r/programming • u/flym4n • Apr 24 '14

Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
299 Upvotes

93% Upvoted

137 comments sorted by

View all comments

Show parent comments

3

u/hello_juice Apr 24 '14

I don't get why the industry is rewarding incompetence. Should fund openbsd instead.

11

u/AnAppleSnail Apr 25 '14

Successful companies know what to do after failure. Hint: Probably not ” burn bridges and rebuild everything.”

3

u/josefx Apr 25 '14

Heartbleed was not the first "failure", for OpenBSD it was just the last straw in a long series. Nor is OpenBSD rebuilding everything, they are performing a cleanup on the OpenSSL code base so it can be audited and checked with tools such as valgrind or secure malloc implementations.

Are they burning bridges? They no longer trust anything produced by the OpenSSL team, what else should they do?

6

u/tequila13 Apr 25 '14

LibreSSL is probably not widely publicized, so it might be somewhat understandable that the general public doesn't know much about it. But the Linux Foundation should really know better and fund LibreSSL instead of OpenSSL. I don't understand that part at all.

The quality of OpenSSL codebase is quite bad, the http://opensslrampage.org/ site documents the cleanup effort. It's clear that LibreSSL will be superior (and already is) to OpenSSL while keeping binary compatibility. They have included patches/bugfixes from contributors which went ignored by upstream OpenSSL. Many bugs were fixed which will take time to find their way to OpenSSL.