LibreSSL – the first 30 days

http://www.openbsd.org/papers/bsdcan14-libressl/index.html

by lysium • 12 years ago

76 31 12 years ago

openbsd.org

alexnewman• 12 years ago

Worth watching http://www.youtube.com/watch?v=GnBbhXBDmwU

jocmeh• 12 years ago

It's even worse than I thought it was. Lots worse. Amazing job by the OpenBSD guys though.

jcr• 12 years ago

Previous discussion from yesterday:

https://news.ycombinator.com/item?id=7761041

lysium• 12 years ago

Thank you for the link; I've searched for the submission, but obviously not thoroughly enough.

alwillis• 12 years ago

Thanks for putting in the time and effort. It makes we wonder the state of other code we rely on from that era.

cschmidt• 12 years ago

Yes, if it was the custom malloc that allowed memory issues to go undetected, what else is doing that?

SwellJoe• 12 years ago

The Squid codebase had a custom malloc in it for a while for some operating systems, but on systems with competent malloc it used the OS implementation. I doubt that malloc remains today (I believe Squid has been somewhat rewritten in C++, with a more modern approach to memory allocation, since I was working on it).

There was a time about 15 years ago, when many UNIX variants had sub-optimal malloc, or other core libraries, and custom implementations were common in large Open Source projects (as well as commercial products). Those operating systems are mostly gone (Solaris remains, kinda, and there's still some big iron running those old beasts), but I haven't seen a newish project using a custom malloc or other core library in years. I couldn't name the projects that made that choice back then, but I remember seeing it very frequently, when I used to read a lot more C source than I do, today.

chrisrohlf2• 12 years ago

Im not sure why this misunderstanding of the code continues to persist. It is not a custom malloc. It is a custom API for reusing chunks of a specific size previously returned by malloc.

XorNot2• 12 years ago

So, this is just like a bazillion jpegs of a powerpoint presentation?

Why not send it to a PDF printer and cutdown that filesize (and not make it take an age to open in a browser)?

dudus2• 12 years ago

I believe the reason can be seen on:

http://www.openbsd.org/papers/bsdcan14-libressl/mgp00025.htm...

"This page scientifically designed to annoy web hipsters"

Spittie• 12 years ago

and not make it take an age to open in a browser

The whole page is ~484kb, which in this day is not much at all (many pages serve more css than that). I do like to complain about big pages as well, but I can't say this is one of those.

But I agree, a pdf would be sweet. My biggest complain with the site is that it doesn't work great on a mobile device (very small links, can't press on a slide to go to the next, and Firefox mobile open the page in "full size" mode with only half a slide visible without zooming back).

XorNot2• 12 years ago

Whole page yes - try clicking on those slides to browse through them at readable size. You still get "stutter->load".

voidlogic4• 12 years ago

Wow, OpenSSL smells so bad, I don't even really trust LibreSSL, at least not for a few years. This is no fault of the great devs trying to clean it up, but more a reflection of how I feel about anything security essential being written in C with a day 1 focus on security.

I personally will stay on the path of using the Go built-in SSL library. Sure there are theoretical issues, but no real ones, I trust that real ones will be handled promptly as they appear and everything is well reviewed and unit tested (and of course is written in a memory safe language). I realize this isn’t an option for the non-gophers, but for gophers... yeah. Maybe when Go (hopefully soon) can be compiled to shared libraries this will be an option for non-Go projects.

These guys are doing heroic work, kudos to them. This is not garbage I would want to have to take out.

voidlogic4• 12 years ago

I'm a little surprised at the down votes as I don't think anything I said was factually incorrect.. are people offended that I think writing something like an SSL library in C is a bad idea perhaps?

voltagex_• 12 years ago

It's possibly because the Go libraries are much newer, although age didn't help OpenSSL in this case.

binarycrusader6• 12 years ago

They're dismissive of your comments because you don't understand that most OS systems programming realistically has to be done in C.

If you want to create a library like OpenSSL that every consumer in every language can use, C is your only practical choice.

dudus2• 12 years ago

Maybe it's time to put a kickstarter page up for this stuff

orik• 12 years ago

If OpenSSL software foundation is a for profit operation, why are tech companies funding it(1) instead of LibreSSL?

1: http://arstechnica.com/information-technology/2014/04/tech-g...

iopq• 12 years ago

Thank you for this. I already forgot how the Internet looked like in the 90s.

LibreSSL – the first 30 days

Related Stories