OpenBSD Affirms That LibreSSL Will Be Portable

[Candide]

silly reason

I don't want to be that guy, but I find it interesting that the OpenBSD guys decided to fork OpenSSL because they seem to believe that there were poor decisions made throughout the project. Yet when you look at the LibreSSL page, someone made a conscious decision to use flashing text and Comic Sans. They can't seriously criticize anyone's decision making when the page that represents their efforts looks like a 13 year old kid made this page back in 1997.

That's a bit like saying "I won't use Linux because Linus Torvalds listens to punk music, and I don't like punk music." (Actually, I have no idea what kind of music Linus likes, nor do I care).

[jake_lesser]

The impression that I get from the various articles I've read is that the development environment / governance surrounding OpenSSL is pretty toxic.

The development environment/governance on OpenBSD is even more toxic.

They can't seriously criticize anyone's decision making when the page that represents their efforts looks like a 13 year old kid made this page back in 1997.

The behaviour of most BSD developers are the same as that of 13 year old kids. For OpenBSD, I'd say a 13 year old kids with ASPD and who talk Ice.

[QUOTE=BSDude]Imagine a world were there's only Gnome3?! [/BSDude]

The Linux desktop will be a lot less fragmented and Gnome 3 will be a lot more usable and customisable due to more manpower. It also wouldn't make the stupid decisions it made because the gnome dev population there are more likely to represent the likings of the general public. Remember the saying: Quantity has a quality of it's own.

That said, perhaps they should look in to merging some of the LibreSSL changes to get a head start on the cleanup effort.

There is nothing to merge from (Non)LibreSSL because the LibreSSL project is just about code deletion, reduction of functionality and bigotry. If there's any flow of code it will be from OpenSSL to LibreSSL not the other way.

OpenSSL is still way more powerful then LibreSSL.

Finally something interesting from wikipedia:

One of the major complaints related to LibreSSL was the exclusion of fixes for previous bugs in OpenSSL which had been commited years ago and have either gone unnoticed or ignored. There are commit logs which show older bugs now being fixed in OpenSSL.

[stevenc]

How come this wasn't performed on OpenBSD? Wouldn't it have been a better platform choice if it was the most supported by both libraries?

In order to do some benchmarking yes, that would be the easiest way. But I was porting it in order to verify as claimed in the article, that LibreSSL is being written portably, so that it can someday be used almost everywhere just as we do with OpenSSH.

[chinoto]

That segfault was hilarious. LibreSSL can't even run on a FreeBSD kernel.

It is being developed for OpenBSD first, which has BSD userland, not GNU. I would suspect it works perfectly on OpenBSD.

[...] There is nothing to merge from (Non)LibreSSL because the LibreSSL project is just about code deletion, reduction of functionality and bigotry. If there's any flow of code it will be from OpenSSL to LibreSSL not the other way. [...]

They are cutting out code that is unnecessary for it to run on OpenBSD so they can work with a smaller code base to make sure it is secure. Once that is done, they will work on making sure it is portable. As for "reduction of functionality", unless you mean OS support, that's news to me, where did you read that?

[dante]

This LibreSLL idea is uterly dumb. They should better concentrate on making the best of the current OpenSSL rather than making another fork of a fork of a fork. What a wasteful mentality. This is like ffmpeg and LibAv... kindergarden.

OpenBSD developers probably have many ideas that would conflict with ideas from the original project, but for the security point they can make much better implementation than openssl.

[Sergio]

The development environment/governance on OpenBSD is even more toxic.

People, prepare to update your ignore list; BSDSucksDicks (kraftman, Pawlerson, endman, LinuxAnalsBSD, now 'jake_lesser') is back again!

[stevenc]

That segfault was hilarious. LibreSSL can't even run on a FreeBSD kernel.

The segfault was my own mistake when trying to port it: instead of using /dev/{.u}random I had the PRNG trying to seed from itself, recursively until stack exhaustion. With that fixed it now also does RSA/DSA/ECDSA/ECDH and completes a benchmark run without crashing. I obviously wouldn't trust what I've done for any real crypto work, and I know it isn't threadsafe yet.

This quick-and-dirty port was compiled with GCC 4.8 with surprisingly few changes, against GNU libc and then able to run on a FreeBSD kernel, though it should just as easily work on GNU/Linux too.

OpenBSD normally use a fork of a very old GCC. They have a stronger (ChaCha20 instead of RC4) implementation of arc4random (replacing the original OpenSSL PRNG, which Debian had big trouble with some years ago). Also the OpenBSD libc has reallocarray, strlcat, strlcpy, funopen; other platforms need to build standalone implementaitons of those but most of that gets done already for OpenSSH.

[wretched_dutchman]

The segfault was my own mistake when trying to port it: instead of using /dev/{.u}random I had the PRNG trying to seed from itself, recursively until stack exhaustion. With that fixed it now also does RSA/DSA/ECDSA/ECDH and completes a benchmark run without crashing. I obviously wouldn't trust what I've done for any real crypto work, and I know it isn't threadsafe yet.

This quick-and-dirty port was compiled with GCC 4.8 with surprisingly few changes, against GNU libc and then able to run on a FreeBSD kernel, though it should just as easily work on GNU/Linux too.

OpenBSD normally use a fork of a very old GCC. They have a stronger (ChaCha20 instead of RC4) implementation of arc4random (replacing the original OpenSSL PRNG, which Debian had big trouble with some years ago). Also the OpenBSD libc has reallocarray, strlcat, strlcpy, funopen; other platforms need to build standalone implementaitons of those but most of that gets done already for OpenSSH.

When porting to debian you may want to look at libbsd-dev, it has the strlc{at,py} and arc4* and you can use http://www.openbsd.org/cgi-bin/cvswe...reallocarray.c for lack of reallocarray.

And don't forget the mandatory reading:
http://insanecoding.blogspot.no/2014...d-and-bad.html
http://insanecoding.blogspot.no/2014...-mistakes.html
http://insanecoding.blogspot.nl/2014...evurandom.html

[beetreetime]

I think in return for how OpenBSD treated the OpenSSL development team, the next release of OpenSSL should be made as incompatible as possible will BSD.

Since LibreSSL will fail, BSD have no support support for secure communications and thus more people will move their servers from BSD to Linux.
Make OpenSSL dependent on systemd.

[Vim_User]

Please don't feed the troll. It is pretty obvious that bot, jake_lesser and beetreetime, are nothing but sockpuppet accounts of the anti-BSD troll, only here to boost this trolls ego with inciting hate and flamewars. Please just add them to your ignore list and move on with the actual topic.