Slashdot Mirror
Not Just a Cleanup Any More: LibreSSL Project Announced
An anonymous reader writes "As some of you may know, the OpenBSD team has started cleaning up the OpenSSL code base. LibreSSL is primarily developed by the OpenBSD Project, and its first inclusion into an operating system will be in OpenBSD 5.6. In the wake of Heartbleed, the OpenBSD group is creating a simpler, cleaner version of the dominant OpenSSL. Theo de Raadt, founder and leader of OpenBSD and OpenSSH, tells ZDNet that the project has already removed 90,000 lines of C code and 150,000 lines of content. The project further promises multi-OS support once they have proper funding and the right portability team in place. Please consider donating to support LibreSSL via the OpenBSD foundation."
LibreSSL.... Please for the love of code, change the name!
'Nuff said
you use polarssl. Which is already exactly that.
Religion is what happens when nature strikes and groupthink goes wrong.
They never claimed they were.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
There's something at the bottom of the page.
"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"
This. Seriously. People may not think that appearance is important, but it is. Comic Sans does not inspire confidence.
Koans and fables for the software engineer
finds out openssl is bollocks,
radically refactors and overhauls millions of lines of code.
as for the LibreSSL team, might i suggest some music?
http://www.openbsd.org/lyrics....
http://www.openbsd.org/lyrics....
Good people go to bed earlier.
Who thinks it's important? Who'll decide to switch or not based on a font on a website? Why?
I'd say it's puerile -- and a bit alarming, considering these people are building something so important to the continued health of the internet.
They DO OpenSSH. And other projects: http://www.openbsdfoundation.org/
Don't fork SSL, we need to keep one standard, I'd think. This is a bad idea. These resources could be used to improve OpenSSL directly.
Granted, the OBSD team has a known personality.
That said, diffs to remove compatibility would likely be rejected. Also, the rate at which they're being submitted wouldn't be verifiable by the OpenSSL team.
Plus, it's better to have multiple libraries.
This is for the better.
Typefaces by their nature are designed to convey a specific emotions. It's the whole reason we don't simply convey written information in one fixed typeface; some are more appropriate than others given the situation.
Comic Sans in particular is designed to imitate comic book lettering. It's not particularly professional. In the wake of the OpenSSL bug, many people were questioning open source in general, saying (not rightfully, but saying nonetheless) that the Heartbleed bug was caused by a bunch of amateur volunteers. i.e. open source is not developed by professionals. Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
Maybe in 2000, I would have cared but no longer. OSS is very well established and is in plenty of cases the leading option. If people want to make stupid emotional decisions, then it's time to let them. No actually, it's time to encourage them because it means I will have fewer serious competitors of the competition hamstring themselves with ill-informed emotional decisions.
SJW n. One who posts facts.
Maybe not as pell-mell as it is opportunistic.
The key reason OpenSSL is so popular in US is because the project is on top of FIPS certifications. LibreSSL might cure cancer, but very few system integrators will use it unless it has certified module.
In the wake of the OpenSSL bug, many people were questioning open source in general, saying (not rightfully, but saying nonetheless) that the Heartbleed bug was caused by a bunch of amateur volunteers. i.e. open source is not developed by professionals
Except you're right, it was caused by half-assing what was supposed to be a good feature, because the programmers decided they would just stop and come back to it later. But now we have *different* amateur volunteers working on it! Problem solved!
Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
Maybe in 2000, I would have cared but no longer. OSS is very well established and is in plenty of cases the leading option. If people want to make stupid emotional decisions, then it's time to let them. No actually, it's time to encourage them because it means I will have fewer serious competitors of the competition hamstring themselves with ill-informed emotional decisions.
They're pleading for donations. Are you comfortable being the sole donor, too?
LibreSSL.... Please for the love of code, change the name!
I wish they would start a naming contest soon.
There ought to be _someone_ out there who can come up with some much better name than "LibreSSL" ...
Muchas Gracias, Señor Edward Snowden !
I'd say it's puerile -- and a bit alarming, considering these people are building something so important to the continued health of the internet.
But it goes right along with the notion that they are not even considering helping the original OpenSSL project (one that they have benefited greatly from in the past) and instead simply forked it in order to do only work that benefits themselves. The "we will get around to multiplatform when the donations pour in" is about as pathetic as the "we will get around to fixing that vulnerability countermeasure code later" that caused Heartbleed in the first place. If Heartbleed didn't scare people away from Free/Open Source software, then this surely will. Mission accomplished, Theo!
At the moment we are too busy deleting and rewriting code to make a decent web page. No we don't want help making web pages, thank you.
SSSL - Secure SSL
After stripping out all of the unnecessary bloat, you would be left with BSDinit. There really is no need to go through all that trouble since BSDinit is already available. Stable, robust, sane, and works great on Unix or Linux.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
The OpenSSH security track record is excellent, almost perfect.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The Statue of Liberty (Liberty Enlightening the World; French: La Liberte eclairant le monde) is a colossal neoclassical sculpture on Liberty Island in the middle of New York Harbor, in Manhattan, New York City. The statue, designed by Frédéric Auguste Bartholdi and dedicated on October 28, 1886, was a gift to the United States from the people of France
(*): accents removed since slashdot seems unable to handle them
You seem to have missed the line at the bottom...
The link to OpenSSL is funny too ;-)
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
OpenOffice -> LibreOffice
...
?
OpenSSL -> LibreSSL
Will the next be
OpenSSH -> LibreSSH
OpenBSD -> LibreBSD
OpenStack -> LibreStack
Fait accompli, apparently. :D
Well played, Theo et al.
A while ago... the common init startup procedures have been ignored by the Linux community and they developed their own Unix-incompatible way to start the system and even pollute many common applications with it so incompatibilties will be everywhere soon. And it keeps going on with KDBUS and so on..
Now when OpenBSD touches a central library it is ultimately bad for everyone, even when they don't destroy compatibility as much as it seems. Who uses VMS or pre-Windows-2000 systems today? Most of those people don't care about a new version of SSL anyway.
That one is easy: Just throw it away completely. Systemd is a major redesign of a major, critical Linux component.You would think that there is a very good, solid, compelling reason to do so. Apparently all they really have is "it boots faster". (And apparently id does not even do that in quite a few circumstances...)
My personal theory is that the NSA planned systemd as a project to sabotage Linux security (remember that Red Hat is primarily funded by the US military): Put an incompetent team with big egos in charge (Poettering and Sivers are certainly that), give them delusions of grandeur, make sure the BSD people ignore it by explicitly denying portability, and then just wait while the cretins produce a bloated, easy-to-exploit mess. (This "init-system" includes a freaking web-server! How stupid can you get?)
No need to place any backdoors, and all the countless vulnerabilities are genuine mistakes! Genius!
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm not gunna use no "liberal SSL", might as well just call it "socialist SSL" and get it over with.
They should call it "FREEDUMB:SSL" and make everybody happy.
Or at least "rePun SSL". Sorry, it's hard finding a use for that -ZL sound.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
They just come over as a bunch of complete, smug, self-absorbed wankers.
*golf clap*
I look forward to new and interesting side-effects of the pell-mell rush to clean up the code of a poorly written, poorly maintained, and even more poorly documented software package!
more poorly documented than OpenSSL?
the OpenBSD team creates some of the best documentation out there.. it is one of their major accomplishments and clearly important to them.
if all they did were document it, openSSL would be better off for it.. they are forking it, improving the code and documenting it.
Of course, they arent gods, perhaps mistakes will be made.. but this team is known for producing high quality code and high quality documentation.. .. i think that you couldn't be any further from the mark with your flippant remark mr AC!
Did you screw up the config? That will get you rooted...
Otherwise, please supply a CVE number for the vulnerability responsible.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You did notice that "legacy" in the thing you quote? You can run OpenSSH with insecure settings or with protocol version 1.0. But if you use these you are supposed to look at the security trade-offs yourself. The thing is that it is not OpenSSH that is insecure here, it just allows you to shoot yourself in the foot after warning you.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
they are not even considering helping the original OpenSSL project (one that they have benefited greatly from in the past) and instead simply forked it in order to do only work that benefits themselves.
so youre suggesting that the maintainers of OpenSSL would have gladly allowed some new kids on the block come in and remove over 200,000 lines of stuff ? and that the new kids on the block are being lame for not trying to do so?
I think this move kind of strikes to the heart of the benefits of opensource projects. When someone decides they want to go in a different direction, they can. This direction is clearly (judging by the nearly 100,000 lines of code removed) different than the one the OpenSSL team is on..
The openbsd team supports over 20 platforms already. Deciding on on not supporting libressl on those 20 platforms before theyre even finished with the main bulk of the work seems pretty reasonable to me... and of course, it will be opensource.. you can go support other platforms if you want!
if you've got an axe to grind against Theo, and the openbsd team thats fine..... but at least you can be reasonable about this.. there is no evidence that the openbsd team has the same mentality as those in the openssl team had when it comes to making secure and correct code..
using funding to decide how/when theyll support other platforms doesnt relate in any way to the attitudes that caused the heartbleed bug... in fact, it might show that they wouldnt want to put a half-effort into something which they cannot use all of their resources on... which is a good thing.
They license the code so people can use it free of charge. Now they complain that people are using it free and not contributing back to the opensource community. Boohoo.
I don't think they care about how their font is interpreted.
I think this is more like - we're busy actually fixing code and not going to hire a team of web designers to produce a web 2.0 dynamic social-media-hooked-into website with a few links and a bit of text.
This. Seriously. People may not think that appearance is important, but it is. Comic Sans does not inspire confidence.
WEB HIPSTER DETECTED! ;)
And your post goes right along with the notion that Slashdot is filled with shitheads.
Yeah basically this. The sense of entitlement from people is quite astonishing. It's not good enough that they provide a free, amazingly secure OS, a free suite of SSH tools used by the entire world and are provideing a complete, open, audited implementation of SSL apparently.
No, they should do more, for free on their own time.
SJW n. One who posts facts.
How the fuck does this kind of trolling/tin-foil-hattery get to +5? The only "Interesting" thing about it is the apparent level of paranoia being experienced by gweihir. I mean, Red Hat as an NSA tool to Destroy Linux? Sure!
I get it, some folks hate systemd and everything Lennart does (and I'm not picking sides anymore), but the parent is just a smear job.
SSSL - Secure Secure Socket Layer is that like when people say LAN Network - Local Area Network Network
Are you retarded? For the trillionth time, OpenBSD had nothing to do with OpenSSL until they forked it? Learn how to fucking read.
Luckily though, they have a history of completing quality software to back up such an attitude. That's way better then the countless shitty projects with websites that push the very limits of jQuery and have beautiful CSS, but are only half-functional at best and riddled with security holes and have an obnoxious focus on spreading the word via facebook and a dozen other social sites.
Actually, they went out of their way to make the website look so bad and added a snarky, unprofessional comment about "web hipsters" to play that fact up. If they had spent less time on the site it would have actually looked better. This is completely disregarding the fact that making a decent looking site takes maybe half an hour. The website they created completely *distracts* from the project.
Instead we have yet another open source project run by myopic developers. You know, people who want to develop, and only want to develop. Ancillary things like project maintenance, management, and fund raising are those not fun, boring things that developers don't want to do.... and which got OpenSSL into trouble in the first place.
I wonder what, if any functionality they are removing.
...but it seems to be a key player in Project Atomic.
This seems to be Red Hat's analog of Solaris "Zones" which let you give root to someone you don't trust in an isolated sandbox on your system. It appears to go further than zones in that you can exchange these sandbox images, with all of their installed software, with other systems. This lets you virtualize without running multiple kernels, yeilding a tremendous savings of memory. The additional assertion is that 3rd party software sales will be of these complete sandbox images, not an RPM/tarfile.
I will have a bit of studying to do for Red Hat 7. These are compelling new features, seemingly well worth the initial bugs.
p.s. just don't pass debug to grub.
Yep, I couldn't have put it better. I don't think they understand how that landing page (and the comment you mention) will actually reduce the likelihood that visitors will trust their professionalism or donate to their efforts.
Koans and fables for the software engineer
I had the same idea. But I was actually serious.
I think they could called it "ClosedSSL."
"You are still using OPEN ssl? Are you crazy? Used this CLOSED ssl to keep hackers out."
It's not like they can steal openssl login credentials and just fix all the code and make a new release for them.
Unless OpenSSL is still using their original code :)
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
Just my point. The OpenSSH project has done its learning and reached a quite high level of quality 10 years or more ago. Ans as it does what it is supposed to, there is no need to add features, making it even more secure.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Yes. See: OpenSSH.
They are not going to put back in the original code. They will build a proper portability layer. Just like what was done for OpenSSH.
There is an OpenBSD fork. It's called Bitrig.
That will take time. The first versions will try to be API compatible because of the huge base of existing software. The future will see incremental API improvements as people learn from their experiences.
No reason to reinvent that.
I am very small, utmostly microscopic.
The last time I tried it, it didn't even recognize my USB keyboard or mouse so it was completely and entirely useless. Seems like they should focus their attention on making an OS that works on computers built within the past decade instead of forking other projects' code.
Maybe that's how it's so secure?
It started back in Team Fortress Classic
They are not going to put back in the original code. They will build a proper portability layer. Just like what was done for OpenSSH.
For which they want funding, before they will begin that work.
Let me put it to you as simple as possible, from their point of view:
"we waited for the heartbleed issue to be public. Then used it for our advantage"
"we removed 90k lines of code and removed support for multiple os's"
"we now require funding, before we carry on work"
I smell money grabbing bullshit to be honest.
Remove 90k lines of someone else's code and demand money? Finish the job, or dont bother starting it.
If anyone's looking to grok it and potentially get involved, there's a fast OpenGrok available:
http://bxr.su/o/lib/libssl/src...
Is to create another OS alternative to replace the broken one? lol
I didn't understand what you were talking about until I checked the CSS's source. :)
They forgot to embed Comic Sans, so unless you installed it manually, you'll just see plain Sans.
They missed a trick tho, they could have had a few of these under the Other OS's title :)
yes, the team has proven themselves cleaning up BSD and many other projects. they have creds and accomplishments in that field
suck on this thermometer: http://www.openbsdfoundation.o...
OpenBSD already has your LibreSystemd, it's called the BSD rc script system. it fucking works, bitches.
wrong, they are working already. They've been working for years. They have been getting funding for years. They have proven projects that benefit everyone. They are merely asking for more donations: http://www.openbsdfoundation.o...
what is wrong with that, they have long track record of success.