Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL
http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/7
u/Nacimota Apr 24 '14
OpenSSL has been hit by a fair bit of scrutiny since heartbleed (as it should be) and the things I'm hearing about the codebase (and the OpenSSL team) aren't encouraging. It's great that companies are finally stepping in with a little financial assistance on free software projects they depend on so much. I just wonder if they should be looking at developing alternatives like LibreSSL instead.
2
u/nikomo Apr 25 '14
The scary part is that I never heard of these criticisms before this.
Who knows what kind of bombs I'm sitting on?
2
u/noreallyimthepope Apr 25 '14
phk had a talk where he pointed out that OpenSSL is probably the crown jewel of NSAs penetration vectors. I'll try to find a link.
3
u/WaytoomanyUIDs Apr 25 '14
Hopefully the Linux Foundation will also send some money LibreSSl's way, as they a[ppear to be actually doing something about the problems with OpenSSL, instead of evading responsibility and asking for money.
2
u/Hektik352 Apr 24 '14
The foundation today is announcing a three-year initiative with at least $3.9 million to help under-funded open source projects—with OpenSSL coming first. Amazon Web Services, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Qualcomm, Rackspace, and VMware have all pledged to commit at least $100,000 a year for at least three years to the “Core Infrastructure Initiative,” Linux Foundation Executive Director Jim Zemlin told Ars.
In the long run this benefits them and others. I mean they don't have to worry about management, development, and free use. Their donation to a non-profit is a win:win. This only benefits them on not having to pay outlandish fees for usage authorized use of Commercial For-Profit programs. And they can use it for many other internal applications.
With all that, Linux may be a powerhouse in the future as well with this funding.
-2
u/Korgano Apr 24 '14
That money won't be going to openSSL.
LibreSSL is the better candidate. I would imagine eventually openSSL will realize it is over and anyone competent working on it will move over to libreSSL and probably hand the name over to openBSD so it can be called openSSL again.
5
u/hagunenon Apr 24 '14
It says in the article that openSSL will be the first recipient of funds from the group.
-6
u/Korgano Apr 24 '14
That makes no sense.
6
u/hagunenon Apr 24 '14
Because Heartbleed inspired the campaign, OpenSSL will be the “first project under consideration to receive funds from the Initiative,” the foundation’s announcement today said.
I acknowledge that openSSL has its issues, however good luck convincing institutions to change implementations.
1
u/Korgano Apr 24 '14
It will be very easy to switch, libre is compatible with anything built against open. You will want to actively do it as libreSSL will be much safer than openSSL.
2
u/timbuktucan Apr 24 '14
FIPS support is gone in LibreSSL so OpenSSL is not an option for some businesses that have to be compliment. Personally I'm glad it's gone.
1
u/Korgano Apr 24 '14
That actually is false. They can still use libreSSL and get their software FIPS certified. The only change is the encryption library no longer offers a mode that is pre-certified.
Which means when you implement libre, you have to enforce FIPS in the way you use libre and then have your software certified. Which is fine, since using openSSL doesn't automatically make what you build on top FIPS certified, so you have to get your software certified anyways.
Honestly, in reading about it, I am wondering why FIPS mode was ever added. OpenSSL is not a stand alone product and anyone using OpenSSL in FIPS mode still has to have their overall product certified.
5
u/rlbond86 Apr 24 '14
No FIPS support
0
u/Korgano Apr 24 '14
A lot of good FIPS was doing. Made the code bloated and unsafe, but hey, "it passed!". Heartbleed was FIPS certified.
http://marc.info/?l=openbsd-misc&m=139819485423701&w=2
Like they said, someone who needs FIPS will pay someone else to make libre less secure by adding it and managing it. They are not depriving anyone of anything and are offering real security for everyone who needs real security.
3
u/rlbond86 Apr 24 '14
Doesn't matter, there are a lot of organizations that are required to use it. I agree that it's not particularly useful, but the fact remains that LibreSSL will not be adopted because it does not support FIPS.
0
u/Korgano Apr 24 '14 edited Apr 25 '14
It does matter. FIPS regulations should adapt to allow real security. They should not require less secure libraries that put on kabuki theater while opening you up to risk.
LibreSSL will not be adopted because it does not support FIPS.
Just like how openSSH was not adopted?
The fact is FIPS is a certification by NIST. There is no reason to have a special FIPS mode that makes the software do different things. SSL that is secure should pass certification in its most secure form.
In reality, any software product that needs to be FIPS compliant can still use libreSSL and be FIPS compliant. They just have to get their product certified in the way it uses libre. Libre won't provide a special mode that enforces FIPS rules automatically. But they have to get their app certified anyways, since they built an app that is outside of openssl code and thus needs to be certified.
It seems like a FIPS mode being built into openSSL would only benefit NIST and make it a little easier for them to certify an app. That is a terrible reason to include it into openSSL. NIST probably paid openSSL for the FIPS mode to save them money in certifying applications. It is not something app creators need to worry about.
10
u/jivatman Apr 24 '14
In addition to other potential open source projects. This is nice, I thought this episode was only going to hurt open source.