Hacker News Reader

Comment by acqq | Hacker News Reader

Why should OpenSSL tell anything to LibreSSL? LibreSSL had very negative words for OpenSSL in the past and tried to build the impression of being "more secure" just based on the "low hanging fruits." It's easy to make the fork and reformat or remove the parts of the code. It's much harder to find the real security problems in what remains.

If I were in OpenSSL team I would also not tell LibreSSL anything and then in, for example, a year show statistics how often LibreSSL wasn't "more secure" at all. That's a fair comparison. (1)

Hard problems are hard.

1) Edit: but see fafner's comment here, it seems the truth is even harder to believe: it seems it's the LibreSSL guys themselves who decided not to be informed and now write what they write(!)

View on HN

Please read the commit log of LibreSSL and try not to face-palm. I think you will fail. The code quality they're up against is very often stuff you expect to find at thedailywtf.com. It must always be ok to criticize (even in the form of mocking) bad code as long as the criticism comes with well written patches. OpenSSL should embrace the help they get for the greater good.

Or instead of just forking OpenSSL then should help develop/submit patches to OpenSSL and improve the existing code base.

A good portion of LibreSSL's patches are in the form of removing code for dead platforms like VAX/VMS and OS/2, problematic wrappers like openssl_malloc() or patching the everything-on-by-default approach that OpenSSL takes. The OpenSSL team actively refuses any such patches, which is why LibreSSL was forked in the first place.

> Or instead of just forking OpenSSL then should help develop/submit patches to OpenSSL and improve the existing code base.

Part of the early LibreSSL work was auditing and merging security patches which had been in the OpenSSL tracker for months or years.

Do LibreSSL and OpenSSL have the same goals? Do they both want to support the same features/hardware/etc.? If LibreSSL remove something because it's not needed for what LibreSSL wants to support, but OpenSSL does want to support it, then what should happen? Should it be removed? Or not?

Different projects can have different goals.

And they could have found the security bugs and report them to OpenSSL even after they forked. If they actually did some serious security investigations of the code they took and kept in their fork, it should be natural to discover such issues and not just wait for others to find them in OpenSSL.

Does anybody know of any such report?

While I generally agree that this should be done, I'd also like to point out that many (most?) security fixes in LibreSSL are really "side effects" from trowing away lots of code, or cleaning it up.

That's my impression too, that they threw away a lot and replaced a few functions with the "good-practice in OpenSSL" ones, but otherwise haven't changed too much, so the code base can be easier to maintain but is not necessary "the" solution some believe it is.

If the mocking is the fair game, everybody can mock LibreSSL too for not actually finding the real security bugs that exist in their code after more months of publicly claiming they are "more secure." I admit they had a few ideas OK, but for my taste they made too much self-promotion and "mocking" of the original developers. I allow you the right to like that, I just state that I don't and stand behind it.

See also fafner's comment here and think about it.

OpenSSL is free to do that, but given the issues in their code it would probably backfire.

Now that is not a very engineering-wise useful behavior. You may feel bad (I mean OpenSSL not "you") but do you want a better Internet or not?

It is as easy as an encrypted email.

Put yourself in OpenSSL shoes. Would you then really send your still confidential bugs to the people who claimed you're incompetent but they themselves didn't remove the said bugs after promoting their work and speaking bad about you for months?

Even if you would, can you know if they would not leak them before your correspondents (which include really big companies which can really be in danger if the leak occurs) are ready? (See fafner's comment here for some details -- apparently LibreSSL people didn't want to guarantee not to leak(!)) You just know they are antagonistic to you.

No, they have different goals and different standards. I think people are attributing "antagonistic" when it really isn't there or is not nearly at the level the general geekdom thinks it is. Theo doesn't believe in embargoes. Theo doesn't want to be a part of yet another list when he is already swamped with the task load he has. I see zero problem with that. That the OpenSSL and LibreSSL teams talk is readily apparent though.

Reply on news.ycombinator.com