LibreSSL

http://www.libressl.org/

by janvdberg • 12 years ago

254 255 12 years ago

libressl.org

EGKW• 12 years ago

What's with the link to YouTube under "OpenSSL"? Supposed to be a joke? Or just a hair in the link soup?

tete2• 12 years ago

The OpenBSD folks love all kinds of music:

http://openbsd.com/lyrics.html

tete2• 12 years ago

Everyone clicked on OpenSSL yet? ;)

DiabloD3• 12 years ago

Comic Sans? Really?

Edit: To those downvoting, yes, I saw the footer. This doesn't excuse their childish behavior. I will not be donating to this project if this is the level of seriousness they have for it.

anaphor2• 12 years ago

Maybe you should consider donating

stephen_g• 12 years ago

To me it comes off as pretty childish - turned me off donating really...

rurounijones5• 12 years ago

Blatantly done on purpose to:

A) In the smallprint: "This page scientifically designed to annoy web hipsters." (Mission accomplished)

B) Make it obvious that this is a temporary site (In case the disclaimer wasn't enough)

And if you really want to see the lengths they went to to annoy web people, look at the source

adamnemecek• 12 years ago

Read the fine print

This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

keyle• 12 years ago

I was about to post the exact same question.

And if that's supposed to promote donations... (?!)

Ask yourself if a founder dresses as a clown to get funding.

tragic2• 12 years ago

Ask yourself which hipster start-up is going to do a comprehensive rewrite job on OpenSSL - or, for that matter, which SV VC is going to bung a few million green sheets into something like this (which, if we're honest, we could all do with happening, rather than the next DOA social media start up with a -ly/-able/-r suffix).

If these people are prepared to take this on, then they can use whatever fonts they bloody well like. As a web hipster, I will pay them for punishing my hubris.

Having said that, I can't seem to find a browser in which the blink tags actually, er, blink. Did all the vendors shitcan it on the quiet? I think we should be told.

DonHopkins4• 12 years ago

Dressing and acting like a clown is Eric Raymond's job.

a80003• 12 years ago

Of course anyone who has not installed Microsoft Fonts won't see this at all.

rakoo2• 12 years ago

You know, what you really care about is them spending time on writing good software, not writing good websites. They don't have time for this, they don't have money for this, and they don't want to spend human CPU on this.

Oh, and while we're at it, the OpenSSL page [0] isn't much better visually speaking. Would you donate to them to make OpenSSL better ?

[0] https://www.openssl.org/

pimlottc• 12 years ago

It's one thing to focus on the code over the website and another to deliberately thumb your nose at people with an ugly font.

It's not all just window dressing; a pleasant, professional website will help to attract more attention and resources.

claudius2• 12 years ago

It seems that is is indeed the official site (as linked-to on http://www.openbsdfoundation.org/), just in case there are any doubts…for no reason whatsoever.

rurounijones5• 12 years ago

Since this is related. I have a question:

How can they know that they have not broken something in their flensing without any automated testing since no tests is one of the big problems with OpenSSL?

mrmincent• 12 years ago

I believe they are compiling the openbsd packages with it, so I guess it is a decent set to test against.

rurounijones5• 12 years ago

Ah, so compile openbsd packages against it then run the tests for those packages.

Sort-of-integration testing. Gotchya

clarry5• 12 years ago

Believe it or not, there are other ways to spot problems besides automated testing, which wouldn't catch every problem anyway (that's why we need human audits like the one OpenBSD is doing).

Yes, software existed before TDD and ADHD.

That's not to say tests don't help. If you are interested, why don't you contribute?

edent• 12 years ago

Somewhat ironic that https://www.libressl.org/ doesn't work, no?

anaphor2• 12 years ago

Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.

phlo• 12 years ago

StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC).

As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used to reveal data from other, encrypted streams. As for the second: if only sensitive data is encrypted, all encrypted streams automatically become "interesting" to a potential eavesdropper. If, however, everything is encrypted, all streams become equal again. The cost of storing all communications becomes much higher, and the ratio of cost and reward of decrypting a single captured stream worsens (as you may either reveal sensitive or non-sensitive data).

[1] https://www.startssl.com/

[2] http://www.instantssl.com/ssl-certificate-products/free-ssl-...

repsilat• 12 years ago

(not even source code or binaries

The real see site doesn't have those things, but a MITM'd unsecured version might.

gjvc• 12 years ago

the last word of that sentence should be "yes"

chuckreynolds• 12 years ago

comic sans? really?

Dosenpfand• 12 years ago

This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

lifthrasiir• 12 years ago

It should rename to LibibreSSL instead, so that one can link the library with `-libressl`. Other than that, I appreciate this effort (no pun intended).

SwellJoe• 12 years ago

Why wouldn't they just make it available for linking as "ibressl" rather than naming the project that? LibibreSSL is unwieldy to put it mildly, and meaningless without the context of the original name.

sarahj• 12 years ago

I understand the point but this comes across as immature. OpenSSL has provided years of free software, supporting thousands of sites and applications.

Of course it has its problems, and there is nothing wrong with adding more competition in this space.

But what this space needs now, more than ever, is professionalism and pride in craft (by which I mean demonstrable unit test coverage, regression testing, fuzz testing and documentation) not silly music video jabs.

nailer• 12 years ago

They've already done massive amounts of work already - adding missing checks, documenting a metric ton of magic numbers, removing VMS support, fixing year 2038 bugs, removing insecure cypher support, removing less secure replacements for secure OS inbuilts, unused code, and more, see http://opensslrampage.org.

On a side note, I was really hoping for the name to be OpenTLS (consistent with OpenBSD and OpenSSH, which are also OpenBSD maintained projects) or ValhallaTLS

gtirloni• 12 years ago

Was all that rejected by the OpenSSL team though?

beefhash• 12 years ago

OpenTLS was already taken: http://www.opentls.org/ -- it's dead, but still taken.

slight• 12 years ago

If anyone can make openssl trustworthy it's OpenBSD.

thebackwardsman2• 12 years ago

Agreed. This is a bit scary. I feel the resources would be better off focusing on merging with the official OpenSSL project rather than forking and _then_ asking for funding, essentially taking any potential funding from the official OpenSSL project.

bananas3• 12 years ago

I'd hope that I speak for the majority here when I say that OpenSSL has had its chance.

This is the beauty of open source, nothing more. We can take this and make it better.

mrweasel4• 12 years ago

I get your point, but let's face it, the OpenBSD developers have done more to fix OpenSSL in the last two weeks that the OpenSSL developers done the last two years.

Some of the bug fixes have been pull from OpenSSLs bugtracker, they've just sat there for one or two years. This should make you think about what motivates the OpenSSL developers, my guess would be new crypto algorithms and the math, rather than maintaining a modern and secure crypto library.

Honestly the better solution might be to have the OpenSSL developers commit new code to the OpenBSD fork. For my understanding no one doubts that the OpenSSL developer understand the math and crypto in SSL and TLS, but they aren't the sharpest C programmers. There's no point in ostracising the OpenSSL developers, but maybe they should just focus on the parts that they do really well and let others, like the OpenBSD developer, productize their work.

alexcroox• 12 years ago

Agreed, the tone of the page and the footer prevents me from taking these guys seriously, especially in this area (even more so with recent events).

tikums• 12 years ago

Which goes to show that you're not the intended end-consumer of this product and don't know their credentials. They are not newcomers to this space. If their tone is off-putting, maybe you should stop relying on OpenSSH too.

DonHopkins4• 12 years ago

At least they succeeded in their goal of annoying web hipsters. Why don't you sell your fixie on craigslist and donate some money anyway, please?

antocv6• 12 years ago

The tone and the footer encouraged me to actually donate even what little I have to this project.

The footer is a smack in the face to all those responsive bootstrap modern crap marketing websites - while this, table based layout, single page html provides more information and works in every device, with every resolution. Everything just included. As it should be.

This page probably took as much time to write as the sentences in the page - instead of fucking around with html initializr responsive themes, colors and oh god make it stop.

Joeboy• 12 years ago

Were you about to donate your time and money to the project, up until you saw the footer?

caseydurfee• 12 years ago

I refuse to run any software that's not hipstergraphically secure.

sergiotapia• 12 years ago

I still can't believe such a fundamental backbone of the web runs on $2000/year. This is a -worldwide- service, and it runs on peanuts. It's flabbergasting. Please donate today if you can.

https://www.openssl.org/support/donations.html

CHY8722• 12 years ago

No. It needs corporate involvement, from Google, Red Hat, Amazon, Verisign etc. Lend minds, not money. By all means fund people to write it, but like it's not you who should be contributing, it's the corporations who rely on it.

copergi8• 12 years ago

OpenSSL has provided years of free software, supporting thousands of sites and applications.

And has done it so poorly that it has been a security nightmare the whole time. Just because something is given away, doesn't mean the world is obligated to be thankful for it. Giving away crap doesn't make it not stink.

pikimeister• 12 years ago

It's indeed a great effort. Lets just hope that it delivers what is promising and doesn't bring other sorts of vulnerabilities due to the new implementation/code.

sigzero3• 12 years ago

I, for one, would be extremely surprised if that happened. They are very thorough (even considering incomplete docs as a bug to be fixed).

mangia• 12 years ago

Please use Comic sans font.... Oh wait !

vayarajesh7• 12 years ago

Comic sans?? lol!

This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags

okamiueru• 12 years ago

Mine doesn't show up in comic sans. However, the link to OpenSSL is to We're Not Gonna Take It (http://www.youtube.com/watch?v=mRCGDUsdRDU)... This all seems like a joke to me.

vayarajesh7• 12 years ago

Check the footer (last line) of the page.. its just a page for donation to get rid of comic sans :)

Rafert• 12 years ago

The OpenBSD Foundation donation page mentions and links back to this site...

seszett• 12 years ago

While it is funny, I think using Comic Sans is actually more hipstery than ranting against it, which is too mainstream today (the same goes for blink tags).

vayarajesh7• 12 years ago

There is a pro-type / mordern-type version of comic sans http://comicneue.com/ :)

canistr• 12 years ago

The correct word for "mainstream" is "surface". "Mainstream" is far too surface of a word.

zorbo3• 12 years ago

Ah yes, the kind of professionalism I've come to expect from OpenBSD. They make decent software, but boy could they use some work in the PR department.

q3k2• 12 years ago

I'd rather have great software and shitty PR than the recent trend of obnoxiously beautiful landing pages for “world-changing” shitty web apps.

vayarajesh7• 12 years ago

I am not sure if anyone noticed the footer of the page. It not the PR's fault or anything to blame PR. Its just a link for donation :).. they are trying to improve the standards of the web by wanting/helping to get rid of comic sans font

mykhal3• 12 years ago

i guess it was designed by theo@ himself )

rubyfan• 12 years ago

I just donated because of that little line at the bottom of the page. I think it is that extra character from the OpenBSD team that I love...

The fact that are are true and opinionated and no bullshit. Real character is hard to find these days.

twic• 12 years ago

I like the fact that OpenBSD has professional implementation but unprofessional presentation. It makes it easy to distinguish from FreeBSD.

Xylakant• 12 years ago

I'm curious what they mean by "free", they put it in bold caps. Since it's a fork of OpenSSL that probably implies that the OpenSSL license remains attached to the code at least until all of the relevant code has either been rewritten or removed.

marlin• 12 years ago

OpenBSD folks, what is your obsession with CVS????

logn• 12 years ago

I can't speak for them, but I think if you're not sold on git/mercurial then you have CVS and SVN as obvious choices. And those two aren't that different (pros/cons explained: http://www.pushok.com/software/svn-vscvs.html ... edit: that's a very old link)

Grue3• 12 years ago

Contains stuff like "SVN not yet so widly used, as the result there are places where it support still not implemented."

Very old indeed.

mrweasel4• 12 years ago

Why are people so obsessed with getting the OpenBSD developers to move from CVS? If it works for them and do what they need there's no need to move.

boklm4• 12 years ago

Because people might be interested to review their changes, and CVS makes that very difficult.

antocv6• 12 years ago

For security reasons.

It is possible with CVS and even SVN to insert bad code on their repository server - but with git thats a much harder if not impossible to do.

tobiasu• 12 years ago

Well, we're all waiting for you to write a BSD licensed git/hg replacement that has decent performance on a VAX.

antirez2• 12 years ago

I imagine supporting non-POSIX operating systems, or not exactly conforming ones, to have its challenges, but is it really hard to make this stuff working in Linux and Open/NET/Free BSD from day one? It seems to me a better approach to start this way, without to mention that the potential developers base you get if you support Linux ASAP can be larger.

Bluerise• 12 years ago

They don't care about that. Their main interest is to have a library conforming to OpenBSD standards.

rodgerd2• 12 years ago

OpenSSH also deliberately trashed cross-platform compatability. This makes it amusing whenever someone flounces off to OpenBSD because they think systemd should have been written portably.

copergi8• 12 years ago

Yeah, fuck those openbsd guys and their totally not portable openssh that you can't run on anything but openbsd!

Sanddancer5• 12 years ago

OpenBSD cares about their own first and foremost. OpenSSH has a similar porting team, and has since the beginning, and there have been no problems there.

antirez2• 12 years ago

"OpenBSD cares about their own first and foremost.".

This is their choice, but their impact in the security of IT is much smaller this way because most servers are running Linux. It is surely a great result to have an operating system like OpenBSD that can be proud of the security level reached and the small amount of vulnerabilities over the years, however if you analyze the computer security problem from a vendor-neutral standpoint, there is more at it than the availability of niche secure systems.

dwc• 12 years ago

I'm sure that portability is a major goal, but "from day one" isn't. Better to focus on correct, high quality, readable code first and then deal with a portable version. And OpenBSD C code tends more toward generic UNIX than some others, so shimming is less painful than it could be.

There really are a lot of parallels with OpenSSH's history. There were the "Oh, God! Theo forked SSH!", "It's just OpenBSD, who uses that?", and all the rest. Now everyone uses it, and it's a good thing. The wait time for it to be ready and available to all platforms was a small price to pay, well worth it, and quite small in retrospect.

abcd_f2• 12 years ago

removed MacOS, Netware, OS/2, VMS and Windows build machinery

What are the plans for native Windows support? I don't know what they mean by "The right Portability team in place", but it'd be a joke if the lib would require CygWin or some other external portability scaffolding. And without proper Windows support LibreSSL will simply fragment OpenSSL user base. I guess it's still better than nothing, but it definitely won't be an OpenSSL "replacement."

bananas3• 12 years ago

Probably none. Windows has its own CSP library which is a little more convenient in a win32 context than OpenSSL or anything POSIX TBH. I think they're doing the right thing here.

abcd_f2• 12 years ago

There's a ton of Windows software that uses OpenSSL as their security library. Moreover, there is a lot of Windows projects that are written in inherently portable way and using OpenSSL API is the most natural choice for them.

If StartSSL manages to topple OpenSSL and to discourage any further OpenSSL development, then that'd be a very bad thing for a lot developers.

orthecreedence• 12 years ago

Ehh, I maintain a few libs that rely on the OpenSSL Windows ports. I'm not too keen on writing a compatibility layer that says "if windows, use the MS version, else use libreSSL!"

I'm fine with them not supporting MSVC in the build, but is it really that much harder to support something like MinGW/MSYS? No need for Cygwin.

The whole point of OpenSSL was that it runs everywhere. If we're going to write a shiny new version, let's at least try to hit the major platforms.

frik• 12 years ago

maybe it's better to switch to NSS, the original SSL library developed by Netscape (now by Mozilla, Google, etc.), that is available under better open source licenses, is used in Firefox, (Chrome), OpenOffice, etc. and has an optional compatible API to OpenSSL: http://en.wikipedia.org/wiki/Network_Security_Services

ProblemFactory• 12 years ago

Curiously, the Heartbleed bug was found by the Google engineer who is working on replacing NSS with OpenSSL in Chrome: https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53...

From the Pros & Cons table, it doesn't seem that NSS is obviously superior to OpenSSL. Both seem to suffer from focus on extra features instead of maintenance and reliability.

jmspring• 12 years ago

Last I looked, libnss still relied on libnspr, which brings it's own amount of overhead.

ZoFreX• 12 years ago

I don't see why this product would have a different porting strategy to the usual way OpenBSD projects (such as OpenSSH) handle it - target OpenBSD exclusively in the core project, and support other platforms with ports. Presumably that's what they are going to do here.

acqq• 12 years ago

As far as I know OpenSSH doesn't work natively on Windows, only over Cygwin, that is, with the whole Linux environment by Red Hat.

masklinn• 12 years ago

FWIW the usual OpenBSD story is "get it working, reliable and simple, on (Open)BSD, then add porting shims" (they'll have to add shims for linux anyway if they start using strlcpy)

teacup502• 12 years ago

Most (all?) native Windows applications shouldn't use OpenSSL.

They should use the operating system-shipped APIs, along with the OS-shipped certificate stores.

That means SChannel and CryptoAPIs in native code.

binaryapparatus• 12 years ago

While most of us just talk, this guys actually did something of great importance. Hell yeah they have all the rights to step on some toes and make fun as they see fit.

I'd always salute doing stuff vs being politically correct.

mehrdada3• 12 years ago

One annoying thing about OpenSSL is its license. I hope The Better Replacement™ fixes that as well (especially if its name gets to contain the string "Libre"), and it is not going to happen by forking OpenSSL.

the_mitsuhiko• 12 years ago

Just don't link it with GPL stuff and you're fine.

Sanddancer5• 12 years ago

This is the problem with any sort of viral license in Free/Open/Libre software. Different people have different notions as to the best way of distributing it. An advertising clause is pretty minor compared to the rights you have to give away to use certain other "Libre" software.

claudius2• 12 years ago

They are already placing completely rewritten files under ‘better’ licenses, so the license switch might happen file-by-file over a long period of time.

gioele2• 12 years ago

Is that strategy possible at all? Are there cases tested in courts (both US and EU) that assert that the file-by-file licence replacement really works?

legulere• 12 years ago

They use ISC for new files they add: http://freshbsd.org/commit/openbsd/4e62360b677d95b324fe5f0e1...

edwintorok• 12 years ago

How about projects that currently have an 'OpenSSL exception' in their license. Will they need a LibreSSL exception in their license too now?

codecondo• 12 years ago

I was going to ASK HN, when are we going to see a replacement for OpenSSL; you know, the company that has much more field experience, or even understanding of how SSL operates.

I then thought to myself, that'd be going too far..and nobody is really going to try and make an alternative.

Oh boy..

broodbucket• 12 years ago

As someone without the Microsoft fonts using a browser that doesn't support the blink tag, I've totally missed out on the experience :(

einrealist• 12 years ago

I cannot even read the text on iPad.

DonHopkins4• 12 years ago

Please, have some mercy on the rest of humanity and just donate anyway!!! I just sent them some money. Now I can sleep at night.

lmedinas• 12 years ago

A fork is not the solution for world problems period.

vayarajesh7• 12 years ago

They should donate to replace comic sans with this much morder version of comic sans http://comicneue.com/

facepalm2• 12 years ago

I'm assuming it is a parody (because of the font)?

In any case forking OpenSSL seems like a knee jerk reaction?

arcatek• 12 years ago

"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"

facepalm2• 12 years ago

Shouldn't they rather worry about making SSL secure? I don't think I like their attitude.

thomseddon• 12 years ago

Does anyone have a link to repo in which it's being developed?

woodson2• 12 years ago

http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/

Confusion• 12 years ago

Has anyone seen an explanation for why this effort isn't being undertaken together with the OpenSSL team?

zorbo3• 12 years ago

I haven't seen an explanation for it, but one reasonable guess would be momentum. If you want to get work done, you don't want to have to wade through red-tape and bureaucracy to get it done. You don't want to work on something with the risk of it being shot-down by the current maintainers. This is not a criticism of the OpenSSL team, it's just a fact of life that it's often easier to "start fresh" than to try to change an already established routine.

I also suspect that part of the reason is because OpenBSD just doesn't work well with others.

rurounijones5• 12 years ago

Considering the fact that the OpenBSD guys are complaining about the OpenSSL guys competance in their commits I don't think they WANT them near the new fork.

erikb2• 12 years ago

I would appreciate so much to see a link to corresponding discussions/blog posts in the security communities.

eyan• 12 years ago

oooh. lots of whiners here.

bosky101• 12 years ago

Ironic, that this website does not use SSL.

MonsieurHoho• 12 years ago

I don't get the point of this fork. Usually when a project is forked, it means that people want to keep the code base but disagree with the way the project is managed.

After heartbleed everybody blamed OpenSSL's bloated code base and it became apparent that many contributions came from volunteers with very few financing.

By forking the project, LibreSSL will keep the problematic code legacy and split the community. Maybe I am missing something, but it looks like opportunism here...

AlexMeesters2• 12 years ago

After heartbleed everybody blamed OpenSSL's bloated code base <

And this is exactly what they are fixing.

OpenSSL's response was to fix heartbleed and move on, not fixing the more broad problem of to much code cruft that led to the bug. IMHO they are right to fork it, OpenSSL's lack of reaction to this is a raise for concern. I am sure Theo( de Raadt) and its team can tackle this, making the code base much much leaner, reducing the risks of bugs similar to heartbleed. And there is really no excuse for OpenSSL to deny that.

Also i think OpenSSL has to much technical debt to be efficient in tackling a cleanup like this.

jbergstroem• 12 years ago

Since libressl.org doesn't seem to contain this information, hopefully someone here perhaps knows more about it: Is it possible to donate specifically to subprojects? As a previous donator to the OpenBSD foundation, being able to do so would hopefully aid receivers of those funds not only use time (timing) as one way to measure the potential success of libressl.

Attitude and font choice aside, I can't help somewhat feel that one could explore better ways to funnel interest, commitment and donations to a project such as this; especially since it sparked as a result of heartbleed.

fab13n2• 12 years ago

With close to years of C under my belt, I believe it's a major error, today, to write a critical cryptographic library in C.

OK, do the codecs in C if it's the only way to meet performance requirements. But the rest must be written in a language that's reasonably analyzable statically, and with adequate abstractions. Seriously, have you looked at the filthy mess of leaky abstractions that OpenSSL's BIO system is? How many bugs could be found and/or planted by a 3-letters agency in that crap? Is there anyone who's comfortable with its #ifdef labyrinths?

Finally, I don't think you can retrofit clarity in OpenSSL any better than you could, say, retrofit virus-resilience in a Microsoft OS that hasn't been originally designed for hostile network environments. I used to believe OpenSSL was made messy in order to sell consulting hours, since Snowden I have a more paranoid hypothesis.

dtech• 12 years ago

They're making a fork of OpenSSL, and removing all the cruft. Porting it to a completely different language would be an error.

There are several alternatives to OpenSSL available and/or popping up right now. They might or might not be a better choice for new developments. But refactoring OpenSSL (where a lot of currently used software depends upon) is certainly not a dumb decision.

fab13n2• 12 years ago

Agreed, there's no realistic way to port OpenSSL to a new language. What I'm saying is, I think a clean-up fork of OpenSSL will divide the workforce per project, without dramatically improving security.

So it's not "dumb", but I expect the net result to be negative. At least a clean reimplementation featuring XXI-th century technologies would have a non-zero chance to produce something great.

Pacabel• 12 years ago

Like we always have to ask when somebody says what you have, "What's the alternative?"

Whatever it is, it'll need to be very portable (well beyond just Linux, OS X and Windows), and it'll presumably need a free implementation on each of those platforms, and it'll need to be quite fast, and it'll need to support native compilation, and it'll need to support interoperability with existing code, and it'll need to be "safer" in some way.

At this time, there are very, very few languages that meet every one of those criteria sufficiently. We're looking at C, or C++. Maybe Ada. But that's about it. Rust doesn't cut it yet, and probably won't for some time. Other candidates are lacking severely in one or more of those important areas.

C++ using modern techniques appears to be the only feasible alternative to C today.

JasonFruit• 12 years ago

Ada sounds like an excellent choice. Of course, it's No Fun By Design™, but it's very, very safe.

erikb2• 12 years ago

People might disagree, but why is this downvoted so much?

dang• 12 years ago

https://news.ycombinator.com/item?id=7619287

antocv6• 12 years ago

"No we dont need help with making web pages"

its just a bunch of html very simple 1990s tags and it still looks and works much better than any html5 css3 bootstrap fanboy page Ive ever seen.

Awesomeness

mykhal3• 12 years ago

does not work wery well for instance for me or html validator..

adamman• 12 years ago

You must be trolling.

The site is ugly and I'm sure they would agree. That clearly is not the focus of their work.

scintill76• 12 years ago

"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags."

They know. I find simple HTML like http://cr.yp.to/ to be refreshing sometimes, albeit not "pretty." But with the font and blink tag (powered by CSS), they've gone out of their way to make it a bit ugly. At least they drew a line and don't have headache-inducing colors or animations.

nottrobin• 12 years ago

Site straining under the load of HN visitors?

TacticalCoder2• 12 years ago

I may have a stupid question but...

While I really enjoy Theo's talks and writings, I wonder if the fact that the VCS is CVS ain't a security issue in itself?

It's been really a long time I haven't used CVS but I remember that attempt to introduce backdoors in projects using Git as a (D)VCS have been caught (it was in the Linux kernel I think). IIRC some attempts were caught precisely because it's hard to fake SHA hashes and so people can't really "mess" with the history of a DVCS like Git: too many people noticed a critical file having no business being modified being, well... Modified.

Once again, it was quite a while ago but I'm pretty certain that both the fact that Git was decentralized and that Git was using cryptographically secure hashes was touted as a "Good Thing" [TM] that helped catch the backdooring attempts.

Ain't using CVS potentially an issue here?

gnoway2• 12 years ago

Git uses SHA-1 hashes, which have not been considered cryptographically secure since 2005.

Git and CVS are both just tools. They each provide a server implementation, but it's uncommon to use either of these for write access in large projects. It's more common to wrap CVS or Git with a different frontend like HTTPS or SSH. My guess is that the OpenBSD guys use OpenSSH.

This team is fanatical about security and process. I am completely comfortable with them using whichever tools they want.

floatboth2• 12 years ago

Linus Torvalds: "the point is the SHA-1, as far as Git is concerned, isn't even a security feature. It's purely a consistency check. The security parts are elsewhere, so a lot of people assume that since Git uses SHA-1 and SHA-1 is used for cryptographically secure stuff, they think that, OK, it's a huge security feature. It has nothing at all to do with security, it's just the best hash you can get."

KMag2• 12 years ago

SHA-1 has been shown to not be collision-resistant. Correct me if you've heard otherwise, but I believe SHA-1 is still believed to be second-preimage resistant.

In other words, with fewer than 2 * * 80 trials, an attacker can generate two files that have the same SHA-1 hash. (In the case of C source files, this probably means embedding a nonsense comment in the middle of each file, probably several hundred to several thousand ASCII characters.) If an attacker can get the very carefully constructed benign file past code review and have the ability to modify the repository, they can substitute the very carefully crafted malicious file for the very carefully crafted benign file without changing the root of the Merkle tree.

Assuming that SHA-1 is still second-preimage resistant, it will take an attacker about 2 * * 159 attempts to come up with a file that has the same hash as a legitimate file not carefully constructed by the attacker.

So, the weaknesses in SHA-1 probably mean that exploiting those weaknesses in the context of git still requires a mole in the development team. Though, I wouldn't want to bet my life on nobody noticing a big nonsense comment in the middle of a C file or someone figuring out how to construct a reasonably reviewable C file as the carefully crafted benign file.

In any case, the weaknesses in SHA-1 still likely pose a significant difficulty in forging a git history without planting a mole in the dev team. It's much better than no cryptographic barriers to forgery.

whistlerbrk• 12 years ago

"I am completely comfortable with them using whichever tools they want."

Forgive me for saying so and I doubt you intend it so, but statements like this is what gets us into trouble. At a certain point we need to trust the people that build the foundation for us, but only once we've done our due diligence. Most people, maybe not you since you seem to know more about the team, have not yet.

gnoway2• 12 years ago

The edit button is gone. I guess these expire?

My reply was not intended as an attack on Git. I use it daily and would choose it 10 times out of 10 vs. CVS for a new project. I just think the assertion that Git 'saved' Linux from some backdooring attempts because it's decentralized and uses cryptographic hashes is wrong; it's not the tools that make this happen, it's the processes around the use of these tools which do that.

I don't know any OpenBSD developers nor do I have any inside knowledge of how their team works, but I know from observation that they are a small team with high standards for code style and quality. They don't just let anyone commit code and appear to be thorough with code review. When procedural/practice problems are identified in the industry, they are proactive about mitigating or fixing those. They have a demonstrated track record of good releases. Basically, I don't see any reason to question their use of CVS.

rpdillon• 12 years ago

Git uses SHA-1 hashes, which have not been considered cryptographically secure since 2005.

That a vast oversimplification. There are still no publicly-known preimage or second-preimage attacks against SHA-1. Even the collision attack in 2005 was limited insofar that it reduced the search from a brute-force 2^80 to 2^69.

Perhaps you're referring to a length extension attack, but I admit I don't know much about those in the context of Git's use of SHA-1.

copergi8• 12 years ago

Ain't using CVS potentially an issue here?

No, why would it? If you don't trust the openbsd developers, the don't use their code.

q3k2• 12 years ago

As far as I read up about this some time ago, it boils down to the following reasons:

- CVS is simple - it's small (fits on a floppy with bsd.rd) and easy to use on exotic/slow architectures - CVS is preferable for their current contribution workflow (centralized) - CVS is treated as a tool that, currently, just works (tm)

afiler• 12 years ago

It seems ever-so-slightly ironic that support for exotic architectures is considered a plus in this case, while support for exotic architectures is being ripped out of the OpenSSL/LibreSSL codebase. (Though probably not deeply ironic, since CVS is comparatively simple.)

ColdHawaiian• 12 years ago

FYI, here is an Ars Technica article that talks about the break-in into the Linux Kernel, and Git's role in revealing the tampering[1].

[1] http://arstechnica.com/security/2013/09/who-rooted-kernel-or...

mykhal3• 12 years ago

libressl.org is inaccessible via ssl - is it some kind of irony or something?

sigzero3• 12 years ago

Why would they need that for a temporary web page? And one that has no need to be accessed via ssl? They threw together a page to give you some information and that is all.

petval• 12 years ago

I like their tools like pfctl, raidctl. Hopefully they create something like sslctl.

floatboth2• 12 years ago

OpenSSL is a library, not a program like pf.

alex4nder• 12 years ago

You know, except for the 'openssl' executable that builds, and a lot of people use.

madospace• 12 years ago

Dear god.. Y comic sans .. !!!!

halfdan• 12 years ago

Comic Sans, really?

gpcz• 12 years ago

I've been thinking recently about Heartbleed, and I was wondering if by writing C code to implement various network and cryptographic protocols, we're acting as human compilers for something that might be better represented in a more abstract format. I know there's some research on this already (the Austin Protocol Compiler), but does anyone here know of any other serious efforts to take the human out of the equation in terms of implementing protocols in C?

antocv6• 12 years ago

C is only used because for cryptography we really need to be close to the CPU and memory, going all assembler is an option actually. Anything higher than that and you have to have formal proofs for your compiler as well as your equations.

godojo• 12 years ago

Don't listen to him, its just for performance, compatibility and portability. There's many other reasons why you might want to use another language, and some do.

hsivonen• 12 years ago

Rust (http://www.rust-lang.org/) is a serious effort to build a language that's close to metal like C but safe.

storrgie• 12 years ago

Rust (http://playrust.com/) is a serious effort to build an envrionment that's about survival and gratuitous male nudity.

carussell• 12 years ago

I think gpcz was suggesting something more along the lines of an entirely new approach to protocol implementation, like VPRI's TCP/IP stack that Jeff Moser describes[1], rather than just swapping out C for something else while keeping the hand-written aspect.

Let's say we want to build the TCP/IP stack of an operating system. A traditional implementation might take 10,000 lines of code. What if you rethought the design from the ground up? What if you could make the IP packet handling code look almost identical to the RFC 791 diagram which defines IP?

If the industry as whole could agree on this approach in a move similar to the Dijkstra/structured programming move that happened a few decades back, the sort of verifiable interoperability + security that Meredith Patterson and Sergey Bratus (who you may recognize from Occupy Babel![2]) call for would be closer to reach[3].

1. Jeff Moser. Towards Moore's Law Software: Part 3 of 3. https://www.youtube.com/watch?v=UzjfeFJJseU

2. Occupy Babel!. http://www.cs.dartmouth.edu/~sergey/langsec/occupy/

3. Meredith Patterson. LANGSEC 2011–2016. https://www.youtube.com/watch?v=UzjfeFJJseU

dmytrish• 12 years ago

The most viable option today seems to be writing code in some language with strong formal guarantees (Agda, Coq) with extracting to Haskell/OCaml for generating C code from there.

That's the way seL4 was written.

a80003• 12 years ago

There are efforts by Microsoft Research in this direction: http://research.microsoft.com/en-us/projects/slam/ They have developed several domain specific languages and specification tools for developing drivers. I think similar methods are applicable to protocols.

slashdotaccount• 12 years ago

https://twitter.com/matthew_d_green/status/45696043584599654...

gizzlon• 12 years ago

Matthew Green ‏@matthew_d_green Apr 18: "@MiodVallat @cwlcks Well then I withdraw my earlier comments. What happens in BSD when the system RNG lacks entropy? Does it block?"

dfc• 12 years ago

Did you get to the part where Prof. Green says:

@MiodVallat @cwlcks Well then I withdraw my earlier comments. What happens in BSD when the system RNG lacks entropy? Does it block?

X-Istence• 12 years ago

Now go read this: https://twitter.com/MiodVallat/status/457169266748715008

And the whole thread ... and problem doesn't exist.

---

Same thing was brought up in this HN thread: https://news.ycombinator.com/item?id=7604364

cridenour• 12 years ago

"No we don't want help making web pages, thank you."

Seems silly to turn away help.

clarry5• 12 years ago

Managing a flock of web devs and telling them all they're doing it wrong would eat up time that could've been spent on the actual code. So it's not actually help.

seanieb• 12 years ago

Wouldn't the name LibreTLS be more appropriate?

TheCoreh• 12 years ago

Or OpenTLS, to still match the OpenBSD naming convention.

adamtj• 12 years ago

I just donated my $100. Have you?

JDShu• 12 years ago

No.

deegles2• 12 years ago

Some of the commit comments are entertaining: "Fix some serious pointer-arithmatic-magic-number-unchecked-return eyebleed that I stumbled into here and got stuck with. If modern society can get past selling daughters for cows, surely we can decide to write modern C code in an "application" that is probably 3 lines of shell/python/cgi away from talking to the internet in a lot of places.. (This file still needs a lot more love though) "oh god yuck" deraadt@ ok tedu@"

http://freshbsd.org/commit/openbsd/fc55d7f9ab6fcadd0ca2f8231...

chris_wot• 12 years ago

I refer everyone to this thread - https://plus.google.com/u/0/+jwildeboer/posts/Tuw81zXqtcC

"Suggesting to call the fork LibreSSL or LibreTLS just to offend everyone. trololo"

And it was so.

euske• 12 years ago

This is one of the best things that happened in the open source world recently. I like their attitude towards "web hipsters" too. They're serious folks who shut up and write AND READ codes.

It's funny that they do this "donate to stop blinking" thing again. They have been doing it for OpenSSH since 2000. cf. http://www.openssh.com/

LibreSSL

Related Stories