Skip to content
0:00 / 0:00

#libressl#openssl#openbsd

LibreSSL: The first 30 days, and what the Future Holds

Andrea Ross

4.1K subscribers • 3 videos on Hallway

YouTube
  • Recommended by 3 people: 3 on Hacker News.
  • A classic. People kept recommending it from 2014 to 2022.
  • Presented by Bob Beck, OpenBSD developer

Intermediate. Assumes working knowledge.

5K views12 years ago3 recommendations

SecuritySystems programmingCryptographyCWeb and application security

Bob Beck discusses the OpenBSD fork of OpenSSL, detailing the removal of legacy code and the security issues uncovered in the process.

by Bob Beck LibreSSL is a recently started initiative by the OpenBSD project to fork and clean up the OpenSSL code base. We have been working on this rather intensively for about a month now. I will be discussing the Origins of LibreSSL (The OpenBSD Fork of OpenSSL) - including why we decided to fork, what we are hoping to achieve, as well as a number of examples of the sorts of code changes we are doing, and the sorts of issues we have found in the code base and how we are changing things. All who are potentially interested in something better than OpenSSL may find this talk of interest.

Why it's here

3 people recommend this

What people say. Recommended as a fascinating and humorous look at the complexity and code quality issues found in OpenSSL.

ivorason Hacker News • Recommends

On “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”

Anyone interested in details of LibreSSL development can watch the BSDCan talk at link to this video - there really are a LOT of instances of braindamaged code in OpenSSL and a radical repair is pretty much the only thing which will work.

mrweaselon Hacker News • Recommends

On “OpenSSL 3.0”

There is a fascinating and funny talk by Bob Beck from OpenBSD on the first 30 days after forking OpenSSL. One of the things he addresses is the scary code and how is prevents community involvement. He also talks a great deal about all that stuff that's not really relevant anymore and how much they removed from the LibreSSL source code. Apparently the crypto modules are pretty well made according to the OpenBSD developers. LibreSSL: The first 30 days, and what the Future Holds: link to this video

yakubinon Hacker News • Recommends

On “Patch OpenSSL on November 1 to avoid “critical” security vulnerability”

I'd expect higher quality code review from OpenBSD folks (who maintain LibreSSL), compared to OpenSSL. Also, an interesting talk: LibreSSL: The first 30 days, and what the Future Holds from BSDCan: < link to this video >

shagieon Hacker News • Mentions

On “Outdated vs. Complete: In defense of apps that don’t need updates”

I am reminded of the libressl - 30 days in report. link to this video Removing support for old versions is a simplification of what needs to be considered. It is a reduction of complexity. If someone is running a PHP version that has been EOLed, it is perfectly reasonable to discontinue support for it in a library - even if new features that weren't available in the EOL'ed version haven't been added yet.