First release of LibreSSL portable is available

http://marc.info/?l=openbsd-tech&m=140510291304119&w=2

by klapinat0r • 12 years ago

133 69 12 years ago

marc.info

nayden• 12 years ago

The github repo: https://github.com/libressl-portable

Kikawala• 12 years ago

From the README:

Development is done in the upstream OpenBSD codebase. A github clone of the official repositories is kept at: https://github.com/libressl-portable We update this repository from the OpenBSD respositories semi-frequently, so changes may not show up in GitHub immediately. The GitHub repository should be used for informational purposes only.

raverbashing2• 12 years ago

Makes me wonder why is OpenBSD still using CVS for their things.

Really, not having atomic commits is a pain

edwintorok• 12 years ago

Where should bugs be reported? It doesn't build on Debian:

  md5/md5_dgst.c: In function 'md5_block_data_order':
  md5/md5_dgst.c:107:49: error: right-hand operand of comma expression has no effect [-Werror=unused-value]
  HOST_c2l(data,l); X( 0)=l;  HOST_c2l(data,l); X( 1)=l;
                                                 ^

pyroh• 12 years ago

Perhaps try #openbsd on Freenode.

tedunangst7• 12 years ago

definitely not. mail to bugs@openbsd.org

agwa2• 12 years ago

Source is served from a HTTP website with no PGP signature in sight. :-( Critical software like this should really be distributed more securely.

tedunangst7• 12 years ago

Indeed. Consider it a preview. :)

akerl_2• 12 years ago

I am considering it a preview of how releases of important security software are handled by the developers.

AlyssaRowan3• 12 years ago

It's a bit early to rely on as critical - this is serious work-in-progress. I'm not sure I'd use it yet, and I'm not sure you should either, but then, I suppose I could say that equally well about the OpenSSL library it's forked from.

It is nevertheless a bit weird to see test sourcecode for TLS support on a site that does not support HTTPS!

Maybe when the cleanup is complete and it's shored up, they might actually use it? :)

agwa2• 12 years ago

Yeah, a LibreSSL dev has replied saying as much. I did not realize this was meant to be a preview release, or I would not have been so critical. (But I do think they could have made this more clear in their announcement and/or version scheme.)

strict9• 12 years ago

humor/irony or not, I'll never take a project seriously that has such ridiculous typography for the project home page.

AlyssaRowan3• 12 years ago

Mission accomplished.

Maybe they could switch to a hip, cool font when everything's finished. Right now, it's in Comic Sans territory, because it's really not done.

I guess that makes OpenSSL crayon, I don't know... :) (Kidding!)

stal4• 12 years ago

agreed

pjscott• 12 years ago

Sure you will. It'll be bundled with your OS, or your browser, or just used by web sites you visit that have "https://" at the beginnings of their URLs, and you'll take it seriously because you take those thing seriously.

By the same token, you're trusting OpenSSL unless you go to great pains not to.

erobbins• 12 years ago

So, an audited port of openssl comes out and the discussion centers around:

1. why CVS sucks and the openbsd team should spend 3 months doing nothing but reworking their development processes so they can use git like all the cool ruby hackers.

2. Lack of formality in the release announcement

3. Choice of font

wow.

pyre• 12 years ago

an audited port of openssl comes out and the discussion centers around:

Exactly what kind of discussion were you hoping for here? We have a number of individuals frequenting this site with the skills to comment on this at a technical level, but they probably have other things to do then to show up for every story that hits the frontpage of HN and requires someone of their skillset to have a competent discussion of the technical details...

they can use git like all the cool ruby hackers.

Though git has become widely accepted by the Ruby community, it was created by kernel hackers. Is Linus Torvalds now a 'hipster Ruby hacker' or can we elevate the level of discussion here above name-calling?

It also seems like you've missed comments like this: https://news.ycombinator.com/item?id=8021965

Pacabel2• 12 years ago

There's a difference between the creator of a software system and who actually adopts it and advocates it in practice.

Yes, git did originally come from Linus and the Linux kernel development community. But since then, their original use of it has been eclipsed by the larger and more vocal GitHub/Ruby on Rails/JavaScript segment of software developers. The fact that both groups use git does not mean that they're otherwise connected in any way. Traits (such as the propensity to be a hipster) specific to one of the groups very likely do not apply to the other.

Many of these GitHub/Ruby on Rails/JavaScript people do advocate very loudly for git's use everywhere, even in situations where it is not the best choice, or even where it's obviously a bad choice. Some of them have elevated git from being a tool to a quasi-religion. They've done this with some of their other "chosen" tools, too, so it's not just limited to git.

They do make the git community as a whole look quite bad. But they're obviously very distinct and separate from the Linux kernel developers who created git. The two distinct groups should obviously not be confused.

stal4• 12 years ago

that's because CVS is shit and they should use git or mercurial.

and why should we trust an SSL tool that uses COMIC SANS on thier website. these LibReSSL dudes sound like idiot hipsters

wmoxam• 12 years ago

"these LibReSSL dudes sound like idiot hipsters"

No, they're just poking fun at people like you :D

ori_b• 12 years ago

Hint: they are mocking you.

id• 12 years ago

"This page scientifically designed to annoy web hipsters."

hobarrera2• 12 years ago

Honestly, if you're using windows (which, AFAIK, is the only OS that includes Comic Sans), why the are you complaining about being unable to trust security software from a certain provider?

maximumoverload• 12 years ago

This is called "bikeshedding" and it's inevitable.

http://en.wikipedia.org/wiki/Parkinson's_law_of_triviality

equoid• 12 years ago

Or perhaps like dogs peeing on lampposts - just leaving their mark. Most of these people are incapable of comprehending the internals of SSL or contributing to it, so they comment on trivialities (which they do not understand either). Dragging things down to their own level is another way of putting it.

clarry2• 12 years ago

I am surprised that we haven't gotten discussion around point 4 ("Theo is an asshole, so is Linus, but Theo is worse"). These seem to be always present when anything related to OpenBSD is discussed. It's disappointing.

First release of LibreSSL portable is available

Related Stories