Hacker News Reader

Comment by lpsz | Hacker News Reader

Up until recently even OpenSSL's own download page was not HTTPS.

Just like Mozilla's page, that makes perfect sense as long as the authenticity can be verified via other means, such as PGP signatures.

What use is having HTTPS to protect the very thing that you need to implement it. It's a basic chicken and egg problem, replayed every time OpenSSL gets compromised, and successfully circumvented by securing it with something else.

Think about it: there's an SSL break and you need to update OpenSSL. What good does it do you to have it available over SSL?

Tell that to building haskell from source. It depends on itself.

I remember back in the day you used to be able to build gcc with various other compilers to bootstrap yourself. I think gcc now requires gcc features, so you're in the same boat.

But anyway, the comparison isn't very good because haskell/gcc don't develop sudden security vulnerabilities that instantly turn existing binaries unusable for getting new ones.

The first C++ compiler was written in C++:

http://www.stroustrup.com/bs_faq.html#bootstrapping

However, the first C compiler was not written in C, but in NB, an intermediate step from B to C:

http://stackoverflow.com/questions/18125490/how-was-the-firs...

Because not all vulnerabilities are the same, and not all are total compromises. For example, BEAST was temporarily worked around by switching to use a stream cipher (RC4) instead of a block cipher. Everyone scrambled to update their OpenSSL version, then switched back, or they switched to an AEAD mode TLS 1.2.

Not that people shouldn't be using GPG, but only using it means you only protect the paranoid.

Reply on news.ycombinator.com