LibreSSL with Bob Beck
Why Hacker News recommends it
Frequently linked as an entertaining and alarming account of OpenSSL code quality and why the fork happened.
Recommended by 6 people across 5 different months, 2014 to 2025.
What it is
Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.
What people said
Strong rec mrweasel · 2021-10 · Hacker News · on “OpenBSD: How it all started”
Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. [this video]
Recommends protomyth · 2014-05 · Hacker News · on “BSDCan 2014 Videos”
The LibreSSL talk is funny and scary. [watch the other version one [this video] so you can hear the other people and see the end]
Recommends lomnakkus · 2014-05 · Hacker News · on “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”
"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: [this video]
Recommends teamhappy · 2015-10 · Hacker News · on “BoringSSL”
It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL[1] (Ted's there too). [1]: [this video]
Recommends Bayart · 2021-11 · Hacker News · on “U.S. telecoms are going to start physically removing Huawei gear”
The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3]. In that case open source was at least able to react appropriately, even if it didn't act preemptively. [1]: [LINK] [2]: [LINK] [3]: [this video]
Recommends g0xA52A2A · 2023-02 · Hacker News · on “OpenSSL Security Advisory [7th February 2023]”
This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck[1], around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? [1] [this video]
Cites clarry · 2014-05 · Hacker News · on “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”
Just in case someone missed it, here's video of the libressl talk to go with the linked slide(s). [this video]
Cites forgottenpass · 2014-05 · Hacker News · on “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”
I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones. That's reasonable, but those aren't the options at play here. Not only because GnuTLS is already a thing, but the chances of OpenSSL becoming really really good are questionable. An OpenBSD guy gave a talk a few weeks back where he said that Heartbleed wasn't the reason for the split, it was the reason for digging into the code and realizing that OpenSSL under current leadership isn't capable of being a really really good option. [this video]
Cites simula67 · 2014-05 · Hacker News · on “OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative”
From Beck's talk[1] they are not reviewing the cryptography code, merely cleaning up the programming. They admit they don't yet have cryptography experts reviewing if the algorithms/implementations are doing what they are supposed to be doing and that they are in fact secure. [1] [this video]
Cites protomyth · 2014-05 · Hacker News · on “Pointers Gone Wild”
> Maybe I'm naieve, but I think perhaps the problems with OpenSSL had come to light a little bit sooner if all dangerous code had clearly been marked 'unsafe'. After listening to Bob Beck's talk[1], I think people did know how unsafe that code was but no one wanted to take a shot at fixing it until it all went bad. At 2:12 into the video (the Jon Snow slide), he explains why nobody looked (or admitted they looked)[2]. Code can be so bad in any language to discourage people from even attempting to figure out how it works. 1) [this video] 2) quotes "Why did WE not look" & "It is your parents talking about how you got made horrible"