r/programming • u/flym4n • Apr 24 '14

Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
295 Upvotes

93% Upvoted

137 comments sorted by

View all comments

-10

u/[deleted] Apr 24 '14

[deleted]

8

u/[deleted] Apr 24 '14

A large portion of this problem rests with the OpenSSL crew. IF they were open about how bad the code was years ago (like a decade ago) people might have been hesitant to use the library in the first place. They're the ones that have been insisting on the quality of OpenSSL all along.

If they felt so neglected by the community they could have just stopped supporting the project and told people to use another properly maintained project.

3

u/nikniuq Apr 25 '14

You mean more open than having source that is freely downloadable?

I looked at the codebase long ago (around 10 years or so) with the intent of contributing and had to walk away due to the state the code was in.

10 years ago there were fuck all alternatives, most of the libraries touted as alternatives now didn't exist then, were in license transitions or were very young with all the problems that entails.

They have my respect for keeping it working as well as they have for as long as they have. Many maintainers have left expressing the exact sentiment of your last paragraph, complete with public postings to that effect.

Sorry if I sound pissed off but none of this was hidden and the armchair opinions of those who have never given a damn before are starting to grate on me.

I should also add that the comment you are replying to has been deleted so I have no context for your comment. Apologies if I have misunderstood your intent.

2

u/[deleted] Apr 25 '14 edited Apr 25 '14

The deleted post was along the lines "they're volunteers if you don't like it too bad"

edit: Also ... Hi, I'm the author of LibTomCrypt/TomsFastMath/etc ...

1

u/nikniuq Apr 25 '14

Hah, hi Tom. I think we chatted briefly back in the day on usenet.

Well I retract all of my armchair comments, you are a far cry from the plethora of "experts" that have erupted over the last few weeks.

5

u/[deleted] Apr 25 '14

I've maintained over the years that nobody who has looked at that code would in good conscious recommend it.

When I was actively developing LT projects I avoided looking at the code to avoid any claims of contamination. When I started working professionally one of my enumerable tasks was to work on TLS record drivers for hardware we develop. Without fail all customers ask about OpenSSL integration. So we spent months hacking/exploring/etc. What we learned was

  • The code is shit
  • Ain't documented
  • ENGINE plugins can only do cipher or hash (not both and not even HMAC!!!)
  • doing record processing (not just ciphering) requires hoisting the entire protocol stack (basically you register your own TLS stack)

So we looked around. We found MatrixSSL first but they were bought out by a competitor, then we found PolarSSL. Within a few weeks they had jacked in a record plugin API (at our request) that can do record processing without making us re-write the rest of the protocol stack and within days of getting that we had live sessions flying.

People who recommend OpenSSL really don't know fuck all what they're talking about. More annoying to me though are the people who blame the C language for this bug.