“The entire talk is amazing, even 7 years later.”
Talk on LibreSSL's first 30 days
Full comment
Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. this video
LibreSSL with Bob Beck
25K views · May 17, 2014 · 1:05:45 · 6 HN recommenders · 19 mentions · discussed 2014–2025
Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.
Why Hacker News points people here: Frequently linked as an entertaining and alarming account of OpenSSL code quality and why the fork happened.
“The entire talk is amazing, even 7 years later.”HN comment, 2021
What Hacker News said 19
“The LibreSSL talk is funny and scary.”
Funny and scary LibreSSL talk
Full comment
The LibreSSL talk is funny and scary. [watch the other version one this video so you can hear the other people and see the end]
“please see this talk”
Shows what LibreSSL is about: fixing OpenSSL problems
Full comment
"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: this video
“I recommend you watch”
Overview of what is wrong with OpenSSL
Full comment
It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL[1] (Ted's there too). [1]: this video
“talk from Bob Beck of OpenBSD on pruning OpenSSL”
Hilarious talk on pruning OpenSSL
Full comment
The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3]. In that case open source was at least able to react appropriately, even if it didn't act preemptively. [1]: link [2]: link [3]: this video
“around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior”
Recounts fixing long-ignored OpenSSL allocator issues
Full comment
This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck[1], around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? [1] this video
“Just in case someone missed it”
Video of the LibreSSL talk accompanying the slides
Full comment
Just in case someone missed it, here's video of the libressl talk to go with the linked slide(s). this video
“An OpenBSD guy gave a talk a few weeks back”
OpenBSD developer explains why OpenSSL was beyond saving
Full comment
I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones. That's reasonable, but those aren't the options at play here. Not only because GnuTLS is already a thing, but the chances of OpenSSL becoming really really good are questionable. An OpenBSD guy gave a talk a few weeks back where he said that Heartbleed wasn't the reason for the split, it was the reason for digging into the code and realizing that OpenSSL under current leadership isn't capable of being a really really good option. this video
“they are not reviewing the cryptography code, merely cleaning up the programming”
Talk admits cleanup, not cryptographic review, so far
Full comment
From Beck's talk[1] they are not reviewing the cryptography code, merely cleaning up the programming. They admit they don't yet have cryptography experts reviewing if the algorithms/implementations are doing what they are supposed to be doing and that they are in fact secure. [1] this video
“he explains why nobody looked (or admitted they looked)”
Explains why nobody looked at the unsafe OpenSSL code
Full comment
> Maybe I'm naieve, but I think perhaps the problems with OpenSSL had come to light a little bit sooner if all dangerous code had clearly been marked 'unsafe'. After listening to Bob Beck's talk[1], I think people did know how unsafe that code was but no one wanted to take a shot at fixing it until it all went bad. At 2:12 into the video (the Jon Snow slide), he explains why nobody looked (or admitted they looked)[2]. Code can be so bad in any language to discourage people from even attempting to figure out how it works. 1) this video 2) quotes "Why did WE not look" & "It is your parents talking about how you got made horrible"
“LibrSSL first 30 days along with quite a lot of other oddities.”
LibreSSL first 30 days includes oddities and comments
Full comment
I meant my comment in the same spirit as a Southerner means "Bless your heart". I do believe Ted Unagnt's comment is included in the this video LibrSSL first 30 days along with quite a lot of other oddities.
“The reason for the fork was not Heartbleed itself but the crazy memory allocation done behind the scenes.”
Fork motivated by memory allocation, not Heartbleed itself
Full comment
> it was created as a direct response to Heartbleed The reason for the fork was not Heartbleed itself but the crazy memory allocation done behind the scenes. this video
“had a good overview of what was thought of OpenSSL”
Overview of how OpenSSL was regarded
Full comment
Bob Beck during his LibreSSL talk had a good overview of what was thought of OpenSSL this video "we are all guilty"
“the explanation from the person in the crowd is something of a horror story”
Horror story from audience about big-endian support
Full comment
Big-endian Support for AMD64 - the explanation from the person in the crowd is something of a horror story that I think a lot of have witnessed in various forms. this video
“Bob Beck pointed that out in his LibreSSL talk”
Notes OpenSSL was seen as bad code before Heartbleed
Full comment
I don't think anyone thought OpenSSL was good code even before Heartbleed. Bob Beck pointed that out in his LibreSSL talk this video
“(the first 30 days)”
Example of a terrible huge C codebase
Full comment
> I've never seen a terrible huge C codebase libssl/openssl (before the rewrite/fixes especially)? Maybe doesn't qualify as huge? See eg: this video "LibreSSL with Bob Beck" (the first 30 days)
Full comment
> And Comic Sans for letters sent to friends finishing design school, obviously. ... and libressl. link (and the talk - this video )
“letting serious security issues sit in their bug tracker for years on end”
Full comment
in the sense that it is utterly wrong, I suppose so... in reality, openssl appears to be a $1mm+/year for-profit fips consulting business [1] that appears to not care much about security, letting serious security issues sit in their bug tracker for years on end [1] this video
“They let critical security bugs sit in their queue for 4 years while they sat on them [1].”
Full comment
to be blunt: openssl is a festering heap maintained by a bunch of hacks. They let critical security bugs sit in their queue for 4 years while they sat on them [1]. They also actively worked to disable automated testing with malloc tooling; while obviously that won't catch all bugs, every bit helps. Finally, it contained rafts of code that, bluntly, my boss would probably fire me for checking in. [1] this video