@ConorMancone Well, the correct term is indeed "national socialists", because they were members of the NSDAP, the "National-Sozialistische Deutsche Arbeiter-Partei" ("National-Socialist German Workers Party"). The term "Nazi" was a german abbreviation of the word "National", but was only used in conjunction with "Nazi-Sozi".

To say that "Nazi" is right and "National Socialist" is wrong is just historically incorrect.

A historically accurate discourse should allow that we describe the groups in the ways they described themselves.

You would also write "The Communist Party of the Soviet Union" and not "the commies"

Sure, you could use commonly used names such as "The Japanese during WWII" instead of "The Imperial Japanese Army", but to insist that the former is somehow "more correct" or that you are a fascism-sympathizer if you use the latter is just weird

There seems to be this weird idea that if you talk in any other way than derogatory of the germans during WWII, you are somehow a nazi.

As per the question: The Wehrmacht did indeed use the Lorenz machine. I don't know why he believed that they didn't.

The Lorenz was indeed better than the Enigma, but was much bigger and heavier, than the comparatively portable Enigma, which limited its use.

If some commander was stationary enough, upgrade to a Lorenz was indeed feasible.

@RoryAlsop Why did you delete that question, by the way? It seems on-topic enough for me.

So I would like to know a bit about history

Why all these main stream softwares uses OpenSSL(I am not sure about this but I guess many popular software use OpenSSL)? Why not using GnuTLS or NSS or the Windows platform implementation of TLS for example?

@Rick I'm in a meeting right now, but I'll happily answer in a few minutes

OK thanks. Take your time :)

@MechMK1 We destroyed his account as abusive - the question went as a by product of that.

@RoryAlsop I see. The question itself seemed fine to me though. I mean, "Why was this encryption thing used instead of this one in this historic context?" is on-topic in my opinion

@MechMK1 "Why" makes questions usually off topic here. We did discuss moving it to History.SE

Eh, I would disagree that "Why" are inherently off-topic, but I agree that this question was borderline

But then the OP got abusive, so initially we suspended, then destroyed when we looked into the account further

Yeah, that was kind of uncalled for, but then again people need to be at least 14 to use SE and even with 14 one can expect a person to be somewhat reasonable

@Rick Are you still here?

Yes

:P

Alright, so regarding heartbleed

The full paragraph you cited is as follows:

That's right

And your question was why does everybody use OpenSSL instead of others, such as GnuTLS, etc...

Ya

OpenSSL is already very old. It started in 1998

GnuTLS began in 2003

Ah OK GnuTsl begin in 2003

Why not use the Windows implementation? because it was windows only

I guess so\

So unless you knew 100% that you never ever want to support Android, iOS, MacOS or Linux, you don't want to use such a platform binding

Most modern web servers (Apache, nginx, etc..) all run on Linux as well

Mozilla NSS actually originated from some old Netscape code

But these large companies can develop their own TLS implementations. For example, Google, that should not be a big deal for Google.

Google does

boringssl.googlesource.com/boringssl

And make it closed sourced

But why?????

Why would you ever want to make crypto code closed source!?

Yes I read Wikipedia and after that heartbleed event, serveral other implemtnations comes up

Maybe safer? Since Google have enough experts who can do that work.

As you see, openssl, open source and also results in such a disaster.

Hmmm. I just feel a bit surprised that Openssl dominates this area. I mean, for example, as you mentioned, GnuTLS began in 2003. Do any well-known softwares use GnuTLS ?

Ah that link you provided is helpful. I read the introduction of that page

@MechMK1 Did you read his very final comment at the very bottom of his deleted answer? I wasn't clear, but that is what really wrapped everything together - not so much his insistence on using "National Socialists"

@Rick No no no no no, you have it all wrong

the problem isn't that OpenSSL being open souce lead to this disaster

On the very contrary

The fact that it was open-source lead to the bug being fixed!

Who knows who already knew about this bug waaay before then. Nobody knows

Perhaps agencies like the NSA already abused Hearbleed for years and nobody knew?

The reason why heartbleed existed is because OpenSSL has very critical code, that very few people are able to write correctly. As such, very few people actually bother contributing to OpenSSL, as compared to other open-source projects (e.g. firefox)

As a result, less eyes look at the code. Also the code quality was notoriously bad in OpenSSL because so few people who really focus on high-quality code bothered working on OpenSSL

This lead to the creation of LibreSSL, which aimed at creating a more stable SSL library

I don't know if that project went anywhere major though. Several packages pledged to support libressl (nginx does, or at least did at some point, as far as I know)

@Rick Yes, VLC supports GnuTLS, but I'm not sure if it supports OpenSSL too

@ConorMancone Some people are just like that. I regularly get called all kinds of names when getting into political arguments. You just have to grow a thick skin on the internet.

@MechMK1 That is definitely a true story. I learned quite a lot from that exchange. I'm now embarrassed to admit that I didn't know that Nazi was short for "National Socialists". I am still curious about the dude's claim of that being a derogatory term

@ConorMancone Modern National Socialists consider the term "Nazi" akin to how Communists consider the term "Commie"

Obviously Nazi is pretty much only used negatively today, but presumably "Nazi" was simply their name back then?

@ConorMancone It was used somewhat commonly to refer to the members of the NSDAP, but the term "Die National-Sozialisten" ("the national-socialists") was used in more formal contexts

It's a bit similar to how democrats in the US are referred to as "the dems". It can be used negatively, but not necessarily so.

Hmm. I get your point. Open source, easy for hackers to find bugs. Because they can read the source. Also, easy for others to fix it. Close source, more difficult for bad guys to find bugs. No source code is provided. And the public can't take a eye on it.

@Rick Exactly. And with crypto code, it's much better to have lots of experts having their eyes on stuff than to try to hide it away

Just look at todays encryption algorithms. Every single one that we use, AES, Twofish, Serpent, Poly1305, etc... area ALL extensively studied by cryptographers world-wide

> Heartbleed is a security bug in the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. "It was introduced into the software in 2012 and publicly disclosed in April 2014."

But this from Wikipedia really surprised me.

Every single company - literally every single one - that claimed to use a "custom encryption format unknown to hackers" has had their algorithm cracked and is being laughed at by cryptographers

@Rick Why?

2 years...

Yes, but what exactly surprizes you?

It was after 2 years when the heartbleed bug was found.

I understand what you are trying to say, but why exactly does it surprize you that it took two years?

@Rick that's isn't really a long period of time. There are severe security bugs that took 10+ years to find

Because I read some articles and I know that an hacker may steal sensitive information with this bug. Like password

Yes, but that is all about what they can do with it, not the nature of the bug.

Do you understand how Heartbleed works?

@MechMK1 Technically no. I just read some text description and image illustration

But OpenSSL is open source. Everyone can read the source code. I expect experts should discover that problem in a short time. Maybe 2 months? A few weeks

@Rick I'll elaborate why this is not the case

Heartbleed is the result of a missing check in the TLS Heartbeat extension

The Heartbeat extension allows a client to keep up an already established TLS session, even when no data is transmitted, by repeatedly sending "Server, are you still there? If so, send BIRD (4 letters)" and the server would reply with "BIRD"

As you can tell from this description, this is the solution to a problem that not very many people had

In fact, heartbeat was disabled by default on basically any major server software using OpenSSL

This means that very few people actually gave a damn about Heartbeat. It was a niche solution to a niche problem.

Those few people who actually care to test OpenSSL and verify how correctly it operates will test the things that actually matter. Certificate verification, key exchanges, etc...

Those are things that matter to the vast majority of users, and thus bugs there would greatly compromise the security of millions of users.

So yeah, it did take years to find heartbleed. Not because the vulnerability wasn't severe enough, but because it wasn't affecting that many people.

Objection, sir.

> The defect spread with the release of OpenSSL version 1.0.1 on March 14, 2012. Heartbeat support was enabled by default, causing affected versions to be vulnerable

@Rick Heartbeat "support"

That doesn't mean that the extension itself was enabled

It just means that these versions could do heartbeat

Ok let me check

What was the other ssh library that turned out to have a severe vulnerability as well? It was more recent, although the library in question was also much less popular....

@ConorMancone Really? There was another one?

@Rick The problem with heartbleed was that it was perfectly stealthy

Meaning you had no indicator whatsoever whether or not you have been exploited

Do you mean that "the server can be attacked but with no trace", mentioned by some articles I saw online?

Exactly. So administrators who had vulnerable OpenSSL versions on their hands couldn't know if they had been attacked or not

I am searching on the Net to see whether heartbeat extension is enabled by default...

Because if it's not enabled by default, like you said, then it's not really a big deal...

@MechMK1 found it - libssh. It's not as commonly used as openssh

nakedsecurity.sophos.com/2018/10/17/…

@ConorMancone Damn, that's hardcore :D

Anyways, I'm off for lunch. See ya

Bye

Thank you

:D

Have a nice lunch

I'm back my lads

=.= I haven't had my dinner yet

As much as I love testssl.sh, I hate that it doesn't run on windows

Or rather, I hate Windows for not running testssl.sh

Holy shit I am going insane

AAAAAAAAaaaaaaa
              aaaa
                  aɐ
                    ɐ
                    ɐ
                  ₐᵃ
                 ₐᵃ
                 ᵃ🇦
                   🇦
                    🇦🇦🇦
                      🇦🇦🇦🇦

@MechMK1 lol, sounds very exciting! Who knew checking TLS was such a pain!

Sounds like me learning Kubernetes over the past year or two

@ConorMancone I honestly don't want to exist anymore. The screams of agony echo through the DMZ

No more, I beg you

YES

I fucking did it

I am a God amongst Men. Legions tremble before me.

@MechMK1 That's always the fun part :)

Holy shit I feel like I am learning things about OS virtualization that I did not want to learn

gph.is/g/aXmXBVn

:D

You now qualify for a €100/month raise

Tell your boss I said so

> You listen up, there's this guy in this online chat and he said I am qualified for more money.

Sounds legit.

Fucking finally

I wish I could tell you what kind of ciphers this thing uses

All I say is that this supports SSLv2

I would guess RC4, DES and NULL.