Hacker News Reader

Comment by coldcode | Hacker News Reader

Someone has to pay for something to be what he says. Maybe the almighty Google or Facebook or Apple someone should fork over some bucks to support a correctly constructed alternative. Open source may be "free" but building something complex and correct is not free to build. Given that openssl had about 2K donated per year it's really a hobby project. It's not like Linus works on Linux while flipping hamburgers for a living.

View on HN

It's absolutely true, good programming costs money and somebody has to pay[1], but given the amount of money floating through TLS protected connections, that should be a solveable problem, once people realize it is there.

But I think the major problem with OpenSSL is that it never had anything resembling architectural leadership: Things just got bolted on to the side and hung from any convenient nail people could find.

PS: Yes, I wrote that piece.

[1] https://www.varnish-cache.org/docs/trunk/phk/dough.html

Apple has SecureTransport[1] and it is open source[2], it had the goto fail bug from earlier this year. Shoving money at the problem isn't necessarily the answer. The problem is the TLS spec is a confusing, arcane spec riddled with tons of gratuitous addons and extensions. Implementing all or even most of it without error/bus is simply a very hard problem

[1]: https://developer.apple.com/library/mac/documentation/securi...

[2]: http://opensource.apple.com/source/libsecurity_ssl/libsecuri...

Reply on news.ycombinator.com