OpenSSL wins the Levchin prize | Hacker News Reader

OpenSSL wins the Levchin prize

openssl.org

94 pointskardos29 comments

Can't help but find it ironic the winner of the 2018 Levchin Prize for Advancements in Real-World Cryptography has an invalid SSL certificate on his research website.

Also the levchinprize.com website. (not that there is a link to it; and it might not even attempt to do ssl)

   levchinprize.com uses an unsupported protocol.
   ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Classic.

At first glance they do support SSL, but not TLS; basically your browser laughed at their antiquated protocol.

A few hours ago, I went to their website after seeing the submission, and it worked. Now I'm getting SSL_ERROR_NO_CYPHER_OVERLAP (in Firefox 57). Maybe they're loadbalancing and one of the servers is incorrectly configured?

I can't help but finding it sad that the prize is a meager 10K, especially for projects that are so relevant for the Internet at large.

Security, in any organization, is always last on the budget list. Perhaps this is reflected in the prize.

I did think the same thing, but you can't blame that on him. Blame IBM/Akamai.

You can. Responsibility for their choice of business partners lies with them, not the public. Otherwise this blame-game-treasure-hunt-rigmarole never ends.

It doesn’t matter that much, but it’s a matter of principle.

It is on Akamai but it is on Akamai's non-TLS network (ie .egsuite.net)...you have to pay more for TLS on Akamai (.edgekey.net)....I'd blame IBM but not Akamai.

What about LibreSSL?

I was think along the same lines. It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess.

Honestly, given the background for the award, cleaning up your code base shouldn't qualify you:

> The prize honors significant contributions to real-world cryptography and celebrates recent advances that have had a major impact on the practice of cryptography and its use in real-world systems.

Improving code quality doesn't actually impact "the practice of cryptography".

> It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess.

Though to be honest, an insane amount of stuff relies on OpenSSH for their security, and has for years. If their code was messy earlier, ok, but they have still been basically de facto standard SSH client for much of networking. I'd say their prize is well earned.

The reward was given to the OpenSSL team.

OpenSSH is a different project, developed by the OpenBSD project. OpenBSD also works on LibreSSL which is a fork of OpenSSL.

OpenSSL itself has NOTHING to do with OpenBSD and OpenBSD related projects.

OpenSSL vs OpenSSH.

So, good for OpenSSL for getting better. More better crypto libraries benefit everyone. Who benefits from OpenSSL remaining terrible?

I certainly don't think libressl deserves any sort of prize, but it does seem a little weird to give an award designated for advancement for something more like hitting par. If they'd been better to start, then no award? Most improved awards have strange incentives.

This award did feel a little different. I can't build anything on top of OpenSSL in quite the same way that I can take the signal protocol and build on it. (All the other winners did something that's useful to rust, too. :))

What about it?

What significant contributions to real-world cryptography have LibreSSL made?

Well seeing as the criteria that they used to pick the OpenSSL project is:

"for dramatic improvements to the code quality of OpenSSL"

I think there is a question around why LibreSSL was not chosen seeing as it has done exactly that...

I don't have any numbers but I would guess this would be since OpenSSL is used a lot more than LibreSSL at the moment. So the criteria "and its use in real world systems" would qualify OpenSSL more than LibreSSL.

If you haven’t seen the difference in quality and design from older versions of OpenSSL to more recent versions, it’s a quite impressive transformation.

I definitely learned a lot of new techniques for writing quality modern C from the recent versions of OpenSSL.

Congrats on the award.

Can you provide a short example?

take a look at this current pkey impl: https://github.com/openssl/openssl/blob/OpenSSL_1_1_0-stable...

and compare that to 0.9.8: https://github.com/openssl/openssl/blob/OpenSSL-fips-0_9_8-s...

You'll notice how much cleaner the code is. Error conditions are more consistently handled. Many fewer macros interleaving the code... etc.

Yes quite true, it is like night and day.

Every time I see openssl rather than libressl getting attention, I'm reminded of how often incompetence is rewarded.

Does OpenSSL have useful documentation yet?

No.

Source: writing code using openSSL

Congratulations!

When money cannot be given, at least kudos can be given.

Words to live by.

Didn't hear of the prize before, so searched for it. From the website of prize.

>>>>>The Levchin Prize was established in 2015 by internet entrepreneur, Max Levchin. The prize honors significant contributions to real-world cryptography and celebrates recent advances that have had a major impact on the practice of cryptography and its use in real-world systems. Up to two awards will be given every year and each carries a cash prize of $10,000.<<<<<

2015. That is pretty new. So, for me it's more of a publicity for the "prize" itself the the"advancement".

It's a serious conference with a steering committee of serious experts who award the prize for serious work. Take a look at the previous winners. I think the only thing you're getting right here is that the prize is relatively new.

Reply on news.ycombinator.com