Jason Tubnor
6 HN recommenders · recommended in 14 months, 2014–2025
1:05:45 · 25K views · May 17, 2014
Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.
Frequently linked as an entertaining and alarming account of OpenSSL code quality and why the fork happened.
19 comments from Hacker News
Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. this video
This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck[1], around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? [1] this video
The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3]. In that case open source was at least able to react appropriately, even if it didn't act preemptively. [1]: [LINK] [2]: [LINK] [3]: this video
It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL[1] (Ted's there too). [1]: this video
The LibreSSL talk is funny and scary. [watch the other version one this video so you can hear the other people and see the end]