<story><title>OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative</title><url>https://www.linuxfoundation.org/news-media/announcements/2014/05/core-infrastructure-initiative-announces-new-backers</url><text>&amp;quot;Network Time Protocol, OpenSSH and OpenSSL first projects to receive support; Open Crypto Audit Project to conduct security audit of OpenSSL&amp;quot;</text></story><parent_chain><item><author>tptacek</author><text>OpenBSD is not auditing OpenSSL. They&amp;#x27;re substantially rewriting it. The net effect is hopefully similar, but it&amp;#x27;s a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we&amp;#x27;re talking about cryptography, which is not as easy to spot or to fix &amp;quot;accidentally&amp;quot; [which is part of OpenBSD&amp;#x27;s M.O.] as memory corruption).&lt;p&gt;&amp;quot;Theo&amp;#x27;s a dick&amp;quot; has nothing to do with why funds are being applied to audit and not to &amp;quot;just have OpenBSD rewrite everything&amp;quot;.</text></item><item><author>kyledrake</author><text>Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve?&lt;p&gt;And &amp;quot;Theo&amp;#x27;s a dick&amp;quot; doesn&amp;#x27;t qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating system (they lead, others followed), the entire team deserves to be well-off dicks. It&amp;#x27;s to me the ultimate highlight of OSS&amp;#x27;s funding problem. People make millions&amp;#x2F;billions of dollars off of this software, and nobody ever contributes any of that back to the shoulders they stood on to make that happen.</text></item></parent_chain><comment><author>marcosdumay</author><text>A security audit may also miss subtle bugs, and the proposed corrections may introduce new bugs.&lt;p&gt;A rewrite has the benefit that it will lead to manageable code, instead of the current mess. Clean code has less places where subtle bug can hide, that does not change just because you are doing cryptography.&lt;p&gt;Anyway, they should send money to both. Both are important, and those companies make so much money using free software, they shouldn&amp;#x27;t be choosing the projects with that fine granularity. The problem is that they won&amp;#x27;t, and as much as kyledrake does not like the answer, it&amp;#x27;s because of Theo. Yes, it&amp;#x27;s a stupid decision, but it does not make it less real.</text></comment>
<story><title>OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative</title><url>https://www.linuxfoundation.org/news-media/announcements/2014/05/core-infrastructure-initiative-announces-new-backers</url><text>&amp;quot;Network Time Protocol, OpenSSH and OpenSSL first projects to receive support; Open Crypto Audit Project to conduct security audit of OpenSSL&amp;quot;</text></story><parent_chain><item><author>tptacek</author><text>OpenBSD is not auditing OpenSSL. They&amp;#x27;re substantially rewriting it. The net effect is hopefully similar, but it&amp;#x27;s a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we&amp;#x27;re talking about cryptography, which is not as easy to spot or to fix &amp;quot;accidentally&amp;quot; [which is part of OpenBSD&amp;#x27;s M.O.] as memory corruption).&lt;p&gt;&amp;quot;Theo&amp;#x27;s a dick&amp;quot; has nothing to do with why funds are being applied to audit and not to &amp;quot;just have OpenBSD rewrite everything&amp;quot;.</text></item><item><author>kyledrake</author><text>Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve?&lt;p&gt;And &amp;quot;Theo&amp;#x27;s a dick&amp;quot; doesn&amp;#x27;t qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating system (they lead, others followed), the entire team deserves to be well-off dicks. It&amp;#x27;s to me the ultimate highlight of OSS&amp;#x27;s funding problem. People make millions&amp;#x2F;billions of dollars off of this software, and nobody ever contributes any of that back to the shoulders they stood on to make that happen.</text></item></parent_chain><comment><author>sigzero</author><text>I would trust Theo&amp;#x27;s team over the OpenSSL team any day of the week.</text></comment>