11 ms·

Christ, what a mess of a project. They inserted this after their big promise to do better after heartbleed? No wonder distros take their time moving to a new v

Christ, what a mess of a project. They inserted this after their big promise to do better after heartbleed? No wonder distros take their time moving to a new version. I really hope one of the alternative SSL libraries get picked up by the major distros. This is embarrassing, especially for those of us who have to justify FOSS in our environment. LibreSSL looks promising. Hopefully competition will mean better outcomes for such critical libraries.

Alupis 11y ago
You can't be serious here? Bugs are introduced into software all the time. It's a sign of active development. It's not the number of bugs that matters, or even the fact that new bugs get introduced over time - rather it's the severity of the bugs, how rapidly the bugs are realized, and ultimately how fast they are dealt with. In this case, it appears to have been a pretty rapid resolution - ie. about 1 month from it being introduced, realized, and fixed. A lot of folks like to lean on LibreSSL and cite "supposed problems" with OpenSSL, just as you have done now. This is a naive approach -- LibreSSL took OpenSSL, cannibalized and gutted it, and all sorts of new, untested, un-vetted code injected. OpenSSL was written largely by crypto specialists, where LibreSSL is mostly a bunch of grumbling developers, with little to no prior crypto experience. There's a reason the world is not jumping on LibreSSL just yet. There's a reason foundations outside of the LibreSSL home (OpenBSD) such as the Core Infrastructure Foundation have not backed it -- it's simply not ready, is very unproven, and won't be for a long, long time, if ever. Give OpenSSL a break. It works far better than nay-sayers want to let on, and has done so for almost 2 decades.
- tedunangst 11y ago
  > and all sorts of new, untested, un-vetted code injected. What?
- chrisfosterelli 11y ago
  I agree he is being excessively hard on OpenSSL, but they have had alot of problems as of late. Software bugs are introduced all the time, you're correct, but projects like OpenSSL should be keeping a much closer eye because state agencies and other malicious parties are definitely watching development closely.
- s1lver 11y ago
  The OpenBSD guys have little to no prior crypto experience? Can you prove this?
  - ForHackernews 11y ago
    I mean, OpenSSH is such a piece of buggy garbage... /s
    - nadams 11y ago
      I once worked with some Linux admins who told me that SSH public key authentication wasn't secure.
      - kstrauser 11y ago
        While that's certainly possible, it's an extraordinary claim because it flies in the face of generally accepted beliefs. If your coworker was Bruce Schneier, I would pay close attention to his explanation. If they were your standard issue sysadmin types, then I'd want to know: 1) Why they believe so, 2) Why they haven't filed security advisories to advise the rest of us, and 3) Why you don't hear about banks being wiped clean because crackers were able to bypass SSH's security measures. It's possible they're right, but as with all extraordinary claims, the onus of proof is on the ones making them.
        nadams 11y ago
        1) Wouldn't tell us 2) I tried to explain millions of people around the world rely on it and use it. I argue it's probably safe (within reason - obviously the weak point is the private key file). These were also the guys who refused to install packages we asked for from the community RedHat repository claiming security vulnerabilities but then they just admitted they installed some packages from there for their own use for puppet and other things they do.
        kstrauser 11y ago
mzs 11y ago
"Patch provided by the BoringSSL project." This is an example of them doing better. A bug was found, reported to them, and they responded quickly giving advanced notice too.
- bch 11y ago
  This is also an example of open source working, in general. Bug found in one project, applied to other.
  - kyberias 11y ago
    I think the same could happen in closed source projects as well.
    - frankzinger 11y ago
      Theoretically, but it's a lot more likely to happen if the projects have almost identical codebases (BoringSSL is a fork of OpenSSL).

Alupis 11y ago

You can't be serious here? Bugs are introduced into software all the time. It's a sign of active development. It's not the number of bugs that matters, or even the fact that new bugs get introduced over time - rather it's the severity of the bugs, how rapidly the bugs are realized, and ultimately how fast they are dealt with. In this case, it appears to have been a pretty rapid resolution - ie. about 1 month from it being introduced, realized, and fixed. A lot of folks like to lean on LibreSSL and cite "supposed problems" with OpenSSL, just as you have done now. This is a naive approach -- LibreSSL took OpenSSL, cannibalized and gutted it, and all sorts of new, untested, un-vetted code injected. OpenSSL was written largely by crypto specialists, where LibreSSL is mostly a bunch of grumbling developers, with little to no prior crypto experience. There's a reason the world is not jumping on LibreSSL just yet. There's a reason foundations outside of the LibreSSL home (OpenBSD) such as the Core Infrastructure Foundation have not backed it -- it's simply not ready, is very unproven, and won't be for a long, long time, if ever. Give OpenSSL a break. It works far better than nay-sayers want to let on, and has done so for almost 2 decades.

tedunangst 11y ago
> and all sorts of new, untested, un-vetted code injected. What?
chrisfosterelli 11y ago
I agree he is being excessively hard on OpenSSL, but they have had alot of problems as of late. Software bugs are introduced all the time, you're correct, but projects like OpenSSL should be keeping a much closer eye because state agencies and other malicious parties are definitely watching development closely.
s1lver 11y ago
The OpenBSD guys have little to no prior crypto experience? Can you prove this?
- ForHackernews 11y ago
  I mean, OpenSSH is such a piece of buggy garbage... /s
  - nadams 11y ago
    I once worked with some Linux admins who told me that SSH public key authentication wasn't secure.
    - kstrauser 11y ago
      While that's certainly possible, it's an extraordinary claim because it flies in the face of generally accepted beliefs. If your coworker was Bruce Schneier, I would pay close attention to his explanation. If they were your standard issue sysadmin types, then I'd want to know: 1) Why they believe so, 2) Why they haven't filed security advisories to advise the rest of us, and 3) Why you don't hear about banks being wiped clean because crackers were able to bypass SSH's security measures. It's possible they're right, but as with all extraordinary claims, the onus of proof is on the ones making them.
      - nadams 11y ago
        1) Wouldn't tell us 2) I tried to explain millions of people around the world rely on it and use it. I argue it's probably safe (within reason - obviously the weak point is the private key file). These were also the guys who refused to install packages we asked for from the community RedHat repository claiming security vulnerabilities but then they just admitted they installed some packages from there for their own use for puppet and other things they do.
        kstrauser 11y ago

mzs 11y ago

"Patch provided by the BoringSSL project." This is an example of them doing better. A bug was found, reported to them, and they responded quickly giving advanced notice too.

bch 11y ago
This is also an example of open source working, in general. Bug found in one project, applied to other.
- kyberias 11y ago
  I think the same could happen in closed source projects as well.
  - frankzinger 11y ago
    Theoretically, but it's a lot more likely to happen if the projects have almost identical codebases (BoringSSL is a fork of OpenSSL).