Hacker News Reader

Comment by ibotty | Hacker News Reader

phk (poul henning kamp) is the lead developer of varnish, in case people are not familiar with him.

His technical prowess are only matched by his privacy champion credentials, see e.g. his Operation ORCHESTRA talk https://www.youtube.com/watch?v=fwcl17Q0bpk

> Local governments have no desire to spend resources negotiating SSL/TLS with every single smartphone in their area when things explode, rivers flood, or people are poisoned.

That's one horrible argument, though. The cost of a text-based protocol on ethernet, over TCP greatly outweighs the cost of the encryption process.

Yes, of course encrypting things will increase computational requirements yet the cost is negligible in comparison to the problem being solved (stopping the trade of personal data).

It's hard for me to associate a privacy champion with these statements.

I can also recommend this one, which - strangely - turns into a privacy/security discussion for the second part of the talk.

http://www.infoq.com/presentations/HTTP-Performance

Indeed, so keep in mind that he has a vested interest in being able to use the FreeBSD feature to efficiently copy a file from a disk into a network interface.

Having to break stuff into protocol frames or having every byte have compute done on it for encryption foils his optimization. It doesn't mean that his optimization is more important than TCP connection sharing and ubiquitous confidentiality, integrity and authenticity.

(Edit: typo)

Isn't this the guy that basically refuses to implement SSL/TLS in varnish[1]? The more cynical part of me wonders if that has anything to do with his rejection of HTTPS everywhere.

[1] https://www.varnish-cache.org/docs/trunk/phk/ssl.html

Show me a quality implementation of SSL/TLS I can use ?

All the ones I've looked at are shitty source code.

Why hold yourself to a much higher standard than your customers do? Even though OpenSSL is shitty, everyone still uses it.

That's actually a very good question, thank you for asking it.

Because I think that we can do much better than the pile of IT-shit we have produced until now.

I am actively trying to do that, through my own code, through the articles that I write and through the discussions I engage in.

Not everybody has the luxury of doing that -- the kids have to be fed and the mortgage has to be paid and a job is a job -- but those of us who can, have an obligation to try to make the world a better place, by raising quality if IT.

What about LibreSSL?

-- Freely licensed

-- Has been ported to FreeBSD

-- Is certainly less of a tangled mess than OpenSSL

It is certainly a step in the right direction, my main worry is that the OpenBSD crew has a tendency to to -- SQUIRREL!! and forget their old toy when they spot a new shiny one.

They do? I personally haven't seen much of that, though I'm admittedly relatively new to the BSD world, so perhaps I just haven't been watching/using the BSDs long enough to notice that sort of tendency in OpenBSD relative to the others.

I know they've been making a lot of switches lately in terms of what ships with the base OS, but pretty much all of them (that I know of) have been more akin to forgetting someone else's old toys and playing with their own shiny new ones. OpenSSH and PF in particular seem to still be alive and well, and they've been around for quite a long time.

Reply on news.ycombinator.com