Skip to content

0:00 / 0:00

#libressl #openssl #openbsd

LibreSSL with Bob Beck

256 subscribers • 1 video on Hallway

Recommended by 7 people: 6 on Hacker News and 1 in engineering communities.
A classic. People kept recommending it from 2014 to 2023.
Presented by Bob Beck, OpenBSD developer
An opinion. It argues one side of a question engineers disagree on.

Intermediate. Assumes working knowledge.

24K views12 years ago7 recommendations

Security Systems programming Web and application security Cryptography C

Bob Beck describes the OpenBSD project's efforts to fork and clean up the OpenSSL codebase, highlighting numerous programming oddities and security risks.

LibreSSL is a recently started initiative by the OpenBSD project to fork and clean up the OpenSSL code base. They have been working on this rather intensively for about a month now.

Why it's here

7 people recommend this, 1 disputes it

What people say. Recommended as an entertaining and eye-opening look at the extreme technical debt and unsafe practices found in the OpenSSL codebase.

u/localtoastin r/netsec • 12 years agoRecommends

LibreSSL with Bob Beck

60View on Reddit

mrweaselon Hacker News • 5 years agoRecommends

On “OpenBSD: How it all started”

Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. link to this video

View on Hacker News

protomython Hacker News • 12 years agoRecommends

On “BSDCan 2014 Videos”

The LibreSSL talk is funny and scary. watch the other version one [video so you can hear the other people and see the end]

View on Hacker News

lomnakkuson Hacker News • 12 years agoRecommends

On “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”

"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: link to this video

View on Hacker News

teamhappyon Hacker News • 11 years agoRecommends

On “BoringSSL”

It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL1 (Ted's there too). 1: link to this video

View on Hacker News

Bayarton Hacker News • 4 years agoRecommends

On “U.S. telecoms are going to start physically removing Huawei gear”

The immediate effect of Heartbleed was the OpenBSD folk 1 and Google 2 forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious 3. In that case open source was at least able to react appropriately, even if it didn't act preemptively. 1: link 2: link 3: link to this video

View on Hacker News

g0xA52A2Aon Hacker News • 3 years agoRecommends

On “OpenSSL Security Advisory [7th February 2023]”

This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck1, around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? 1 link to this video

View on Hacker News

x0x0on Hacker News • 12 years agoDisputes

On “New Bug Found in Widely Used OpenSSL Encryption”

in the sense that it is utterly wrong, I suppose so... in reality, openssl appears to be a $1mm+/year for-profit fips consulting business 1 that appears to not care much about security, letting serious security issues sit in their bug tracker for years on end 1 link to this video

View on Hacker News

x0x0on Hacker News • 12 years agoDisputes

On “This is why software sucks”

to be blunt: openssl is a festering heap maintained by a bunch of hacks. They let critical security bugs sit in their queue for 4 years while they sat on them 1. They also actively worked to disable automated testing with malloc tooling; while obviously that won't catch all bugs, every bit helps. Finally, it contained rafts of code that, bluntly, my boss would probably fire me for checking in. 1 link to this video

View on Hacker News

clarryon Hacker News • 12 years agoMentions

On “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”

Just in case someone missed it, here's video of the libressl talk to go with the linked slide(s). link to this video

View on Hacker News

forgottenpasson Hacker News • 12 years agoMentions

On “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”

I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones. That's reasonable, but those aren't the options at play here. Not only because GnuTLS is already a thing, but the chances of OpenSSL becoming really really good are questionable. An OpenBSD guy gave a talk a few weeks back where he said that Heartbleed wasn't the reason for the split, it was the reason for digging into the code and realizing that OpenSSL under current leadership isn't capable of being a really really good option. link to this video

View on Hacker News

simula67on Hacker News • 12 years agoMentions

On “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”

From Beck's talk1 they are not reviewing the cryptography code, merely cleaning up the programming. They admit they don't yet have cryptography experts reviewing if the algorithms/implementations are doing what they are supposed to be doing and that they are in fact secure. 1 link to this video

View on Hacker News

protomython Hacker News • 12 years agoMentions

On “Pointers Gone Wild”

> Maybe I'm naieve, but I think perhaps the problems with OpenSSL had come to light a little bit sooner if all dangerous code had clearly been marked 'unsafe'. After listening to Bob Beck's talk1, I think people did know how unsafe that code was but no one wanted to take a shot at fixing it until it all went bad. At 2:12 into the video (the Jon Snow slide), he explains why nobody looked (or admitted they looked)2. Code can be so bad in any language to discourage people from even attempting to figure out how it works. 1) link to this video 2) quotes "Why did WE not look" & "It is your parents talking about how you got made horrible"

View on Hacker News

protomython Hacker News • 10 years agoMentions

On “Why OpenBSD Is Important to Me”

I meant my comment in the same spirit as a Southerner means "Bless your heart". I do believe Ted Unagnt's comment is included in the link to this video LibrSSL first 30 days along with quite a lot of other oddities.

View on Hacker News

gbrown_on Hacker News • 10 years agoMentions

On “OpenSSL after Heartbleed”

> it was created as a direct response to Heartbleed The reason for the fork was not Heartbleed itself but the crazy memory allocation done behind the scenes. link to this video

View on Hacker News

protomython Hacker News • 8 years agoMentions

On “Why Is SQLite Coded in C? (2017)”

Bob Beck during his LibreSSL talk had a good overview of what was thought of OpenSSL link to this video "we are all guilty"

View on Hacker News