Hacker News Reader

Comment by ktRolster | Hacker News Reader

Audits cost money. Tons of money. And they don't guarantee anything - bugs in OpenSSL have not been discovered for years despite thousands of people using the code, poring over it and billions depending on it.

Any reasonable audit of OpenSSL would have said, "Don't use it."

View on HN

And instead use... what? Let's say you are creating a company that needs website to sell stuff. On that website, you need TLS implementation, to process user data & credit cards. After expensive security audit that consumed most of what your angel investors can give you, you decide that anything based on OpenSSL can't be safely used. Now what?

If the system we're talking about existed, someone would have created a more robust implementation.

How do you know? It's not a magic law of the universe that "someone" always creates things because someone wants them. Sometimes problems are hard and just don't get solved, for a long time, even though everybody wants them solved.

But this isn't some intractable problem. For aerospace and critical infrastructure projects, for example, there is plenty of meticulously written and audited high-quality code developed at higher cost in response to the demand created by legal requirements.

https://www.wired.com/2015/05/possible-passengers-hack-comme...

http://www.cnn.com/2015/05/17/us/fbi-hacker-flight-computer-...

https://arstechnica.com/information-technology/2015/06/airbu...

https://en.wikipedia.org/wiki/Therac-25

https://en.wikipedia.org/wiki/Accidents_and_incidents_involv...

https://en.wikipedia.org/wiki/Mars_Climate_Orbiter#Cause_of_...

Did I make my point clear or do I need to google for another 2 minutes to find a dozen more examples of "aerospace and critical infrastructure projects" with software problems?

Forks of OpenSSL. After Heartbleed, dozens of forks were made. One I think is really promising is LibreSSL which is managed by the same people who work on OpenBSD.

So, the premise there is "we couldn't find the bugs by the whole community in twenty years, but if we split the community into a dozen independent projects which do not cooperate, surely then we'll find the bugs that eluded us for two decades". Right.

I would roll my own. I'm totally confident I can do it better than the OpenSSL team. Of course, I would see what I could do with GnuTLS, first.

In practice, OpenSSL should not be considered secure. At best it can be considered as a way to stop script kiddies.

So why didn't you do that already? I mean, there are very few problems as important to software world and, frankly, to the major part of world economy, than robust electronic commerce. And encryption pays a vital role in this process. Somebody releasing 100% secure crypto implementation, guaranteed no bugs, would be doing the humanity a huge service. What prevents you from doing it now, today, this minute? Please do it right now!

Reply on news.ycombinator.com