| ▲ | ahartmetz 3 hours ago |
| >We do not fully understand the motivations that led to the public APIs and internal complexity we’ve described here. We’ve done our best to reverse engineer them by asking “what would motivate someone to do this” and often we’ve found ourselves coming up short. Surely they thought of it but didn't say it out loud... to keep it exploitable, maybe? |
|
| ▲ | woodruffw 2 hours ago | parent [-] |
| No, that's not what's being implied. They're just saying they don't understand why OpenSSL has added so many indirections to otherwise straightforward operations. Source: I am friends with the maintainers who wrote this and was one of the people who reviewed it in draft form. |
| |
| ▲ | pseudosaid 2 hours ago | parent [-] | | yet you too dont have an idea why asinine decisions were championed | | |
| ▲ | woodruffw 2 hours ago | parent [-] | | I have a pretty good idea. And it has nothing to do with malice or exploitability. | | |
| ▲ | noitpmeder 2 hours ago | parent | next [-] | | Care to share...??? | | |
| ▲ | palata 2 hours ago | parent [-] | | Didn't they say it already? They basically think that the OpenSSL API is convoluted. That's my understanding of the comment above, at least. | | |
| ▲ | timschmidt an hour ago | parent [-] | | Unnecessarily complicated APIs are a security code smell precisely because they help hide bugs, leaky abstractions, insecure state, and other exploitable issues. | | |
| ▲ | palata 32 minutes ago | parent [-] | | Did I say they weren't? Not sure why I'm being downvoted here. | | |
| ▲ | timschmidt 12 minutes ago | parent [-] | | Op did immediately above you i.e.: "nothing to do with malice or exploitability" and when asked to explain you responded with: "Didn't they say it already?" Which any reader can verify they have not at the time of 1:42pm EST Oct 23 2026. |
|
|
|
| |
| ▲ | incanus77 an hour ago | parent | prev [-] | | Gee, I wonder what it could’ve been… |
|
|
|
