LibreSSL with Bob Beck

> And Comic Sans for letters sent to friends finishing design school, obviously. ... and libressl. [link] (and the talk - ▶ this video )

in “Rubio stages font coup: Times New Roman ousts Calibri” · View on HN

> I've never seen a terrible huge C codebase libssl/openssl (before the rewrite/fixes especially)? Maybe doesn't qualify as huge? See eg: ▶ this video "LibreSSL with Bob Beck" (the first 30 days)

in “Important PostgreSQL 14 update to avoid silent corruption of indexes” · View on HN

I don't think anyone thought OpenSSL was good code even before Heartbleed. Bob Beck pointed that out in his LibreSSL talk ▶ this video

in “Replacements for existing software written in Rust” · View on HN

Big-endian Support for AMD64 - the explanation from the person in the crowd is something of a horror story that I think a lot of have witnessed in various forms. ▶ this video

in “What changed in OpenSSL after heartbleed” · View on HN

Bob Beck during his LibreSSL talk had a good overview of what was thought of OpenSSL ▶ this video "we are all guilty"

in “Why Is SQLite Coded in C? (2017)” · View on HN

> it was created as a direct response to Heartbleed The reason for the fork was not Heartbleed itself but the crazy memory allocation done behind the scenes. ▶ this video

in “OpenSSL after Heartbleed” · View on HN

I meant my comment in the same spirit as a Southerner means "Bless your heart". I do believe Ted Unagnt's comment is included in the ▶ this video LibrSSL first 30 days along with quite a lot of other oddities.

in “Why OpenBSD Is Important to Me” · View on HN

Just in case someone missed it, here's video of the libressl talk to go with the linked slide(s). ▶ this video

in “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative” · View on HN

I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones. That's reasonable, but those aren't the options at play here. Not only because GnuTLS is already a thing, but the chances of OpenSSL becoming really really good are questionable. An OpenBSD guy gave a talk a few weeks back where he said that Heartbleed wasn't the reason for the split, it was the reason for digging into the code and realizing that OpenSSL under current leadership isn't capable of being a really really good option. ▶ this video

in “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative” · View on HN

From Beck's talk[1] they are not reviewing the cryptography code, merely cleaning up the programming. They admit they don't yet have cryptography experts reviewing if the algorithms/implementations are doing what they are supposed to be doing and that they are in fact secure. [1] ▶ this video

in “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative” · View on HN

> Maybe I'm naieve, but I think perhaps the problems with OpenSSL had come to light a little bit sooner if all dangerous code had clearly been marked 'unsafe'. After listening to Bob Beck's talk[1], I think people did know how unsafe that code was but no one wanted to take a shot at fixing it until it all went bad. At 2:12 into the video (the Jon Snow slide), he explains why nobody looked (or admitted they looked)[2]. Code can be so bad in any language to discourage people from even attempting to figure out how it works. 1) ▶ this video 2) quotes "Why did WE not look" & "It is your parents talking about how you got made horrible"

in “Pointers Gone Wild” · View on HN

to be blunt: openssl is a festering heap maintained by a bunch of hacks. They let critical security bugs sit in their queue for 4 years while they sat on them [1]. They also actively worked to disable automated testing with malloc tooling; while obviously that won't catch all bugs, every bit helps. Finally, it contained rafts of code that, bluntly, my boss would probably fire me for checking in. [1] ▶ this video

in “This is why software sucks” · View on HN

in the sense that it is utterly wrong, I suppose so... in reality, openssl appears to be a $1mm+/year for-profit fips consulting business [1] that appears to not care much about security, letting serious security issues sit in their bug tracker for years on end [1] ▶ this video

in “New Bug Found in Widely Used OpenSSL Encryption” · View on HN