If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.
Phoronix, Linux Hardware Reviews, Linux hardware benchmarks, Linux server benchmarks, Linux benchmarking, Desktop Linux, Linux performance, Open Source graphics, Linux How To, Ubuntu benchmarks, Ubuntu hardware, Phoronix Test Suite
Because the OpenSSL guys had tons of weird abstractions for portability and was like whatever, this is fine, look the code is portable. All that abstraction and weirdness resulted in lots of buggy and insecure code.
The LibreSSL guys are about stripping out legacy code, stripping out insecure code, removing all weird abstractions and putting the primary focus on security instead of portability.
Also the LibreSSL is developed by the OpenBSD guys who has a development history of being all about security, strictness and robustness. OpenBSD doesn't care about fun, fancy or cool stuff, they're all about security. Also, they have Theo de Raadt which is an asshole and he won't let any shit fly. He would probably torch someone if they were to submit something buggy or insecure.
Because the OpenSSL guys had tons of weird abstractions for portability and was like whatever, this is fine, look the code is portable. All that abstraction and weirdness resulted in lots of buggy and insecure code.
The LibreSSL guys are about stripping out legacy code, stripping out insecure code, removing all weird abstractions and putting the primary focus on security instead of portability.
Also the LibreSSL is developed by the OpenBSD guys who has a development history of being all about security, strictness and robustness. OpenBSD doesn't care about fun, fancy or cool stuff, they're all about security. Also, they have Theo de Raadt which is an asshole and he won't let any shit fly. He would probably torch someone if they were to submit something buggy or insecure.
Crypto programming is also notoriously complicated do I wouldn't expect anything actually secure from the project in the first five years at least
Crypto programming is also notoriously complicated do I wouldn't expect anything actually secure from the project in the first five years at least
You are right, programming cryptographic software is notoriously complicated and layers of additional abstraction just makes it more complicated, which is why the LibreSSL team is stripping away all the layers of abstraction and deleting tons of code, to make the code base leaner, cleaner, and smaller.
You are right, programming cryptographic software is notoriously complicated and layers of additional abstraction just makes it more complicated, which is why the LibreSSL team is stripping away all the layers of abstraction and deleting tons of code, to make the code base leaner, cleaner, and smaller.
The OpenBSD guys do concentrate on security, but they are *definitely* not as infallible as they like to think that they are. In fact, I think I'd prefer my crypto written by people who are generally more in touch with their own limitations.
There are a *lot* of extremely smart people researching OpenSSL security constantly, if just from the position of: "I have a big company, I'm going to throw $10m a year at this security stuff, find me some auditors to read some code". You can argue "monoculture" but if your job is on the line, you'll go with the industry standard.
FWIW - my favourite GPL vs BSD license example is the OpenSSH vulnerability that was fixed in Solaris for several years before someone binary diff'ed the files. That means that someone in the Solaris security team knew how to remote root *every* sshd in the world for years. Sun never needed to release their fix, 'coz BSD doesn't require that source code is released.
Comment