rude; it's a wake-up call. I'd be surprised if not a few "victims" of those comments aren't also glad that errors are both found and pointed out. Just as if you hacked together a not-quite working break system for a car, you'd prefer being called out as a hack, and someone fixing it, rather than having lots of people get hurt. The stakes involving openssl can actually be life or death.
gnu8 12y ago
Scorching the earth is the right thing to do. OpenSSL is the sick man of the internet and its community has been dysfunctional to non-functional for years, much like its code. The massive injection of money won't solve that problem in the long term. The security patches ought to be integrated with LibreSSL immediately, not after an embargo period dictated by the vendors who have essentially bought out OpenSSL.
- danielweber 12y ago
  There can be more than one bad actor in a play.

wtbob 12y ago

> OpenSSL served the entire internet for years. Well, it gave the entire Internet a false sense of security for years, at least. > …the hate just seems petty. Have you read some of the cruft that the LibreSSL guys removed? OpenSSL has been a horrid mess. Sometimes you gotta admit that a Yugo is a really, really, really bad car.

rjaco31 12y ago
False sense of security? They provided the best SSL stack for years, and for free. Everybody knew for long that OpenSSL was a mess, and the harsh reality is that no one wanted to take care of it beside the few (almost benevolent) OpenSSL developers. So now, the OpenBSD guys come in with their almighty attitude, while they knew about it for years and didn't bother to do anything about it before. No one wanted to do that job before Heartbleed, so yeah, it's really uncalled for to be that rude. We should all be grateful the OpenSSL team did what they did for so long.
- rurban 12y ago
  You must been living on an island over the last years. "OpenSSL was the best SSL stack for years?" Best no, only fast. PolarSSL (now "mbed TLS") is the best, to the best definition of best. Still better than OpenSSL, which was known to be fast but insecure and poorly managed, are the stacks used the biggest clients: * NSS used by Chrome, Mozilla, et al * GnuTLS used by exim, GNOME, et al. I'm not at all grateful to the OpenSSL team for using horrible software practices and putting their clients into danger.
_delirium 12y ago
Even the OpenBSD people seem to think it's a car worth keeping, just in need of an engine overhaul and better maintenance. They didn't throw out OpenSSL and write their own SSL library (like they have with other things), but rather forked it and cleaned it up.

_asummers 12y ago

What's petty about removing bad code? If someone came into your (work or FOSS) project and just started removing code at the clip they were, you'd probably be extremely upset. At best, it would take way too long to get the approvals by the community. They made the decision that with the changes they wanted (and in their opinion needed) to make would not be worth the politics involved. I don't blame them for that decision. As a byproduct, they are now maintainers of their own system, and as shown by OpenSSH, they are very good stewards of critical systems. Then they ported it back to Linux, and got a call added to the kernel. I wouldn't call that petty. I think it would have been better had OpenSSL just been straight up fixed rather than forked, but can you legitimately see a way for that to have happened? To my knowledge, the OpenBSD guys have not hated on the OpenSSL guys in any way, they have hated on the code itself, which was objectively bad code with many latent bugs. Any comments about not knowing how to write secure code resulted from what was produced: insecure code.

coldpie 12y ago
> What's petty about removing bad code? Nothing. But no one said anything about removing bad code. Have you looked at that page? Their comments are extremely rude: "So the OpenSSL codebase does “get the time, add it as a random seed” in a bunch of places inside the TLS engine, to try to keep entropy high. I wonder if their moto is “If you can’t solve a problem, at least try to do it badly”." "Old news, but OpenSSL doesn’t give a fuck whether or not memory was freed. It’s all good." It's hostile, unprofessional, and unnecessary. I understand these kinds of comments in a private IRC channel or something, but publicly ridiculing someone else's software, especially mission critical software that's been used for years across many platforms, is uncalled for. It really gave me a bad taste for the LibreSSL project, and all just for some petty sniping.
- e12e 12y ago
  > It's hostile, unprofessional, and unnecessary. It might be "unprofessional" which is to say, it's not polite (and since they're giving it away - why would it be "professional" -- they're not (necessarily) getting paid for the work) -- but it's not really disproportionately hostile, and most of all, I disagree that it's "unnecessary". As evidenced in part by recent security issues, and in part by what the libressl project has dug up/cut away: the code base was horrid for the purpose (providing authentication and confidentiality). Much worse than merely "not good". I think the (rightfully) hostile attitude helps others realize just how bad things were/are. And I welcome it. I'm sure a few developers are hurt by the comments, but all of your quotes above are pretty much factual and concrete: it's not name calling for the sake of being rude; it's a wake-up call. I'd be surprised if not a few "victims" of those comments aren't also glad that errors are both found and pointed out. Just as if you hacked together a not-quite working break system for a car, you'd prefer being called out as a hack, and someone fixing it, rather than having lots of people get hurt. The stakes involving openssl can actually be life or death.

gnu8 12y ago

Scorching the earth is the right thing to do. OpenSSL is the sick man of the internet and its community has been dysfunctional to non-functional for years, much like its code. The massive injection of money won't solve that problem in the long term. The security patches ought to be integrated with LibreSSL immediately, not after an embargo period dictated by the vendors who have essentially bought out OpenSSL.

danielweber 12y ago
There can be more than one bad actor in a play.