LibreSSL with Bob Beck
Jason Tubnor6 HN recommenders · recommended in 5 months, 2014–2025
talk · intermediate · evergreen · 2014–2025 on HN
Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.
Frequently linked as an entertaining and alarming account of OpenSSL code quality and why the fork happened.
Up next
4 mo on HNUbuntu Slaughters Kittens | BSD Now 103
Jupiter Broadcasting
4 HN recommender · 2015–2024
6 mo on HNZebras All the Way Down - Bryan Cantrill, Uptime 2017
Code & Supply
6 HN recommender · 2018–2025
3 mo on HNAndreessen's Corollary: Ethical Dilemmas in Software Engineering - Bryan Cantrill | Craft 2019
CraftHub Events
3 HN recommender · 2019–2025
1 mo on HNHow Boeing Lost Its Way
Bloomberg Originals
1 HN recommend · 2020–2021
6 mo on HNUser-level threads....... with threads. - Paul Turner - Google
Linux Plumbers Conference
6 HN recommender · 2013–2024
10 mo on HNThe Real Story Behind Wayland and X - Daniel Stone (linux.conf.au 2013)
Mladen Mijatov
13 HN recommender · 2013–2026
3 mo on HNLibreSSL: The first 30 days, and what the Future Holds
Andrea Ross
3 HN recommender · 2014–2022
9 mo on HNMindfulness with Jon Kabat-Zinn
Google
11 HN recommender · 2009–2017
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
11 mo on HNBut how does bitcoin actually work?
3Blue1Brown
15 HN recommender · 2017–2024
8 mo on HNDiffie-Hellman Key Exchange
Art of the Problem
9 HN recommender · 2016–2024
12 comments from Hacker News
Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. ▶ this video
This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck[1], around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? [1] ▶ this video
The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3]. In that case open source was at least able to react appropriately, even if it didn't act preemptively. [1]: link [2]: link [3]: ▶ this video
It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL[1] (Ted's there too). [1]: ▶ this video
The LibreSSL talk is funny and scary. [watch the other version one ▶ this video so you can hear the other people and see the end]
"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: ▶ this video
> And Comic Sans for letters sent to friends finishing design school, obviously. ... and libressl. link (and the talk - ▶ this video )
> I've never seen a terrible huge C codebase libssl/openssl (before the rewrite/fixes especially)? Maybe doesn't qualify as huge? See eg: ▶ this video "LibreSSL with Bob Beck" (the first 30 days)
I don't think anyone thought OpenSSL was good code even before Heartbleed. Bob Beck pointed that out in his LibreSSL talk ▶ this video
Big-endian Support for AMD64 - the explanation from the person in the crowd is something of a horror story that I think a lot of have witnessed in various forms. ▶ this video
Bob Beck during his LibreSSL talk had a good overview of what was thought of OpenSSL ▶ this video "we are all guilty"
> it was created as a direct response to Heartbleed The reason for the fork was not Heartbleed itself but the crazy memory allocation done behind the scenes. ▶ this video