Slashdot Mirror
Once a Forgotten Child, OpenSSL's Future Now Looks Bright
Trailrunner7 writes: Rarely does anything have a defined turning point in its history, a single day where people can point and say that was the day everything changed. For OpenSSL, that day was April 7, 2014, the day that Heartbleed became part of the security lexicon. Heartbleed was a critical vulnerability in the venerable crypto library. OpenSSL is everywhere, in tens of thousands of commercial and homespun software projects. And so too, as of last April, was Heartbleed, an Internet-wide bug that leaked enough memory that a determined hacker could piece together anything from credentials to encryption keys.
"Two years ago, it was a night-and-day difference. Two years ago, aside from our loyal user community, we were invisible. No one knew we existed," says Steve Marquess, cofounder, president and business manager of the OpenSSL Foundation, the corporate entity that handles commercial contracting for OpenSSL. "OpenSSL is used everywhere: hundreds, thousands of vendors use it; every smartphone uses it. Everyone took that for granted; most companies have no clue they even used it." To say OpenSSL has been flipped on its head—in a good way—is an understatement.
Heartbleed made the tech world realize that the status quo wasn't healthy to the security and privacy of ecommerce transactions and communication worldwide. Shortly after Heartbleed, the Core Infrastructure Initiative was created, uniting The Linux Foundation, Microsoft, Facebook, Amazon, Dell, Google and other large technology companies in funding various open source projects. OpenSSL was the first beneficiary, getting enough money to hire Dr. Steve Henson and Andy Polyakov as its first full-timers. Henson, who did not return a request to be interviewed for this article, is universally known as the one steady hand that kept OpenSSL together, an unsung hero of the project who along with other volunteers handled bug reports, code reviews and changes.
"Two years ago, it was a night-and-day difference. Two years ago, aside from our loyal user community, we were invisible. No one knew we existed," says Steve Marquess, cofounder, president and business manager of the OpenSSL Foundation, the corporate entity that handles commercial contracting for OpenSSL. "OpenSSL is used everywhere: hundreds, thousands of vendors use it; every smartphone uses it. Everyone took that for granted; most companies have no clue they even used it." To say OpenSSL has been flipped on its head—in a good way—is an understatement.
Heartbleed made the tech world realize that the status quo wasn't healthy to the security and privacy of ecommerce transactions and communication worldwide. Shortly after Heartbleed, the Core Infrastructure Initiative was created, uniting The Linux Foundation, Microsoft, Facebook, Amazon, Dell, Google and other large technology companies in funding various open source projects. OpenSSL was the first beneficiary, getting enough money to hire Dr. Steve Henson and Andy Polyakov as its first full-timers. Henson, who did not return a request to be interviewed for this article, is universally known as the one steady hand that kept OpenSSL together, an unsung hero of the project who along with other volunteers handled bug reports, code reviews and changes.
It was a big load of toss.
Revisionist shitstory.
The OpenSSL declared themselves emperors of security. They declared you knew shit and could help. They declared their cloth was whole.
These emperors were shown to wear no clothes. They weren't secure, they were pompous asses.
All the eyes don't matter when the gate keeper sucks.
Someone has to be shilling to post a summary like that one. The only future for OpenSSL is to be replaced over time by LibreSSL or another competitor.
Also: "...every smartphone uses it."
Do any smartphones use openssl? Android uses BouncyCastle and Apple uses their own crypto libraries (they provide openssl for compatibility purposes on OSX, but not iOS). Microsoft has their own crypto libraries, too, so I doubt Windows Phones use openssl...
OpenSSL.... yeah, right, whatever.
LibreSSL is the one that deserves all the credit and support.
With a smaller team and zero experience working with the codebase, LibreSSL has consistantly beat OpenSSL to the punch regarding ripping out trash, rendering and refactoring garbage into sanity, and fixing bugs.
OpenSSL should have been doing this all along but were just lazy, not competent, poorly organized, etc.
And now they just go all "we're a foundation now" and reap kudos from the world?
BAH, totally undeserving.
And all you're going to get is the same crap in the tarball instead of new original thoughts.
To be fair, EAY wrote SSLeay in the mid-90s when standards were a secondary consideration, and compilers frequently generated incorrect code - while being infrequently updated. On top of that, there were no practical cross-platform build systems. It's easy to look at 'clean' code like PolarSSL, GnuTLS, etc., and conclude that they're better. The fact is, they haven't really been tested. I don't see countermeasures for cache timing attacks in many of the come-lately SSL/TLS libraries. The GnuTLS 'bignum' code is fucking amateur hour stuff. Even the bloated and exception-unsafe GMP library has better secure functions, despite the fact that it drops dead at the first sign of trouble, and is utterly unsuitable for embedded or secure environments.
LibreSSL is going to be another 'NIH' project that will spend the next decade being patched by people who realise that crypto software can't be left to dilettantes.
.
So how was the problem with OpenSSL solved?
Well, the same people, with their same ideas, who could not run a successful project in the past were given large amounts of money to run the project in the future. The summary for this thread reads more like a self-congratulatory press release from the OpenSSL people, rubbing in our faces that they managed to get money to continue their poor project management.
Why couldn't Henson even be bothered to respond to the request for an interview, much less be interviewed?
For fuck's sakes, man. You're now fully employed for OpenSSL. Would it kill you to do an interview?
Please help metamoderate.
The diffs are huge every single time, despite the releases being boring bug and security fixes. Things that shouldn't need more than twenty lines each.
% diff -rNU 0 openssl-1.0.1[lm]|wc
675635 2681760 21556437
Twenty-one megabytes. 675 thousand lines changed.
Here's the changelog between 1.0.1L and 1.0.1M, for two months of bugfixes:
Changes between 1.0.1l and 1.0.1m [19 Mar 2015]
*) Segmentation fault in ASN1_TYPE_cmp fix
[detailed descriptions snipped]
*) ASN.1 structure reuse memory corruption fix
*) PKCS7 NULL pointer dereferences fix
*) DoS via reachable assert in SSLv2 servers fix
*) Use After Free following d2i_ECPrivatekey error fix
*) X509_to_X509_REQ NULL pointer deref fix
*) Removed the export ciphers from the DEFAULT ciphers
Twenty-one megabytes for seven fixes. What the hell are they doing with their source code to create that much churn?
"Slow Down Cowboy! It's been 58 minutes since you last successfully posted a comment" -- slashdot, driving users away.
For the "many eyes" to work, there are quite few requirement.
Yes, being opensource is a requirement, but is not the single only requirement.
The code need to be actually readable and to attract users motivated to check it.
That wasn't the case. OpenSSL's code is known to be really crappy, with lots of bad decisions inside. Any coder trying to review it will have their eyes starting to bleed.
It doesn't attract people who might review it. It only attracts the kind of people who just want to quickly hack a new feature and slap it on the top, without having a look at what's running underneath.
The code need also to be reasonably accessible to code review tools.
Lots of reviewers don't painfully check every single last line of code by hand. Some use tools to do controls. OpenSSL has had such a series of bad decision in the past, that the resulting piece of neightmare is resistant to some types of analysis.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]