LibreSSL: The first 30 days, and what the Future Holds
Andrea Ross3 HN recommenders · recommended in 3 months, 2014-2022
5K views · 12 years ago · talk · evergreen
Bob Beck of OpenBSD gives a BSDCan 2014 talk on the first month of LibreSSL, the OpenSSL fork. He explains why they forked, what they removed, and examples of the problems found in the OpenSSL code base.
Recommended as a funny, fascinating tour of how bad the OpenSSL code was and what cleanup looks like.
1:05:45LibreSSL with Bob Beck
Jason Tubnor
25K views • 12 years ago
48:02BlackHat USA 2011: SSL And The Future Of Authenticity
Christiaan008
95K views • 15 years ago
53:00The Internet Was Weeks Away From Disaster And No One Knew
Veritasium
16.4M views • 8 months ago
46:22DEF CON 19 - Moxie Marlinspike - SSL And The Future Of Authenticity
DEFCONConference
11K views • 13 years ago
53:0236C3 - A systematic evaluation of OpenBSD's mitigations
media.ccc.de
18K views • 6 years ago
1:02:52Joanna Rutkowska: Towards (reasonably) trustworthy x86 laptops
media.ccc.de
27K views • 10 years ago
43:28Leaping the chasm from proprietary to open: A survivor's guide
Bryan Cantrill
14K views • 11 years ago
59:2328c3: The Science of Insecurity
28c3
42K views • 14 years ago
29:01Netanel Rubin: The Perl Jam: Exploiting a 20 Year-old Vulnerability
media.ccc.de
8K views • 11 years ago
24:31Introduction to LibrePCB A new, powerful and intuitive EDA tool for everyone
FOSDEM
15K views • 8 years ago
13:47Theo de Raadt (ruBSD 2013)
fuckyoustupidzombie
41K views • 12 years ago
1:06:36Computer Security 161 Cryptocurrency Lecture
Nicholas C Weaver
128K views • 4 years ago
1:07:10Brian Beckman: Don't fear the Monad
jasonofthel33t
415K views • 13 years ago
45:50"The Mess We're In" by Joe Armstrong
Strange Loop Conference
398K views • 12 years ago
1:02:041. Introduction for 15.S12 Blockchain and Money, Fall 2018
MIT OpenCourseWare
7.2M views • 6 years ago
24:20Satoshi Has No Clothes: Failures in On-Chain Privacy by Ian Miers (Devcon4)
Ethereum Foundation
5K views • 7 years ago
53:53Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd"
Hackfest Communication
27K views • 10 years ago
54:01Abseil's Open Source Hashtables: 2 Years In - Matt Kulukundis - CppCon 2019
CppCon
22K views • 7 years ago
12:24Elliptic Curve Back Door - Computerphile
Computerphile
554K views • 8 years ago
38:22Kim Nilsson - Cracking MtGox
TheBitcoinArmy
47K views • 9 years ago
4 comments from Hacker News
I'd expect higher quality code review from OpenBSD folks (who maintain LibreSSL), compared to OpenSSL. Also, an interesting talk: LibreSSL: The first 30 days, and what the Future Holds from BSDCan: < ▶ this video >
I am reminded of the libressl - 30 days in report. ▶ this video Removing support for old versions is a simplification of what needs to be considered. It is a reduction of complexity. If someone is running a PHP version that has been EOLed, it is perfectly reasonable to discontinue support for it in a library - even if new features that weren't available in the EOL'ed version haven't been added yet.
There is a fascinating and funny talk by Bob Beck from OpenBSD on the first 30 days after forking OpenSSL. One of the things he addresses is the scary code and how is prevents community involvement. He also talks a great deal about all that stuff that's not really relevant anymore and how much they removed from the LibreSSL source code. Apparently the crypto modules are pretty well made according to the OpenBSD developers. LibreSSL: The first 30 days, and what the Future Holds: ▶ this video
Anyone interested in details of LibreSSL development can watch the BSDCan talk at ▶ this video - there really are a LOT of instances of braindamaged code in OpenSSL and a radical repair is pretty much the only thing which will work.