Slashdot Mirror
OpenSSL To Undergo Security Audit, Gets Cash For 2 Developers
Trailrunner7 (1100399) writes "Scarcely a month after announcing the formation of a group designed to help fund open source projects, the Core Infrastructure Initiative has decided to provide the OpenSSL Project with enough money to hire two full-time developers and also will fund an audit of OpenSSL by the Open Crypto Audit Project. The CII is backed by a who's who of tech companies, including Google, Microsoft, IBM, the Linux Foundation, Facebook and Amazon, and the group added a number of new members this week, as well. Adobe, Bloomberg, HP Huawei and Salesforce.com have joined the CII and will provide financial backing. Now, the OCAP team, which includes Johns Hopkins professor and cryptographer Matthew Green, will have the money to fund an audit of OpenSSL, as well. OpenSSL took a major hit earlier this year with the revelation of the Heartbleed vulnerability, which sent the Internet into a panic, as the software runs on more than 60 percent of SSL-protected sites."
The whole security model is broken. How many CAs does your browser come with these days? Do you even know? How do you know they haven't already turned over their CA signing keys to 7 different governments?
There's no way to "fix" openssl. The entire thing is predicated on a false premise.
While I applaud the efforts and support I do hope that the work of others will not be ignored. The audit is great news, but I do hope the existing and new developers will look to LibreSSL for code updates, ideas and their own audit results. If we can get a nice bidirectional and completely cooperative flow between the two projects than hopefully the final result will be a highly secured, audited product that we can all use.
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
The comments from the folks who started LibreSSL at a meeting of the Calgary Unix Users Group the other night were beyond scathing. Bob Beck's first slide shows Laura Dern in Jurassic Park, up to her elbows in stegasaurus dung, as a metaphor for what the first skim of the code felt like. It's a hopelessly overpatched mess of spaghetti code and #IFNDEF mazes that nobody can really maintain. Their fork has already tossed out tens of thousands of lines of code and started again. (Another slide shows the line from Aliens: "Nuke it from orbit. It's the only way to be sure").
If not a from-scratch rewrite, think of a home reno where you have to strip it to the frame and put up new drywalls.
And this situation was allowed to grow by the current bunch that manage OpenSSL; they're only doing this at all because one of the hundreds of time-bombs in the code finally went off, and anybody who's looked it knows how many hundreds more there are. For shame.
There's a link to the slides from the libressl.org site, which is very minimal, as they say "We're too busy deleting code to make web pages".
It was just a very sobering presentation. To think we let so much depend on a pile of cruft.
http://www.libressl.org/
seriously pumping openssl full of cash at this point is like buying new deck chairs for the titanic.
Good people go to bed earlier.
Two developers added to an already crummy project? Ha! I'll send my money to the OpenBSD project, instead. OpenSSH and pf are just two examples of how they got the job done when outside projects fail to deliver. They'll do the same with LibreSSL, and in a year most everybody will have switched.
Send the OpenBSD project some money: http://www.openbsdfoundation.org/
The issue that I find, is that OpenSSL is the only Open Source Player out there.
But It is not the only SSL/TLS game in town. There is also GnuTLS and Network Security Services (NSS).
/^([Ss]ame [Bb]at (time, |channel.)){2}$/
Why give these guys money? Start afresh like the BSD guys are doing. I suspect they don't want to lose their juicy consulting gigs.
There are alternatives, although I can't comment on how they compare with OpenSSL.
GnuTLS (LGPLv2.1)
Mozilla Network Security Services (Mozilla Public License)
PolarSSL (GPL2 and proprietary).
MatrixSSL (GPL and proprietary
the fact that these companies haven't even addresses the other MASSIVE flaw with openssl (which the OpenBSD team has dealt with already) shows they have no grasp of the issues
In Ubuntu or Debain... Can you Apt-get Apache to use these instead?
Actually that is a serious question. I never saw those as an option.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
...Humans make mistakes. Clever people make just as many mistakes....
You left out the part about clever people not continuing to make the same mistakes over and over.
.
The problem with OpenSSL is not that mistakes were made.
The problem is that mistakes were made and the developers did not learn from those mistakes, did not seem to care about fixing those mistakes, and did not care about preventing similar mistakes from recurring.
And Apple's SSL.
> ... One big mistake is not a reason to scorch and salt the earth.
Listen, lad. I've built this kingdom up from nothing. When I started here, all there was was swamp. All the kings said I was daft to build a castle in a swamp, but I built it all the same, just to show 'em. It sank into the swamp. So, I built a second one. That sank into the swamp. So I built a third one. That burned down, fell over, then sank into the swamp. But the fourth one stayed up.
An' that's what your gonna get, lad -- the strongest castle in these islands.
1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
Already now I have the trusted third party option. Moxie has started a service offering this: http://convergence.io/
FYI: LibreSSL is a fork of OpenSSL that started over a month ago.
http://www.libressl.org/ [libressl.org]
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
The problem is that mistakes were made and the developers did not learn from those mistakes, did not seem to care about fixing those mistakes, and did not care about preventing similar mistakes from recurring.
To play Devil's advocate (or rather, advocate of the developers): if they were a properly resources software-development team, they might have been better able to pay off the technical-debt accumulating in the codebase. Hopefully this injection of resources will change things for the better. (The LibreSSL crew seem to be making good progress on the technical debt front, also.)
Meanwhile, in Git's crypto code.
(Linked from this blog entry.)
By writing it in macros the code is moderately human-readable, while giving the performance benefits of actually being written in assembly. By doing it that way the compiler also has the opportunity to optimize the assembly somewhat.
I saw those slides. There were 17 levels of #ifdefs in the code. Every ifdef is a binary switch, which means 2^17 different iterations of source code.(!!!!!) That's 131072 different compiles (!!!!!!).
So, lets pretend that a config/make sequence just needs 10 minutes (unlikely, they have an oddball config script that isn't like autoconf). To hit 17 levels of ifdef, you'd need approx 910 computer-days just to do all the compiles. Do you think they tested this matrix?
I hate to beat up on a bunch of people who did hard work for free, but they really did a bad job on a lot of things.
I've been on Slashdot too much, i read it as "10 Micro$softs of wasted time"
Hiring two fulltime dedicated programmers? Seems like a good thing to me.
Submitting their work to a separate entity for auditing and verification? Sounds like a good thing to me.
As long as the various business entities involved in the auditing stick to that mandate and don't start trying to directly influence the development or design of OpenSSL, it all sounds good to me. Otherwise, we're likely to end up with CDE, the Common Desktop Environment.