Someone has to pay for something to be what he says. Maybe the almighty Google or Facebook or Apple someone should fork over some bucks to support a correctly constructed alternative. Open source may be "free" but building something complex and correct is not free to build. Given that openssl had about 2K donated per year it's really a hobby project. It's not like Linus works on Linux while flipping hamburgers for a living.
It's absolutely true, good programming costs money and somebody has to pay[1], but given the amount of money floating through TLS protected connections, that should be a solveable problem, once people realize it is there.
But I think the major problem with OpenSSL is that it never had anything resembling architectural leadership: Things just got bolted on to the side and hung from any convenient nail people could find.
Apple has SecureTransport[1] and it is open source[2], it had the goto fail bug from earlier this year. Shoving money at the problem isn't necessarily the answer. The problem is the TLS spec is a confusing, arcane spec riddled with tons of gratuitous addons and extensions. Implementing all or even most of it without error/bus is simply a very hard problem
Comments
Someone has to pay for something to be what he says. Maybe the almighty Google or Facebook or Apple someone should fork over some bucks to support a correctly constructed alternative. Open source may be "free" but building something complex and correct is not free to build. Given that openssl had about 2K donated per year it's really a hobby project. It's not like Linus works on Linux while flipping hamburgers for a living.
It's absolutely true, good programming costs money and somebody has to pay[1], but given the amount of money floating through TLS protected connections, that should be a solveable problem, once people realize it is there.
But I think the major problem with OpenSSL is that it never had anything resembling architectural leadership: Things just got bolted on to the side and hung from any convenient nail people could find.
PS: Yes, I wrote that piece.
[1] https://www.varnish-cache.org/docs/trunk/phk/dough.html
Apple has SecureTransport[1] and it is open source[2], it had the goto fail bug from earlier this year. Shoving money at the problem isn't necessarily the answer. The problem is the TLS spec is a confusing, arcane spec riddled with tons of gratuitous addons and extensions. Implementing all or even most of it without error/bus is simply a very hard problem
[1]: https://developer.apple.com/library/mac/documentation/securi...
[2]: http://opensource.apple.com/source/libsecurity_ssl/libsecuri...