Slashdot Mirror
Not Just a Cleanup Any More: LibreSSL Project Announced
An anonymous reader writes "As some of you may know, the OpenBSD team has started cleaning up the OpenSSL code base. LibreSSL is primarily developed by the OpenBSD Project, and its first inclusion into an operating system will be in OpenBSD 5.6. In the wake of Heartbleed, the OpenBSD group is creating a simpler, cleaner version of the dominant OpenSSL. Theo de Raadt, founder and leader of OpenBSD and OpenSSH, tells ZDNet that the project has already removed 90,000 lines of C code and 150,000 lines of content. The project further promises multi-OS support once they have proper funding and the right portability team in place. Please consider donating to support LibreSSL via the OpenBSD foundation."
LibreSSL.... Please for the love of code, change the name!
'Nuff said
The source code in OpenSSH is as bad as OpenSSL. Convoluted and crazy as hell, to the point of being unmaintainable.
Perfect for more bugs like Heartbleed to hide in.
I look forward to new and interesting side-effects of the pell-mell rush to clean up the code of a poorly written, poorly maintained, and even more poorly documented software package!
Comic Sans.
That looks professional.
you use polarssl. Which is already exactly that.
Religion is what happens when nature strikes and groupthink goes wrong.
Works for anybody
finds out openssl is bollocks,
radically refactors and overhauls millions of lines of code.
as for the LibreSSL team, might i suggest some music?
http://www.openbsd.org/lyrics....
http://www.openbsd.org/lyrics....
Good people go to bed earlier.
Another problem with OpenSSL is its hideous API - huge, inconsistent, poorly documented, and exposing way too many low level protocol details that should be handled internally by the library, not by applications.
Now if only libressl could have a sane licence that wasn't GPL-incompatible :(
Don't fork SSL, we need to keep one standard, I'd think. This is a bad idea. These resources could be used to improve OpenSSL directly.
Granted, the OBSD team has a known personality.
That said, diffs to remove compatibility would likely be rejected. Also, the rate at which they're being submitted wouldn't be verifiable by the OpenSSL team.
Plus, it's better to have multiple libraries.
This is for the better.
The key reason OpenSSL is so popular in US is because the project is on top of FIPS certifications. LibreSSL might cure cancer, but very few system integrators will use it unless it has certified module.
LibreSSL.... Please for the love of code, change the name!
I wish they would start a naming contest soon.
There ought to be _someone_ out there who can come up with some much better name than "LibreSSL" ...
Muchas Gracias, Señor Edward Snowden !
Ahem. You say "holding OpenSSL hostage," when in fact the two developers of OpenSSL are completely incomptent and deserve to have the project forcefully taken out of their hands.
Now *there's* one that needs a cut-the-fat do-over.
Notice that Theo doesn't have the goal of making LibreSSL BSD-only.
It's not about a better OpenSSL. It's about OpenBSD waving its penis around. That's all it is. The OpenSSL team is amenable to aid; but they have two developers and no help.
Well perhaps the OpenSSL folks need to examine how they're organized then.
There are reports that the OpenSSL Foundation got $2 000 for all of 2013. Meanwhile the FreeBSD Foundation got $750 000 in 2013, and are aiming for $1 million in 2014. The OpenBSD Foundation's goal for 2014 was $150K, which they reached.
I'm sure given OpenSSL's importance that they could match (and probably exceed) these other two projects, and get a proper staff.
How about going retro with iSSL or eSSL? Or maybe xSSL - X's are always cool.
Yes, they goofed. However, is anyone else volunteering their time for a project that at best is an entry on a resume? The OpenSSL coders are paying a dear opportunity cost for doing their work. they could easily be making far more per month by making another F2P/P2W app for iOS.
IMHO, if one thinks they can do better, then go for it. It is easy to be an armchair coder and tsk-tsk about other people's mistakes. It is a lot harder to be actually producing and debugging hundreds of thousands of lines of code... earning zero for the task.
After stripping out all of the unnecessary bloat, you would be left with BSDinit. There really is no need to go through all that trouble since BSDinit is already available. Stable, robust, sane, and works great on Unix or Linux.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
The Statue of Liberty (Liberty Enlightening the World; French: La Liberte eclairant le monde) is a colossal neoclassical sculpture on Liberty Island in the middle of New York Harbor, in Manhattan, New York City. The statue, designed by Frédéric Auguste Bartholdi and dedicated on October 28, 1886, was a gift to the United States from the people of France
(*): accents removed since slashdot seems unable to handle them
OpenOffice -> LibreOffice
...
?
OpenSSL -> LibreSSL
Will the next be
OpenSSH -> LibreSSH
OpenBSD -> LibreBSD
OpenStack -> LibreStack
A while ago... the common init startup procedures have been ignored by the Linux community and they developed their own Unix-incompatible way to start the system and even pollute many common applications with it so incompatibilties will be everywhere soon. And it keeps going on with KDBUS and so on..
Now when OpenBSD touches a central library it is ultimately bad for everyone, even when they don't destroy compatibility as much as it seems. Who uses VMS or pre-Windows-2000 systems today? Most of those people don't care about a new version of SSL anyway.
That one is easy: Just throw it away completely. Systemd is a major redesign of a major, critical Linux component.You would think that there is a very good, solid, compelling reason to do so. Apparently all they really have is "it boots faster". (And apparently id does not even do that in quite a few circumstances...)
My personal theory is that the NSA planned systemd as a project to sabotage Linux security (remember that Red Hat is primarily funded by the US military): Put an incompetent team with big egos in charge (Poettering and Sivers are certainly that), give them delusions of grandeur, make sure the BSD people ignore it by explicitly denying portability, and then just wait while the cretins produce a bloated, easy-to-exploit mess. (This "init-system" includes a freaking web-server! How stupid can you get?)
No need to place any backdoors, and all the countless vulnerabilities are genuine mistakes! Genius!
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm not gunna use no "liberal SSL", might as well just call it "socialist SSL" and get it over with.
They should call it "FREEDUMB:SSL" and make everybody happy.
Or at least "rePun SSL". Sorry, it's hard finding a use for that -ZL sound.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Why not call it egoSSL in honor of Theo DieRat!
Remove those stinking French Words from our purified bodily liquids !
Maybe gnuTSSlapp - Gnu TLS/SSL libre all privacy project . That sounds like it would fit the bill.
Good job, you figured out why they chose that name. However, it's unrealistic that anyone would want to fork OpenSSH or OpenBSD.
The entire IT community is deep in love with "new, new, new". So we can new kernels with new features, new file systems, new browser features, new codecs. Did I tell you that you can now read your dog's neckband with Linux version 3.5.1.77-NEW ??
But only a few or no people make the effort to prove correctness of the kernel and the compilers and a basic web browser. That new-disease makes it incredibly easy for the Powers to find exploits. And that is exactly how they want it to be.
If we ever want "secure IT", we first need proven correct foundations like compilers, kernels, IP stacks. Will that ever happen ? I am sceptical.
They license the code so people can use it free of charge. Now they complain that people are using it free and not contributing back to the opensource community. Boohoo.
This. Seriously. People may not think that appearance is important, but it is. Comic Sans does not inspire confidence.
WEB HIPSTER DETECTED! ;)
How the fuck does this kind of trolling/tin-foil-hattery get to +5? The only "Interesting" thing about it is the apparent level of paranoia being experienced by gweihir. I mean, Red Hat as an NSA tool to Destroy Linux? Sure!
I get it, some folks hate systemd and everything Lennart does (and I'm not picking sides anymore), but the parent is just a smear job.
But lets just read this again:
the project has already removed 90,000 lines of C code and 150,000 lines of content.
The project further promises multi-OS support once they have proper funding and the right portability team in place
Remove current code for Windows and VMS support = check.
Wait for funding to code in Windows and VMS support back in = check
Pull the other one guys, honestly.
Anyone can remove code from someone elses project and make it more "optimized". The whole point is to either replace that with newer code, not ask for money to put it back in.
Your basically stealing the work of OpenSSL and using the current heartbleed as a goat to get funding for your project.
I wonder what, if any functionality they are removing.
To me, this just seems like they're trying to jump in quickly to take advantage of the OpenSSL FUD train to create a new "standard" that everyone will quickly switch to in a knee-jerk reaction, without really thinking the matter through, only to come out later and demand money from O/S vendors to re-integrate support for their O/S that was previously "deoptimized" from the OpenSSL code they're starting with...
Am I wrong?
The OpenSSL coders are paying a dear opportunity cost for doing their work.
Bullshit. They're obviously not doing this full time, or they would have caught and fixed the Heartbleed bug long ago. And if they ARE doing this full time, then they're compeltely incompetent at their job. ("You had one job!")
IMHO, if one thinks they can do better, then go for it.
That's exactly what they're doing. This is a hostile takeover of the project. :)
p.s. Now you can go get a real job and/or go make Fwp/P2W apps for iOS instead of pretending to maintain OpenSSL. :-D
...but it seems to be a key player in Project Atomic.
This seems to be Red Hat's analog of Solaris "Zones" which let you give root to someone you don't trust in an isolated sandbox on your system. It appears to go further than zones in that you can exchange these sandbox images, with all of their installed software, with other systems. This lets you virtualize without running multiple kernels, yeilding a tremendous savings of memory. The additional assertion is that 3rd party software sales will be of these complete sandbox images, not an RPM/tarfile.
I will have a bit of studying to do for Red Hat 7. These are compelling new features, seemingly well worth the initial bugs.
p.s. just don't pass debug to grub.
There is an OpenBSD fork. It's called Bitrig.
No reason to reinvent that.
I am very small, utmostly microscopic.
The last time I tried it, it didn't even recognize my USB keyboard or mouse so it was completely and entirely useless. Seems like they should focus their attention on making an OS that works on computers built within the past decade instead of forking other projects' code.
Maybe that's how it's so secure?
It started back in Team Fortress Classic
Let us hope that people now realize that attention needs to be given to critical components such as SSL. I also hope that in a year or ten, Theo de Raadt isn't in the same position as Robin Seggelmann - where some flaw slips in and kaboom. I try to contribute a few $ as a private user to open source projects. The big onus lies on companies who use open source to save millions in MS-costs, etc to contribute liberally to these projects. Thankfully a few great companies even allow people to work on these open source projects during their normal work time (on the clock).
it's like the sound of something going over your head - but you don't actually hear it.
(Other examples: ATM machine, PIN number, hot water heater)
WideOpenSSL!
If anyone's looking to grok it and potentially get involved, there's a fast OpenGrok available:
http://bxr.su/o/lib/libssl/src...
Is to create another OS alternative to replace the broken one? lol
What about PolarSSL, a professional alternative ?
OpenSSL.org claims the licenses are "BSD-style", but that's like putting a cow patty on your head and calling it a yarmulke. How is OpenBSD planning to get around that little hurdle?
OpenBSD already has your LibreSystemd, it's called the BSD rc script system. it fucking works, bitches.
Already in progress:
http://www.google-melange.com/gsoc/project/details/google/gsoc2014/kremlin/5639274879778816