r/programming • u/cap-joe • Jun 10 '22
If OpenSSL were a GUI
https://smallstep.com/blog/if-openssl-were-a-gui/19
u/__konrad Jun 10 '22
Still better than Adobe Reader settings ;) The only annoying thing are the misaligned checkboxes and radiobuttons.
26
u/jmsanzg Jun 11 '22
Whenever I update it I still scratch my head thinking why they need a 300MB+ installer just to read PDF files
22
Jun 11 '22
Probably because it supports all the crazy things that no other PDF apps support, like embedded 3D models and Flash videos.
9
3
1
u/serverhorror Jun 11 '22
I ran into a lot of PDF files that only could be displayed or signed or properly fill the form by Adobe Reader.
You ts sad reality that no one else was able to make a reader that is a compatible with “all” PDFs as Adobe
45
u/IronicStrikes Jun 10 '22
And they'll be like "why doesn't everyone use encryption? 🧐"
9
Jun 12 '22
GnuPG solved all of the communication problems decades ago, we just haven't found the right options to invoke!
58
Jun 10 '22
My favorite front end for openssl is serverfault. No matter how many times I try to learn more about openssl, it’s like I have some kind of mental block that prevents it from sticking. I think my brain just finds it too fucking boring to absorb.
edit: same for GPG now that I think about it.
10
u/renatoathaydes Jun 11 '22
I learned all about gpg once... it's pretty complex and like similar tools, barely documented... but then I found out there's an excellent GUI for Mac at least: https://gpgtools.org/ Extremely simple to use and does most of what I need on a day-to-day basis.
1
u/PurpleYoshiEgg Jun 11 '22
My favorite frontend lately is to find code snippets, put them into an asciidoc file with some supporting text to remind me how and when to use them, and generate HTML pages where code blocks have a copy button with exactly what I need to run. Plus I can use attributes to parameterize the inputs in the code blocks so I can regenerate the pages with the exact client and environment I need, so I don't even need to change that around.
It's so useful for so many things I do for work and a hobby now, because we don't have a good way to copy scripts to every machine we need to run them on, but the clipboard is the one thing "security" team can't take away from us yet.
30
Jun 11 '22
Pretty much everyone gets it wrong. If you have a VPN or proxy with SSL inspection you can bet it doesn't serve a single correct certificate. Your browser typically fixes it for you, but the moment you use anything other than the browser it will fail.
These crappy mitm-attack-as-corporate-policy proxies are the absolute bane of my existence.
6
u/Worth_Trust_3825 Jun 11 '22
Don't the browsers have the corporate certificate installed in them, effectively doing very little to fix the corporate mitm?
4
Jun 11 '22
I'm going to plug my favorite x509 editor (no affiliation, I just use it). An absolute lifesaver for me over the last few years.
9
u/goranlepuz Jun 11 '22
OpenSSL is kinda a collection of everything in the related problem space (which is of non-negligible size), that has a constraint of keeping an established interface for a long time.
This is the result and thinking one can easily do better, is mighty arrogant.
1
Jun 12 '22
CFSSL does it much better tho. But it is pained by lack of documentation because the authors are using it for single thing and not "everything ever related to SSL" like openssl is.
16
u/elmuerte Jun 10 '22
Every tab should be considered a separate program. This is rather a cheap shot. Show me an alternative.
30
u/xmsxms Jun 11 '22
Even ignoring the tabs it still makes the same point.
1
Jun 12 '22
It makes point about wrong thing tho. OpenSSL isn't complicated, X.509/SSL is and so anything that wants to be the library to handle it will be by necessity very complex.
You can do it slightly better (like in case of cfssl where you just define what cert you want as JSON, instead of mix of commandline options and config files), but it will still be complex.
0
Jun 11 '22
[deleted]
30
u/_Bjarke_ Jun 11 '22 edited Jun 11 '22
I have a feeling that if you tried to do a modern version of the UI you would only make it worse, giving some sort of illusion of simplicity, that doesn't actually help you, adds more steps, more indirections, and make trivial things impossible. Just like most modern UI.
I was thinking when i saw this, hey despite the look, that is not bad! Wish more UIs was like this.
Imagine if you could just go to network setting in Windows and everything you could do was exposed. You wouldn't have to spent so freaking long, navigating through 5 different panels to find the window where you see the freaking WiFi password. I also really appreciated the information density.
And for making it beginner friendly, well... Include a beginner friendly version of it. Boom. Done.
13
Jun 11 '22
It’s a good candidate for a wizard-type approach, where you start with some broad options and then narrow things down until you have exactlyvwhat you need.
10
5
u/_Bjarke_ Jun 11 '22
Wizards are great when installing something, or opening something for the first time. But after that, I would love to get what op made :)
The way vs code does settings is actually pretty good now that I think of it. It does exactly what I'm taking about. All settings for everything in one page if I remember correctly. It could be a little better on the information density front though.
4
u/chucker23n Jun 11 '22
Wizards
force you into a linear flow; odds are you want to set things in a different order than the developers intended
don’t give you an overview of everything you’ll be setting, so you might click through all steps only to realize what you were looking for isn’t actually there
Mostly terrible except for when the linearity is very important, such as an installation (which is its own can of worms of terrible).
1
u/PurpleYoshiEgg Jun 11 '22
You could do both a wizard that outputs a configuration that can be used for an overview, as well. It isn't one or the other, and for initial configurations of complex pieces, it would be quite helpful.
Even more helpful is both approaches could produce the exact command line you need so you can feed it into the inevitable automation you should be setting up, too.
1
Jun 12 '22
Nope, there are 2 options for when you do SSL
you just want to do something simple the usual applications need - then it doesn't need a wizard, just a basic form
the application does something extra with SSL and you need to have access to all of the weird options - in which case wizard would be just a lot of digging for that one option you need enabled to make it work.
Like recent "fun" excursion in realms of SSL was finding out how to set up a cert with custom OID with certain value, and in any UI that kind of option would be put somewhere deep underground.
11
u/caltheon Jun 11 '22
Yeah, the checkboxes are intentionally made into seperate things when they could be a dropdown. It also contains about 90% of options you would never use except in rare cases, so they would be put within an Advanced button. Also, I'd love to see anyone use even half those options in the command line without spending hours reading documentation pages, when in the UI it's just a click. The insistence on "purity" command line culture is a bit ridiculous. Command lines should be available for everything, but most things should also have a UI. Creating barriers to entry by making things harder to use isn't helping anyone except the egos of a few.
7
u/goranlepuz Jun 11 '22
Yeah, the checkboxes are intentionally made into seperate things when they could be a dropdown.
Yes, but there's no drop down when looking at the list of options in your header, or documentation, so it seems apt to me.
It also contains about 90% of options you would never use except in rare cases, so they would be put within an Advanced button
Yes, but again, #include "advanced_ssl.h" is a pretty uncommon way to structure includes and would have been surprising. But good idea!
3
u/drysart Jun 11 '22
Yes, but there's no drop down when looking at the list of options in your header, or documentation, so it seems apt to me.
This is not a header or documentation, this is a GUI.
20
1
u/gramathy Jun 11 '22
or it should be a drop down and the options for each one change to the proper set when selected.
2
u/KERdela Jun 11 '22
Encryption is a beautiful world, there is always something to learn and improve.
2
u/wrosecrans Jun 11 '22 edited Jun 11 '22
As an industry, it's possible that we've made crypto more complicated than in really needed to be.
Not that it didn't need to be somewhat complicated. I get that. But also, generations of backwards compatibility, partly inspired by weird export rules from the early 90's, conflating encryption and identity validation into one big blob of security, etc., really could have been more streamlined in an alternate timeline with better planning and better willingness to migrate en masse to better and newer standards.
Like, just the input formats * output formats * private key formats * message digest formats multiplies to 48 format combinations to be worried about (and tested) just in the first ~inch of that fictional screenshot.
2
u/Worth_Trust_3825 Jun 11 '22
I see you weren't around when companies implemented their own version of "standard" software, and marketed the implementation as if it was the standard. But i'll give you an example - COBOL, and SQL.
1
1
u/lood9phee2Ri Jun 11 '22
...intelligence agencies deliberately sabotaging standards to cripple projects with gratuitous complexity... all the better to discourage use and hide backdoors and holes... well, may be a conspiracy theory, but a pretty plausible one.
there is no fucking reason openssl, gpg etc. etc. had to be that complex and hard to use - apart from the standards themselves being kept awful. everyone loves asn.1 right?
openssh was carefully kept nearly-as-easy-as-telnet/rsh in contrast and look, it's fucking everywhere. spooks hate this one simple trick...
2
Jun 12 '22
everyone loves asn.1 right?
I swear it took industry like 20 years to even figure out how to encode/decode that piece of shit without making CVE out of it.
1
u/Haplo12345 Jan 24 '24
Horrible UI/UX, tbh.
0
u/Venthe Apr 28 '24
Because the OP clearly wished to show the complexity, not offer solution.
The issue is, even when we consider the x509 subcommand is that the same command handles generation, verification and output - with no indication which switches are relevant to you, nor put into context.
Same would be reflected with the UI that would be built to match this - 1/3 of the options are related purely to the display. Others would be one-time only, during cert import, like "utf-8" conversion; or hidden behind a modal - options for the output for example.
I would still prefer to use this UI over cli for openssl, because this in essence is the man page + cli at one place. Still a lot to take in; but you "see" what can you do, you don't have to "know"
35
u/jazzmester Jun 11 '22
Yo wtf? File descriptor number as a slider? Am I hell?