Hacker News Reader

Comment by AdamH12113 | Hacker News Reader

I think people are wildly missing the point here. This GUI mock-up is not about improving usability, it's a comment on the hideous complexity of OpenSSL. The visible tab's options represent, in the words of the author, "80% of one corner of OpenSSL’s functionality". There are 45 tabs shown. On my monitor, this one tab is over two pages long. If the other tabs average out to a similar length, there would be around 100 pages of options available.

That is too much complexity for a single security-critical program.

View on HN

OpenSSL is a "swiss army knife" for all things security... making a bad (mock) gui makes it look a lot more terrible than it really is. Imagine the same gui for bash settings, ffmpeg or even just a browser (just look at the size of about:config!)

Most people do just one of a few operations, where they copy-paste the commands found online, as they do with windows registry, firefox about:config or ffmpeg, so it's no different than that.

> ffmpeg

You mean like this? https://iangetz.com/projects/ffmpeg-builder/

I'm a CLI guy, but `openssl` is insanely complex and I think it would benefit the ecosystem immensely if someone built a wrapper CLI that made it easier to complete the small handful of popular use cases that 90% of us have to go to Google to remember.

I have seen many tutorials using CloudFlare's `cfssl` as an alternative.

That is just a small subset of ffmpeg commands, here's the full list:

https://gist.github.com/tayvano/6e2d456a9897f55025e25035478a...

If you make a GUI out of this, it will be a pain in the ass... and ugly!

Luckily, there are many ffmpeg frontends, that select just a tiny subset of commands that are most often needed (like yours and many others), and the same things exist for openssl, eg:

https://hohnstaedt.de/xca/

>if you make a GUI out of this, it will be a pain in the ass

I guarantee you, 10000%, that it will still be more usable than CLI is without having to google everything. FFMPEG is so complex that doing anything with it feels like talking in some ancient archaic code known only to the video tech wizards, and a GUI would absolutely make that better.

That covers a tiny fraction of ffmpeg's actual interface

> imagine the same gui for ffmpeg...

I think they call that VLC

VLC doesn't use ffmpeg, it uses libavcodec.

Do me a favor and tell me what the path is on their github registry, and be less ridiculously pedantic.

The entire point is that libavcodec exposes a different interface. You wouldn't build a GUI for ffmpeg, you'd build one for libavcodec unless your actual goal is generating ffmpeg commands.

I don't think a Swiss army knife approach is a good idea for security software to begin with. It's a good way to generate cruft and lock yourself into questionable design decisions due to Hyrum's Law. It's not great for auditability, either.

FFmpeg is a practically an entire non-linear video editor in a CLI tool. That is indeed a lot of complexity, but the stakes are low -- if you screw up an FFmpeg command, you've lost some encoding time, not your entire password database. (I get the impression a lot of FFmpeg's functionality wouldn't serialize well, either, but I'm far from an expert on that.)

Nobody on Earth ever has or ever will like the Windows registry.

No comment on Firefox.

> That is too much complexity for a single security-critical program.

Looking at this x509 page, a lot of these options kind of seem like "required complexity" to me. There's a few things that aren't really needed (like the string conversion stuff) and a few things that could be condensed in one option (the "Print [..]" options can be one "print [list-of-fields]"), but those are relatively minor things.

The thing is, SSL/TLS is kinda complicated, but that's not really OpenSSL's fault.

Sure, I'm willing to accept that the X.509 is inherently complicated and there's not much OpenSSL could do to simplify it. But that seems like a good reason not to add support for 44 other major operations to the software...

TLS is more than just x509.

If you want a tool that "just generates certificates" then it's easy, but if you want an advanced management tool that can do all sorts of things then you will end up with something complex because TLS is complex with a lot of different parts.

And yeah, the openssl tool could be designed a lot better, but much of this is a matter of UX and managing complexity, not so much reducing it.

Why not? It's a collection of 44 tooks each doing one thing well :)

Also fun thing is that openssl doesn't even properly handle all of the cases and complexities of x509. Like subject altnames and what can be included in there by certain specifications and standards.

It is. You're not meant to be using it directly. Some of what's in OpenSSL is just glorified test drivers. OpenSSL is complicated in large part because it is the de facto reference implementation for a lot of cryptography.

I was hoping that it was interactive, showing all tabs and all options. But I like what I'm seeing there.

Reply on news.ycombinator.com