OpenSSL 1.0.0 released [LWN.net]

OpenSSL 1.0.0 released

Posted Mar 30, 2010 10:38 UTC (Tue) by patrick_g (subscriber, #44470)
In reply to: OpenSSL 1.0.0 released by rsidd
Parent article: OpenSSL 1.0.0 released

>>> the high level of expertise required would hopefully deter local modifications downstream (like the Debian incident).

Well Marco Peereboom (author of the text "OpenSSL is written by monkeys") is an OpenBSD hacker so he must have the knowledge to change the code.

to post comments

OpenSSL 1.0.0 released

Posted Mar 30, 2010 11:49 UTC (Tue) by hppnq (guest, #14462) [Link] (2 responses)

You may want to reconsider.

Unhindered by what can only be called a limited grasp of the delicate material at hand, Mr Peereboom wrote a library that apparently is supposed to replace OpenSSL, called assl (forget that name), which currently targets a dazzling two platforms. It does not seem to add anything useful, but it does contain roughly 10% goto statements, 90% of those in a macro.

I am not sure whether this code is in OpenBSD. Certainly, it does not belong there. Oh, and I forgot to congratulate the OpenSSL team on an excellent piece of work!

OpenSSL 1.0.0 released

Posted Mar 30, 2010 12:07 UTC (Tue) by rsidd (guest, #2582) [Link] (1 responses)

I just looked it up. It's not supposed to replace OpenSSL. It's a wrapper
offering an alternative API. And there's nothing wrong with GOTO statements
when used appropriately: the linux kernel has plenty of those too. It is
often the cleanest and most readable way to break out of nested loops.

OpenSSL 1.0.0 released

Posted Mar 30, 2010 14:09 UTC (Tue) by hppnq (guest, #14462) [Link]

From the project webpage and the source code, I can only conclude that the assl API is definitely meant to replace the OpenSSL API, which you are quite strongly encouraged not to use.

Not even the author would dream of replacing the OpenSSL implementation with his own. It speaks volumes that the quite trivial problem he set out to solve has, of course, not been implemented in his library. Instead, he chose to partially implement what was already there, poorly. The multiple goto's in every subroutine are indicative of the general quality of the code.

I would recommend that newbie SSL application programmers take some time and learn to use the OpenSSL API -- it is not that hard and you will come away with precious knowledge. For a quick and dirty job, read the sample code that comes with OpenSSL instead, and live happily.