One week of OpenSSL cleanup

Re:One week of OpenSSL cleanup by Wilya on Sunday April 20, 2014 @12:28PM (#7617364)

I don't think the changes they are doing at the moment have much security value. They aren't working on fixing OpenSSL security flaws. They are obliterating all the layers of cross-platform compatibility that make the code more complex, and removing everything OpenBSD isn't likely to use.

They are transforming a local copy of openssl that tracks upstream changes to their own fork, that probably won't reunite with the upstream version anytime soon.

In the process, they are obviously likely to find some bugs (and they already have fixed one or two harmless ones), but I think they are more interested in building a clean fork for themselves than in fixing the upstream openssl.

[ Parent | on HN ]

Re:One week of OpenSSL cleanup by dobbsbob on Sunday April 20, 2014 @01:26PM (#7617615)

OpenSMTPD, OpenNTPD and OpenSSH are avail for other platforms. They will strip OpenSSL down to essentials, spend months auditing what's left then when satisfied it is reliable software porting to other platforms can begin. It's only been a week

[ Parent | on HN ]

Re:One week of OpenSSL cleanup by jgrahamc on Sunday April 20, 2014 @12:31PM (#7617382)

But they are doing stuff like this:

1. Let's remove OPENSSL_cleanse: http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib...

2. Crap. Let's put it back again: http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib...

That plus the 'tone' of the commits makes me wary of these changes.

[ Parent | on HN ]

Re:One week of OpenSSL cleanup by clarry on Sunday April 20, 2014 @12:33PM (#7617389)

Did you actually read the second diff you linked? They did not put anything back again. They removed even more junk. It is all deletions.

I'm getting tired of all the people who complain about the humour, tone or style in the commit messages. If you have serious concerns, why not read the diffs and comment on the actual changes? This is how real problems get noticed and corrected.

But some things were in fact removed and put back again, because it turns out some ports depended on it. Sometimes you just don't notice what a few thousand other applications depend on before you remove some code.

[ Parent | on HN ]

Re:One week of OpenSSL cleanup by jgrahamc on Sunday April 20, 2014 @12:40PM (#7617426)

You're right. I'm wrong about number 2. Mea culpa.

[ Parent | on HN ]

Re:One week of OpenSSL cleanup by edwintorok on Sunday April 20, 2014 @02:07PM (#7617796)

Also look at the manpage for explicit_bzero: http://www.openbsd.org/cgi-bin/man.cgi?query=bzero&sektion=3

It already does what OpenSSL_cleanse is meant to do, so using it makes sense.

[ Parent | on HN ]

Re:One week of OpenSSL cleanup by danielweber on Sunday April 20, 2014 @01:55PM (#7617741)

You are seeing this because they are working in public. Any of us would look like fools if you saw our intermediate work product.

[ Parent | on HN ]