Hacker News Reader

Comment by Animats | Hacker News Reader

That's forward progress. How did OpenSSL ever get to be so complicated, anyway? They still have 200,000 lines of code. It doesn't do that much.

View on HN

It helps if you understand that OpenSSL is itself a fork of an earlier SSL library, SSLeay, which Eric Young has said was a project he used to learn C with; SSLeay goes all the way back to the days when you needed to pay for a special license for Apache-SSL. It's very, very old code.

That's not correct, it was to learn bignum arithmetic not C.

Citation: https://twitter.com/eay4young/status/377209505513504768

It actually started as a wrapper around Young's much earlier DES implementation, written as a drop-in replacement for Solaris's DES tools which were unavailable outside the US because of export restrictions.

I know this because I've dealt with a company that distributes files in Solaris-compatible DES format from an unencrypted FTP server and helpfully supplies Young's libdes to interface with it.

Well, at least it isn't EBCDIC...

It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL[1] (Ted's there too).

[1]: https://www.youtube.com/watch?v=GnBbhXBDmwU

I love how OpenBSD is consistent about using Comic Sans in their material.

They clearly haven't lost their sense of humour despite working with this terrible material. Lesser men would turn cynical over half the things they have to endure :)

The discussion of Big Endian amd64 support at 38:50 in that video is hilarious and scary.

That whole discussion on the slide from 38:50 is hilarious and scary.

"You can't turn off the debugging malloc but you can turn off sockets"

"If the size of socklen_t changes while your program is running, OpenSSL will cope"

Big Endian AMD64? Cisco support? iOS compiled big endian to little endian? WTF!? Lmao crazy on so many levels...

EDIT to add:

Epic observation: "The good news is: if the size of socklen_t changes while your program is running, then... (other guy) OpenSSL will cope." Lol.

If I remembered correctly Cisco was using PowerPC and it was big endian. I do believe that might be a factor in the madness.

Probably thought it would be easier to write a converter than figure out how to change their code without breaking it. That's my guess. Wouldn't have even been a problem if Intel/AMD had chosen the best endianness. ;)

Reply on news.ycombinator.com