LibreSSL: The first 30 days, and what the Future Holds
Andrea Ross3 HN recommenders · recommended in 3 months, 2014–2022
talk · intermediate · evergreen · 2014–2022 on HN
Bob Beck of OpenBSD gives a BSDCan 2014 talk on the first month of LibreSSL, the OpenSSL fork. He explains why they forked, what they removed, and examples of the problems found in the OpenSSL code base.
Recommended as a funny, fascinating tour of how bad the OpenSSL code was and what cleanup looks like.
Up next
6 mo on HNBryan Cantrill on Jails and Solaris Zones
PapersWeLove
6 HN recommender · 2016–2025
10 mo on HNCppCon 2017: Matt Kulukundis “Designing a Fast, Efficient, Cache-friendly Hash Table, Step by Step”
CppCon
9 HN recommender · 2018–2026
3 mo on HNTwitter and Visual Studio Rant
Molly Rocket
3 HN recommender · 2020–2026
6 mo on HNMock Interview with Shawn McGrath
Molly Rocket
6 HN recommender · 2017–2023
5 mo on HNLibreSSL with Bob Beck
Jason Tubnor
6 HN recommender · 2014–2025
3 mo on HNSimon Sinek: Why Leaders Eat Last
99U
3 HN recommender · 2014–2017
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
11 mo on HNBut how does bitcoin actually work?
3Blue1Brown
15 HN recommender · 2017–2024
8 mo on HNDiffie-Hellman Key Exchange
Art of the Problem
9 HN recommender · 2016–2024
7 mo on HNBlackHat USA 2011: SSL And The Future Of Authenticity
Christiaan008
9 HN recommender · 2011–2017
8 mo on HNBlockchains Are a Bad Idea (James Mickens)
HBS Digital Initiative
8 HN recommender · 2018–2023
4 comments from Hacker News
I'd expect higher quality code review from OpenBSD folks (who maintain LibreSSL), compared to OpenSSL. Also, an interesting talk: LibreSSL: The first 30 days, and what the Future Holds from BSDCan: < ▶ this video >
There is a fascinating and funny talk by Bob Beck from OpenBSD on the first 30 days after forking OpenSSL. One of the things he addresses is the scary code and how is prevents community involvement. He also talks a great deal about all that stuff that's not really relevant anymore and how much they removed from the LibreSSL source code. Apparently the crypto modules are pretty well made according to the OpenBSD developers. LibreSSL: The first 30 days, and what the Future Holds: ▶ this video
Anyone interested in details of LibreSSL development can watch the BSDCan talk at ▶ this video - there really are a LOT of instances of braindamaged code in OpenSSL and a radical repair is pretty much the only thing which will work.
I am reminded of the libressl - 30 days in report. ▶ this video Removing support for old versions is a simplification of what needs to be considered. It is a reduction of complexity. If someone is running a PHP version that has been EOLed, it is perfectly reasonable to discontinue support for it in a library - even if new features that weren't available in the EOL'ed version haven't been added yet.