SoylentNews is people
SoylentNews
Bob Beck who is an OpenBSD, OpenSSH, and LibreSSL developer as well as the director of Alberta-based non-profit OpenBSD Foundation gave a talk earlier today at BSDCan 2014 in Ottawa, discussing and illustrating the OpenSSL problems that have led to the creation of a big fork of OpenSSL that is still API-compatible with the original, providing a drop-in replacement, without the #ifdef spaghetti and without its own "OpenSSL C" dialect.
Bob is claiming that the Maryland-incorporated OpenSSL Foundation is nothing but a for-profit front for FIPS consulting gigs, and that noone at OpenSSL is actually interested in maintaining OpenSSL, but merely adding more and more features, with the existing bugs rotting in bug-tracking for a staggering 4 years (CVE-2010-5298 has been independently re-discovered by the OpenBSD team after having been quietly reported in OpenSSL's RT some 4 years prior).
Bob reports that the bug-tracking system abandoned by OpenSSL has actually been very useful to the OpenBSD developers at finding and fixing even more of OpenSSL bugs in downstream LibreSSL, which still remain unfixed in upstream OpenSSL.
It is revealed that a lot of crude cleaning has already been completed, and the process is still ongoing, but some new ciphers already saw their addition to LibreSSL RFC 5639 EC Brainpool, ChaCha20, Poly1305, FRP256v1, and some derivatives based on the above, like ChaCha20-Poly1305 AEAD EVP from Adam Langley's Chromium OpenSSL patchset.
To conclude, Bob warns against portable LibreSSL knockoffs, and asks the community for Funding Commitment -- the Linux Foundation is turning a blind eye to LibreSSL, and instead is only committed to funding OpenSSL directly, despite the apparent lack of security-oriented direction within the OpenSSL project upstream. Funding can be directed to the OpenBSD Foundation.
(Score: 2) by gman003 on Sunday May 18 2014, @03:36PM
They're making a point - fixing the code is much more important than having a fancy website, so they put up an extremely simple website. To demonstrate that they are focused on the codebase rather than marketing, they used a few things that modern designers claim is the Worst Thing Ever - Comic Sans, blink tags, marquee tags.
(Score: 2) by maxwell demon on Sunday May 18 2014, @03:46PM
There's nothing wrong with setting up an extremely simple web site. But they really should not have added those negative things. There's a huge difference between just not making it pretty, and actively making it ugly.
Indeed, even if the time they put in it has not been large, it still is true that the time they invested into thinking which part might blink would better have been invested in the code. That is, by actively making the site intentionally ugly they actually counteract the very point.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 0) by Anonymous Coward on Sunday May 18 2014, @04:35PM
meet maxwell demon (1608) the pissed off web hipster
(Score: 2) by maxwell demon on Sunday May 18 2014, @05:11PM
Ah, an ad hominem, the resort of those who ran out of arguments.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 0) by Anonymous Coward on Sunday May 18 2014, @07:26PM
It's more like you don't get it, so any argument is pointless. But sure, lets all be annoyed by the look of that website than the quality of the code they're fixing for us
(Score: 2) by maxwell demon on Sunday May 18 2014, @07:55PM
Oh, so just because they (promise to) do something good, you are not allowed to criticise them for something they are doing bad? That's certainly not an attitude I can relate with.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by Hairyfeet on Sunday May 18 2014, @08:17PM
Sadly I see this waaay too often from the FOSS camp, its the "its free so you can't complain" argument and to which i always respond "So if somebody offers you a free sandwich and then puts a side of shit on the plate that doesn't matter because its free?"
If they want people to give them tens of thousands of dollars for their work? A touch of professionalism really isn't too much to ask IMHO. if somebody came into my shop with a proposal and they put it in Comic Sans because "its to annoy hipsters lulz" I'd tell them "You obviously have the mentality of a 15 year old, please stop wasting my time" and show them the door...and they are shocked that the Linux foundation doesn't want to hand a couple million to them over openSSL?
ACs are never seen so don't bother. Always ready to show SJWs for the racists they are.
(Score: 2) by hybristic on Sunday May 18 2014, @09:13PM
I believe the point is, the part they are doing "badly" was completely intentional. It was part of the statement and marketing. So yes it took time away from the code development, but if they just threw up a plain html site without all the blinking and Comic Sans they couldn't have made the statement they were going for. And it's important to get a message across about what you're doing. They are saying, yeah we are bad at all this web design crap, look we even use crap fonts and scrolling text! But what we do know is security. If you are into looks and features this isn't the solution for you.