{"version":"1.0.0","segments":[{"startTime":0.0,"endTime":1.365,"body":"It's 2026."},{"startTime":1.375,"endTime":4.279,"body":"It's like the most scrutinized"},{"startTime":1.375,"endTime":4.279,"body":"C code on the planet."},{"startTime":4.279,"endTime":7.069,"body":"All of like the low hanging fruit,"},{"startTime":4.279,"endTime":7.069,"body":"memory, corruption, and open."},{"startTime":7.579,"endTime":9.319,"body":"An OpenSSL gone now, right?"},{"startTime":9.319,"endTime":10.579,"body":"Like how likely"},{"startTime":10.579,"endTime":11.509,"body":"one today,"},{"startTime":11.659,"endTime":12.919,"body":"so I was gonna say, like we, we were"},{"startTime":13.009,"endTime":13.489,"body":"literally"},{"startTime":13.579,"endTime":13.929,"body":"today."},{"startTime":19.113,"endTime":20.073,"body":"Hello."},{"startTime":20.133,"endTime":22.383,"body":"Welcome to Security"},{"startTime":20.133,"endTime":22.383,"body":"Cryptography, whatever."},{"startTime":22.443,"endTime":23.373,"body":"I'm Deirdre."},{"startTime":23.763,"endTime":24.393,"body":"I am David."},{"startTime":25.093,"endTime":27.733,"body":"I am a national spokesperson for"},{"startTime":25.093,"endTime":27.733,"body":"the Crystal Hot Sauce company."},{"startTime":28.318,"endTime":28.858,"body":"Awesome."},{"startTime":29.488,"endTime":30.448,"body":"That's Thomas."},{"startTime":30.858,"endTime":31.998,"body":"and we have two."},{"startTime":32.283,"endTime":34.143,"body":"Special guest today we have returning"},{"startTime":34.143,"endTime":34.623,"body":"champion,"},{"startTime":34.623,"endTime":35.323,"body":"Alex Gaynor."},{"startTime":35.343,"endTime":36.183,"body":"Hi Alex."},{"startTime":36.183,"endTime":36.303,"body":"Hello."},{"startTime":36.393,"endTime":36.873,"body":"Hello."},{"startTime":36.873,"endTime":38.208,"body":"Thanks for having me a second time."},{"startTime":38.403,"endTime":39.843,"body":"Yes, thanks for coming back."},{"startTime":39.843,"endTime":41.013,"body":"We didn't scare you off."},{"startTime":41.103,"endTime":46.443,"body":"And, uh, our other collaborator on the"},{"startTime":41.103,"endTime":46.443,"body":"Python Cryptography Library, Paul Kehrer."},{"startTime":46.623,"endTime":47.463,"body":"Hi Paul."},{"startTime":48.093,"endTime":48.593,"body":"Hi everybody."},{"startTime":48.918,"endTime":50.628,"body":"I'm just here on Alex's shirt tails."},{"startTime":51.003,"endTime":56.363,"body":"Yes, we invited Paul and Alex today,"},{"startTime":51.003,"endTime":56.363,"body":"on today because they wrote a little"},{"startTime":56.363,"endTime":61.433,"body":"blog post about OpenSSL and they"},{"startTime":56.363,"endTime":61.433,"body":"gave a talk about OpenSSL a couple"},{"startTime":61.433,"endTime":63.693,"body":"of weeks ago, on the same topics."},{"startTime":63.753,"endTime":70.263,"body":"And they have a lot of experience trying"},{"startTime":63.753,"endTime":70.263,"body":"to operate around OpenSSL as maintainers"},{"startTime":70.473,"endTime":73.383,"body":"of the, the Python Cryptography Library."},{"startTime":73.383,"endTime":76.173,"body":"We say the, because it's"},{"startTime":73.383,"endTime":76.173,"body":"literally called cryptography."},{"startTime":76.383,"endTime":80.733,"body":"And so if you wanna redo anything"},{"startTime":76.383,"endTime":80.733,"body":"with cryptography in Python, theirs"},{"startTime":80.733,"endTime":83.013,"body":"is usually the one that you go for."},{"startTime":83.293,"endTime":84.133,"body":"Alex."},{"startTime":84.833,"endTime":89.913,"body":"Te tell us what prompted you to"},{"startTime":84.833,"endTime":89.913,"body":"write this statement, which is"},{"startTime":89.913,"endTime":93.663,"body":"also the first statement from the"},{"startTime":89.913,"endTime":93.663,"body":"Python Cryptographic authority."},{"startTime":93.663,"endTime":94.473,"body":"AKA you two."},{"startTime":94.833,"endTime":99.663,"body":"Before you do that, can I ask one or"},{"startTime":94.833,"endTime":99.663,"body":"both of you to explain to, you know,"},{"startTime":99.663,"endTime":104.933,"body":"the world, why Pike cryptography"},{"startTime":99.663,"endTime":104.933,"body":"is, you know, like why you guys have"},{"startTime":104.933,"endTime":106.583,"body":"standing to make these complaints."},{"startTime":106.583,"endTime":107.573,"body":"Like, who do you guys think you are?"},{"startTime":109.453,"endTime":109.673,"body":"Hi."},{"startTime":109.903,"endTime":110.193,"body":"Sure."},{"startTime":110.273,"endTime":113.513,"body":"I, I, I, I'll start with that and Alex"},{"startTime":110.273,"endTime":113.513,"body":"can jump in as he sees, uh, necessary."},{"startTime":114.213,"endTime":117.773,"body":"So, uh, the Python Cryptographic"},{"startTime":114.213,"endTime":117.773,"body":"Authority is a self-proclaimed authority."},{"startTime":117.773,"endTime":121.343,"body":"It's important to note that inside the"},{"startTime":117.773,"endTime":121.343,"body":"context of Python, there, there used to"},{"startTime":121.343,"endTime":125.163,"body":"be like, like a running gag where you"},{"startTime":121.343,"endTime":125.163,"body":"would create a, an authority to define"},{"startTime":125.223,"endTime":128.433,"body":"like the, basically the, the GitHub"},{"startTime":125.223,"endTime":128.433,"body":"name space that you were going to use."},{"startTime":128.613,"endTime":132.423,"body":"So the Python Packaging Authority,"},{"startTime":128.613,"endTime":132.423,"body":"which became a very official concept"},{"startTime":132.453,"endTime":135.243,"body":"in Python, was originally actually"},{"startTime":132.453,"endTime":135.243,"body":"the creation of a single person"},{"startTime":135.243,"endTime":136.593,"body":"who wanted to go and do some work."},{"startTime":136.993,"endTime":139.933,"body":"similarly, the Python Cryptographic"},{"startTime":136.993,"endTime":139.933,"body":"Authority was founded in kind of an"},{"startTime":139.933,"endTime":142.483,"body":"aspirational manner back in 2013."},{"startTime":143.013,"endTime":147.403,"body":"like Alex and I were working for the same"},{"startTime":143.013,"endTime":147.403,"body":"employer, back then, and we looked around"},{"startTime":147.403,"endTime":151.723,"body":"and discovered that there was not really a"},{"startTime":147.403,"endTime":151.723,"body":"good solution for cryptography and Python."},{"startTime":151.993,"endTime":154.923,"body":"In Alex's case, he was also"},{"startTime":151.993,"endTime":154.923,"body":"interested in Pi, PI, support a"},{"startTime":154.923,"endTime":156.243,"body":"thing that he regrets to this day."},{"startTime":156.543,"endTime":159.256,"body":"Uh, but, uh, The outcome of that was"},{"startTime":156.543,"endTime":159.256,"body":"ultimately that we, you know, we've"},{"startTime":159.706,"endTime":163.936,"body":"embarked on a 13 year and counting,"},{"startTime":159.706,"endTime":163.936,"body":"uh, adventure of taking over the, the,"},{"startTime":163.936,"endTime":165.946,"body":"the world of cryptography and python."},{"startTime":166.206,"endTime":171.166,"body":"and largely we've been successful, mostly"},{"startTime":166.206,"endTime":171.166,"body":"because we have a, I mean, I'm sure we're"},{"startTime":171.166,"endTime":174.946,"body":"gonna get into this, but we, we have a"},{"startTime":171.166,"endTime":174.946,"body":"somewhat maniacal focus on the way in"},{"startTime":174.946,"endTime":178.426,"body":"which we deliver the software and the"},{"startTime":174.946,"endTime":178.426,"body":"way in which we, that the expectations"},{"startTime":178.426,"endTime":182.596,"body":"we set for ourselves, such that we"},{"startTime":178.426,"endTime":182.596,"body":"can and do have higher expectations"},{"startTime":182.596,"endTime":183.411,"body":"for the things that we depend on."},{"startTime":183.861,"endTime":184.051,"body":"Yeah,"},{"startTime":184.306,"endTime":191.996,"body":"I can't emphasize enough how in like pre"},{"startTime":184.306,"endTime":191.996,"body":"13 years ago, so like 2011, if you tried"},{"startTime":191.996,"endTime":196.316,"body":"to make an H-T-T-P-S connection from"},{"startTime":191.996,"endTime":196.316,"body":"Python, it was effectively impossible."},{"startTime":196.756,"endTime":200.566,"body":"you at best like had to install"},{"startTime":196.756,"endTime":200.566,"body":"Py OpenSSL, which didn't have"},{"startTime":200.566,"endTime":203.476,"body":"wheels, so it had to build"},{"startTime":200.566,"endTime":203.476,"body":"OpenSSL from source every time."},{"startTime":203.656,"endTime":207.856,"body":"And so it, and that, and of course,"},{"startTime":203.656,"endTime":207.856,"body":"OpenSSL would fail to compile because"},{"startTime":207.856,"endTime":211.136,"body":"it was 2011 so it was just bad."},{"startTime":211.361,"endTime":215.671,"body":"And for those who don't ship a"},{"startTime":211.361,"endTime":215.671,"body":"lot of python, libraries, wheels"},{"startTime":215.671,"endTime":217.081,"body":"is a technical term of art."},{"startTime":217.171,"endTime":220.501,"body":"It's not just ha ha wheels"},{"startTime":217.171,"endTime":220.501,"body":"included, like batteries included."},{"startTime":220.831,"endTime":221.581,"body":"What are wheels?"},{"startTime":221.881,"endTime":222.061,"body":"Yeah."},{"startTime":222.061,"endTime":225.431,"body":"Wheels are, uh, python's,"},{"startTime":222.061,"endTime":225.431,"body":"binary package artifacts."},{"startTime":225.431,"endTime":229.721,"body":"So you can have an sist which is sourced,"},{"startTime":225.431,"endTime":229.721,"body":"that you compile yourself, or a wheel"},{"startTime":229.871,"endTime":231.461,"body":"that's pre-compiled by somebody else."},{"startTime":231.461,"endTime":235.511,"body":"So we, we build wheels of"},{"startTime":231.461,"endTime":235.511,"body":"cryptography for many, many operating"},{"startTime":235.511,"endTime":237.671,"body":"systems and CPU architectures."},{"startTime":237.971,"endTime":239.981,"body":"This is a, a language called Python."},{"startTime":239.981,"endTime":243.041,"body":"Why isn't, why isn't it"},{"startTime":239.981,"endTime":243.041,"body":"called like eggs or, or like,"},{"startTime":243.041,"endTime":243.881,"body":"were called eggs."},{"startTime":244.301,"endTime":244.841,"body":"oh God."},{"startTime":244.871,"endTime":245.411,"body":"Damnit."},{"startTime":245.771,"endTime":246.101,"body":"Okay."},{"startTime":246.101,"endTime":246.491,"body":"And now they're"},{"startTime":246.491,"endTime":248.471,"body":"called wheels because that makes sense."},{"startTime":248.531,"endTime":248.651,"body":"All"},{"startTime":248.676,"endTime":248.921,"body":"the, the."},{"startTime":248.996,"endTime":252.206,"body":"Alex is the first person to be asked"},{"startTime":248.996,"endTime":252.206,"body":"the same question twice on this"},{"startTime":252.206,"endTime":254.126,"body":"podcast in two different episodes."},{"startTime":254.826,"endTime":257.316,"body":"Yeah, you get your wheels"},{"startTime":254.826,"endTime":257.316,"body":"at the cheese shop."},{"startTime":257.376,"endTime":260.906,"body":"Which The cheese shop was the original"},{"startTime":257.376,"endTime":260.906,"body":"name of the Python package index."},{"startTime":261.206,"endTime":261.496,"body":"What?"},{"startTime":261.846,"endTime":262.136,"body":"Okay."},{"startTime":262.141,"endTime":262.671,"body":"Okay."},{"startTime":262.926,"endTime":266.256,"body":"It's cause Python was named after"},{"startTime":262.926,"endTime":266.256,"body":"a Monty Pi after Monty Python."},{"startTime":266.256,"endTime":268.086,"body":"And the Cheese Shop is a famous sketch,"},{"startTime":268.371,"endTime":271.251,"body":"Now I'm remembering our whole"},{"startTime":268.371,"endTime":271.251,"body":"episode that we, we did this"},{"startTime":271.251,"endTime":272.511,"body":"whole rigamarole with like,"},{"startTime":272.781,"endTime":275.271,"body":"you know, we've been running,"},{"startTime":272.781,"endTime":275.271,"body":"going strong for several years now."},{"startTime":275.271,"endTime":277.941,"body":"I, for, forgive me for"},{"startTime":275.271,"endTime":277.941,"body":"forgetting, but, okay."},{"startTime":277.941,"endTime":278.421,"body":"So,"},{"startTime":278.837,"endTime":282.767,"body":"I was gonna, I was gonna say,"},{"startTime":278.837,"endTime":282.767,"body":"right, so like the, the situation"},{"startTime":282.767,"endTime":286.227,"body":"with like, like your biggest"},{"startTime":282.767,"endTime":286.227,"body":"dependency is openness, L right."},{"startTime":286.902,"endTime":287.392,"body":"correct."},{"startTime":287.442,"endTime":287.662,"body":"Yes."},{"startTime":288.027,"endTime":288.147,"body":"Yeah."},{"startTime":288.447,"endTime":293.742,"body":"Right, and like in the universe of things"},{"startTime":288.447,"endTime":293.742,"body":"that use OpenSSL, like that's gotten a"},{"startTime":293.742,"endTime":298.462,"body":"lot more complicated over the last 10"},{"startTime":293.742,"endTime":298.462,"body":"years as Chrome has shifted to BoringSSL"},{"startTime":298.482,"endTime":304.722,"body":"and AWS now uses their own kind of"},{"startTime":298.482,"endTime":304.722,"body":"formally verified SSL and open BSD did"},{"startTime":304.722,"endTime":309.522,"body":"LibreSSL, like in the universe of OpenSSL"},{"startTime":304.722,"endTime":309.522,"body":"consumers, where do you guys fit in?"},{"startTime":309.522,"endTime":310.272,"body":"Like, what's your rank?"},{"startTime":311.047,"endTime":314.117,"body":"I, I don't know that there's an"},{"startTime":311.047,"endTime":314.117,"body":"official leaderboard of like, OpenSSL"},{"startTime":314.137,"endTime":317.367,"body":"consumers, but, I, I guess we have"},{"startTime":314.137,"endTime":317.367,"body":"a lot of standing, at the very"},{"startTime":317.367,"endTime":321.117,"body":"least in the Python ecosystem, we're"},{"startTime":317.367,"endTime":321.117,"body":"consistently one of the most downloaded"},{"startTime":321.117,"endTime":323.467,"body":"packages, on the Python package index."},{"startTime":323.647,"endTime":327.277,"body":"Many millions of downloads, like"},{"startTime":323.647,"endTime":327.277,"body":"if you use a Python thing, it's"},{"startTime":327.277,"endTime":329.257,"body":"like quite likely you rely on us."},{"startTime":329.307,"endTime":333.397,"body":"all, all of the major clouds"},{"startTime":329.307,"endTime":333.397,"body":"command line interfaces include us."},{"startTime":333.697,"endTime":334.267,"body":"because then like the,"},{"startTime":334.567,"endTime":337.372,"body":"the cert bot, lets encrypt"},{"startTime":334.567,"endTime":337.372,"body":"client includes us."},{"startTime":337.467,"endTime":337.757,"body":"Yeah."},{"startTime":338.057,"endTime":341.672,"body":"In the same sense as like if you were"},{"startTime":338.057,"endTime":341.672,"body":"already a GO program and you use Net HTTP,"},{"startTime":341.692,"endTime":344.392,"body":"you'd be pulling in go's, TLS libraries."},{"startTime":344.722,"endTime":347.092,"body":"In Python world, if you're doing"},{"startTime":344.722,"endTime":347.092,"body":"the equivalent of if you're doing"},{"startTime":347.092,"endTime":350.362,"body":"requests or whatever, you're"},{"startTime":347.092,"endTime":350.362,"body":"effectively to do TLS pulling you guys"},{"startTime":350.662,"endTime":355.687,"body":"No T So TLS is the one thing that is, I"},{"startTime":350.662,"endTime":355.687,"body":"think in the usual cryptography toolkit"},{"startTime":355.687,"endTime":360.232,"body":"that you probably would not pull in,"},{"startTime":355.687,"endTime":360.232,"body":"cryptography for, we don't have TLS APIs."},{"startTime":360.467,"endTime":365.307,"body":"You're much more likely to either use"},{"startTime":360.467,"endTime":365.307,"body":"the Python, standard library SSL module"},{"startTime":365.427,"endTime":369.612,"body":"or PI OpenSSL, which, which we also"},{"startTime":365.427,"endTime":369.612,"body":"maintain, but is a separate library."},{"startTime":369.912,"endTime":370.452,"body":"Oh wow."},{"startTime":371.152,"endTime":376.252,"body":"And just for the record, why aren't you"},{"startTime":371.152,"endTime":376.252,"body":"just writing your Python cryptographic"},{"startTime":376.252,"endTime":379.162,"body":"library in Python and shipping Python?"},{"startTime":379.862,"endTime":383.162,"body":"That would be a very convenient,"},{"startTime":379.862,"endTime":383.162,"body":"unfortunately, it would have both"},{"startTime":383.162,"endTime":387.282,"body":"security and performance implications"},{"startTime":383.162,"endTime":387.282,"body":"that are, effectively insoluble"},{"startTime":387.282,"endTime":388.327,"body":"inside Python, the language."},{"startTime":389.027,"endTime":393.677,"body":"I, I will also say when we started"},{"startTime":389.027,"endTime":393.677,"body":"cryptography, you know, 12 or 13"},{"startTime":393.677,"endTime":398.107,"body":"years ago, we made, put amounts to"},{"startTime":393.677,"endTime":398.107,"body":"like a very ironic deal, which is"},{"startTime":398.107,"endTime":401.737,"body":"like, I was persuaded that like I"},{"startTime":398.107,"endTime":401.737,"body":"would help coordinate this library as"},{"startTime":401.737,"endTime":405.547,"body":"long as the one thing we were doing"},{"startTime":401.737,"endTime":405.547,"body":"was not implementing cryptography."},{"startTime":405.847,"endTime":408.007,"body":"We wanted to think hard about APIs."},{"startTime":408.157,"endTime":411.307,"body":"We wanted to think hard about"},{"startTime":408.157,"endTime":411.307,"body":"what made a safe default and what"},{"startTime":411.307,"endTime":412.897,"body":"shouldn't have a default at all."},{"startTime":413.017,"endTime":417.487,"body":"We wanted to think hard about testing,"},{"startTime":413.017,"endTime":417.487,"body":"but we were not trying to do something"},{"startTime":417.727,"endTime":422.077,"body":"where we felt like the relevant expertise"},{"startTime":417.727,"endTime":422.077,"body":"was like really outside of, you know,"},{"startTime":422.527,"endTime":425.677,"body":"what a person might have if they"},{"startTime":422.527,"endTime":425.677,"body":"didn't have like a PhD in cryptography."},{"startTime":426.112,"endTime":429.832,"body":"and you're talking like low level"},{"startTime":426.112,"endTime":429.832,"body":"primitives because like we can have a, a,"},{"startTime":429.837,"endTime":434.062,"body":"a wonderful debate about what counts as"},{"startTime":429.837,"endTime":434.062,"body":"implementing cryptography, but I, I know"},{"startTime":434.062,"endTime":434.482,"body":"what you mean."},{"startTime":434.572,"endTime":434.632,"body":"Yeah."},{"startTime":434.827,"endTime":438.487,"body":"yeah, I, I would say about six"},{"startTime":434.827,"endTime":438.487,"body":"months after we, you know, I had"},{"startTime":438.487,"endTime":440.827,"body":"this conversation where we're"},{"startTime":438.487,"endTime":440.827,"body":"not implementing cryptography."},{"startTime":441.157,"endTime":443.737,"body":"One of our maintainers at the time,"},{"startTime":441.157,"endTime":443.737,"body":"I guess this would've been right"},{"startTime":443.737,"endTime":446.737,"body":"after HeartBleed, came up to me"},{"startTime":443.737,"endTime":446.737,"body":"and said, we should implement TLS."},{"startTime":446.737,"endTime":448.777,"body":"And I said, what happened to our deal?"},{"startTime":448.867,"endTime":451.447,"body":"And he said, TLS is a network protocol."},{"startTime":451.447,"endTime":452.827,"body":"It's not cryptography."},{"startTime":453.127,"endTime":453.312,"body":"Uhhuh."},{"startTime":453.577,"endTime":453.937,"body":"Uh,"},{"startTime":454.237,"endTime":456.937,"body":"and I think that's one of the, and I"},{"startTime":454.237,"endTime":456.937,"body":"think it's like a very true statement"},{"startTime":456.937,"endTime":458.647,"body":"that like really rides the line."},{"startTime":458.807,"endTime":459.097,"body":"Yeah."},{"startTime":459.642,"endTime":463.332,"body":"Yeah, and we've enclo we've definitely"},{"startTime":459.642,"endTime":463.332,"body":"increasingly blurred it over time."},{"startTime":463.332,"endTime":466.272,"body":"I mean, I think one of the first"},{"startTime":463.332,"endTime":466.272,"body":"times we kind of said, oh, this"},{"startTime":466.272,"endTime":469.182,"body":"isn't really cryptography, was"},{"startTime":466.272,"endTime":469.182,"body":"when we did like a AES key wrap"},{"startTime":469.182,"endTime":470.792,"body":"support, back in the day when like"},{"startTime":470.792,"endTime":471.482,"body":"OpenSSLs"},{"startTime":471.542,"endTime":473.252,"body":"implementations of it weren't very good."},{"startTime":473.602,"endTime":478.502,"body":"and like we still strive not to do it"},{"startTime":473.602,"endTime":478.502,"body":"unless we have to, but there are scenarios"},{"startTime":478.502,"endTime":481.922,"body":"where we choose to hoist it into ourselves"},{"startTime":478.502,"endTime":481.922,"body":"because we believe we can do it better."},{"startTime":482.232,"endTime":484.482,"body":"I think the most recent example"},{"startTime":482.232,"endTime":484.482,"body":"of that is actually something"},{"startTime":484.482,"endTime":487.392,"body":"that we haven't released yet,"},{"startTime":484.482,"endTime":487.392,"body":"which is the, uh, HPKE support."},{"startTime":487.672,"endTime":491.182,"body":"OpenSSL does support HPKE, but"},{"startTime":487.672,"endTime":491.182,"body":"we have chosen to implement it"},{"startTime":491.182,"endTime":493.072,"body":"ourselves using OpenSSL as primitive."},{"startTime":493.772,"endTime":496.022,"body":"And why did you choose to do that?"},{"startTime":496.722,"endTime":499.332,"body":"So I think there were a, a couple"},{"startTime":496.722,"endTime":499.332,"body":"motivations to come into it."},{"startTime":499.332,"endTime":502.632,"body":"One, it means we're, you're gonna"},{"startTime":499.332,"endTime":502.632,"body":"get a really consistent HPKE"},{"startTime":502.632,"endTime":505.812,"body":"implementation no matter where"},{"startTime":502.632,"endTime":505.812,"body":"you get your cryptography from."},{"startTime":505.812,"endTime":511.112,"body":"So like the OpenSSL HPKE implementation"},{"startTime":505.812,"endTime":511.112,"body":"is not supported on LibresSL BoringSSL,"},{"startTime":511.112,"endTime":515.552,"body":"aws-lc, which I, I guess we'll probably"},{"startTime":511.112,"endTime":515.552,"body":"mention a lot in this, conversation."},{"startTime":515.552,"endTime":516.722,"body":"So I'll just call the forks."},{"startTime":516.752,"endTime":519.492,"body":"So like, implementing it ourselves"},{"startTime":516.752,"endTime":519.492,"body":"means you'll get a consistent"},{"startTime":519.492,"endTime":522.462,"body":"experience 'cause they'll all"},{"startTime":519.492,"endTime":522.462,"body":"have the underlying cryptography."},{"startTime":522.982,"endTime":527.752,"body":"it means we have a lot more control"},{"startTime":522.982,"endTime":527.752,"body":"over kind of the compatibility surface."},{"startTime":527.842,"endTime":531.502,"body":"We're not accidentally pulling in"},{"startTime":527.842,"endTime":531.502,"body":"lax parsing behavior or other kind of"},{"startTime":531.682,"endTime":535.042,"body":"unintended behavior from OpenSSL and."},{"startTime":535.432,"endTime":538.942,"body":"It gives us the kind of high level"},{"startTime":535.432,"endTime":538.942,"body":"of confidence that we're, we're"},{"startTime":538.942,"endTime":542.542,"body":"handling all the edge cases from"},{"startTime":538.942,"endTime":542.542,"body":"both the security and correctness and"},{"startTime":542.542,"endTime":544.552,"body":"just like not crashing perspective."},{"startTime":544.612,"endTime":546.337,"body":"Paul, I don't know if there"},{"startTime":544.612,"endTime":546.337,"body":"were more motivation for you."},{"startTime":547.037,"endTime":550.067,"body":"Well, I would say that the, the, the one"},{"startTime":547.037,"endTime":550.067,"body":"that's kind of the elephant in the room,"},{"startTime":550.097,"endTime":554.257,"body":"that's the, the core component of, part"},{"startTime":550.097,"endTime":554.257,"body":"of our criticism that ac occurred in our"},{"startTime":554.257,"endTime":559.517,"body":"statement is that the HPKE APIs are only"},{"startTime":554.257,"endTime":559.517,"body":"accessible through the OSSL_PARAM api."},{"startTime":560.217,"endTime":561.147,"body":"So, okay."},{"startTime":561.417,"endTime":562.917,"body":"I wanna stop you guys there, right?"},{"startTime":562.947,"endTime":567.897,"body":"So I, I, so we're kind of beating around"},{"startTime":562.947,"endTime":567.897,"body":"the bush and like, I think trying to"},{"startTime":567.897,"endTime":571.197,"body":"like let you guys introduce the, the,"},{"startTime":567.897,"endTime":571.197,"body":"the talk that you guys did yourself,"},{"startTime":571.197,"endTime":572.337,"body":"but I kind of don't wanna do that."},{"startTime":572.337,"endTime":574.197,"body":"Let's just like cat outta the bag."},{"startTime":574.377,"endTime":579.317,"body":"You guys gave, you're, you're not super"},{"startTime":574.377,"endTime":579.317,"body":"happy with the current state of OpenSSL"},{"startTime":579.507,"endTime":582.747,"body":"but it's like, not for the normal reason"},{"startTime":579.507,"endTime":582.747,"body":"that people usually bring up, like, you"},{"startTime":582.747,"endTime":586.167,"body":"know, that's why there's Libra SL 'cause"},{"startTime":582.747,"endTime":586.167,"body":"we don't tRust the code or whatever."},{"startTime":586.167,"endTime":589.497,"body":"Although we can get into that"},{"startTime":586.167,"endTime":589.497,"body":"later too, but for other reasons."},{"startTime":589.677,"endTime":590.067,"body":"Right."},{"startTime":590.307,"endTime":594.987,"body":"So, and your, your reasoning"},{"startTime":590.307,"endTime":594.987,"body":"is mostly about, or is entirely"},{"startTime":594.987,"endTime":597.287,"body":"about the design of OpenSSL 3."},{"startTime":597.762,"endTime":599.232,"body":"The, that version of the library."},{"startTime":599.772,"endTime":603.742,"body":"So I have not paid close enough"},{"startTime":599.772,"endTime":603.742,"body":"attention to OpenSSL to know"},{"startTime":603.742,"endTime":605.772,"body":"what the fuck OpenSSL 3 is."},{"startTime":606.042,"endTime":607.782,"body":"What's roughly like the timeline here?"},{"startTime":607.782,"endTime":608.562,"body":"What happened?"},{"startTime":608.862,"endTime":612.662,"body":"Like I knew OpenSSL back on the Heartbleed"},{"startTime":608.862,"endTime":612.662,"body":"days, and now there's multiple OpenSSLs."},{"startTime":613.122,"endTime":618.822,"body":"So, you know, Heartbleed happened in"},{"startTime":613.122,"endTime":618.822,"body":"2013, and at that time it became like"},{"startTime":619.032,"endTime":622.992,"body":"a very well known fact that OpenSSL"},{"startTime":619.032,"endTime":622.992,"body":"was kind of a project on life support"},{"startTime":622.992,"endTime":626.532,"body":"that didn't have the right resourcing"},{"startTime":622.992,"endTime":626.532,"body":"and had various problems because of it."},{"startTime":627.012,"endTime":631.032,"body":"Uh, in the wake of that OpenSSL got a"},{"startTime":627.012,"endTime":631.032,"body":"surge of investment, both monetarily"},{"startTime":631.032,"endTime":633.072,"body":"and also in, in, uh, human time."},{"startTime":633.342,"endTime":636.372,"body":"Like there were a bunch of folks from"},{"startTime":633.342,"endTime":636.372,"body":"Google, like Emelia Kaspar and others who"},{"startTime":636.372,"endTime":638.052,"body":"went over there and did a bunch of work."},{"startTime":638.292,"endTime":640.992,"body":"Um, there were folks who, who"},{"startTime":638.292,"endTime":640.992,"body":"later founded some of the forks"},{"startTime":640.992,"endTime":644.382,"body":"that were involved heavily, and"},{"startTime":640.992,"endTime":644.382,"body":"then there was just like a large"},{"startTime":644.382,"endTime":647.472,"body":"organization formed that had a bunch"},{"startTime":644.382,"endTime":647.472,"body":"of full-time employees to do things."},{"startTime":648.042,"endTime":651.392,"body":"As a component of that, the business"},{"startTime":648.042,"endTime":651.392,"body":"realized that, part of the way in"},{"startTime":651.392,"endTime":656.072,"body":"which you sustain in the cryptographic"},{"startTime":651.392,"endTime":656.072,"body":"library is by catering to business"},{"startTime":656.072,"endTime":657.782,"body":"interests around things like FIPS."},{"startTime":658.472,"endTime":662.492,"body":"The structure of FIPS is such that"},{"startTime":658.472,"endTime":662.492,"body":"you want to isolate it off and that."},{"startTime":662.927,"endTime":666.857,"body":"Created a concept that they were, uh,"},{"startTime":662.927,"endTime":666.857,"body":"that was supposed to replace engines."},{"startTime":667.067,"endTime":669.197,"body":"Uh, engines are a method of"},{"startTime":667.067,"endTime":669.197,"body":"plugging things into OpenSSL."},{"startTime":669.887,"endTime":671.447,"body":"Providers became the new thing."},{"startTime":671.747,"endTime":674.627,"body":"Providers are intended to be a"},{"startTime":671.747,"endTime":674.627,"body":"superset that can do all that stuff."},{"startTime":674.687,"endTime":677.087,"body":"And in the abstract it's a fine concept."},{"startTime":677.477,"endTime":681.707,"body":"However, in practice, as they went down"},{"startTime":677.477,"endTime":681.707,"body":"the path of this OpenSSL 3, which was an"},{"startTime":681.707,"endTime":686.027,"body":"intent, a deliberate, um, ABI breakage,"},{"startTime":681.707,"endTime":686.027,"body":"they skipped 2 because they were worried"},{"startTime":686.027,"endTime":689.117,"body":"about version numbering based on the"},{"startTime":686.027,"endTime":689.117,"body":"fact that Libre had forked themselves"},{"startTime":689.117,"endTime":690.647,"body":"and they called themselves 2 at the time."},{"startTime":691.137,"endTime":695.607,"body":"they went to three and the consequence,"},{"startTime":691.137,"endTime":695.607,"body":"like the actions of three were"},{"startTime":695.607,"endTime":699.987,"body":"basically rewrite the entire internals"},{"startTime":695.607,"endTime":699.987,"body":"were without understanding the"},{"startTime":699.987,"endTime":701.727,"body":"surface area of your own project."},{"startTime":702.117,"endTime":707.697,"body":"Uh, this led to an 18 month alpha beta"},{"startTime":702.117,"endTime":707.697,"body":"phase before release, and ultimately"},{"startTime":707.697,"endTime":711.357,"body":"well over two years of delays from when"},{"startTime":707.697,"endTime":711.357,"body":"they expected to be able to release it."},{"startTime":711.747,"endTime":712.077,"body":"Uh,"},{"startTime":712.377,"endTime":715.767,"body":"did that, when did that land,"},{"startTime":712.377,"endTime":715.767,"body":"like when did OpenSSL 3 become?"},{"startTime":716.467,"endTime":719.977,"body":"I assume that right now OpenSSL 3 is like"},{"startTime":716.467,"endTime":719.977,"body":"the mainstream version everyone's using."},{"startTime":720.677,"endTime":724.667,"body":"Yeah, if you get your OpenSSL from like a"},{"startTime":720.677,"endTime":724.667,"body":"Ubuntu or Debian, a Red Hat, you're gonna"},{"startTime":724.667,"endTime":729.777,"body":"get an OpenSSL 3 from like a recent Linux"},{"startTime":724.667,"endTime":729.777,"body":"distribution and then that landed in 2021."},{"startTime":730.777,"endTime":731.977,"body":"Okay, that makes sense to me."},{"startTime":731.977,"endTime":736.247,"body":"So now I know what you're about to"},{"startTime":731.977,"endTime":736.247,"body":"say, but let's bring our audience up"},{"startTime":736.247,"endTime":742.007,"body":"to speed on the suite of concerns that"},{"startTime":736.247,"endTime":742.007,"body":"you guys have about the situation."},{"startTime":742.707,"endTime":742.917,"body":"Yeah."},{"startTime":742.977,"endTime":746.267,"body":"So we've got a couple, and I'm"},{"startTime":742.977,"endTime":746.267,"body":"gonna say them in the order"},{"startTime":746.267,"endTime":747.332,"body":"that we wrote the post in."},{"startTime":748.032,"endTime":750.792,"body":"as we'll get into, I think we put"},{"startTime":748.032,"endTime":750.792,"body":"them in the wrong order in the post."},{"startTime":751.012,"endTime":755.152,"body":"so the, the first concern, it's, it's"},{"startTime":751.012,"endTime":755.152,"body":"the most easy to quantify is performance."},{"startTime":755.482,"endTime":760.882,"body":"Uh, OpenSSL 3 had some really, really"},{"startTime":755.482,"endTime":760.882,"body":"significant performance regressions."},{"startTime":761.062,"endTime":765.062,"body":"Things like loading, elliptic"},{"startTime":761.062,"endTime":765.062,"body":"curve, public key from like a"},{"startTime":765.392,"endTime":767.102,"body":"subject public key info format."},{"startTime":767.132,"endTime":769.382,"body":"Really simple format to parse."},{"startTime":769.472,"endTime":775.962,"body":"Got something like, eight times slower"},{"startTime":769.472,"endTime":775.962,"body":"between OpenSSL 1, 1 1 and OpenSSL 3"},{"startTime":776.287,"endTime":777.867,"body":"Was it doing the, on"},{"startTime":777.867,"endTime":778.617,"body":"curve math?"},{"startTime":778.617,"endTime":779.337,"body":"Was it checking that"},{"startTime":779.412,"endTime":780.552,"body":"No, no."},{"startTime":780.552,"endTime":780.792,"body":"It"},{"startTime":780.792,"endTime":782.017,"body":"like, yeah."},{"startTime":782.097,"endTime":782.202,"body":"Yeah."},{"startTime":782.202,"endTime":785.772,"body":"It's like anything you can come up with"},{"startTime":782.202,"endTime":785.772,"body":"it that's like the cryptography, the"},{"startTime":785.772,"endTime":788.322,"body":"math that might make this time is not it."},{"startTime":788.442,"endTime":793.512,"body":"It was that the abstraction for how"},{"startTime":788.442,"endTime":793.512,"body":"providers worked and like the interplay"},{"startTime":793.512,"endTime":798.432,"body":"between it and the DER parser and just"},{"startTime":793.512,"endTime":798.432,"body":"like what the public, a pi, like, all"},{"startTime":798.432,"endTime":804.462,"body":"that back and forth had so many indirect"},{"startTime":798.432,"endTime":804.462,"body":"calls, so much allocation, so much"},{"startTime":804.462,"endTime":810.262,"body":"locking, OpenSSL had a whole like format,"},{"startTime":804.462,"endTime":810.262,"body":"auto detection thing that happened."},{"startTime":810.262,"endTime":814.202,"body":"It was like, you know, you can find"},{"startTime":810.262,"endTime":814.202,"body":"the issues in the OpenSSL bug tracker"},{"startTime":814.322,"endTime":816.872,"body":"where folks are like breaking down,"},{"startTime":814.322,"endTime":816.872,"body":"like, where is the time going?"},{"startTime":816.872,"endTime":820.532,"body":"And it's, it's truly just that the,"},{"startTime":816.872,"endTime":820.532,"body":"the parsing itself had become so"},{"startTime":820.532,"endTime":823.372,"body":"convoluted, that, that it was just."},{"startTime":823.702,"endTime":826.342,"body":"You know, it time was"},{"startTime":823.702,"endTime":826.342,"body":"spent in nonsense places."},{"startTime":826.522,"endTime":831.022,"body":"we'll say since then, OpenSSL has made"},{"startTime":826.522,"endTime":831.022,"body":"some improvements and now it is only"},{"startTime":831.172,"endTime":834.382,"body":"three times slower than it used to"},{"startTime":831.172,"endTime":834.382,"body":"be as of, the last time I measured."},{"startTime":834.592,"endTime":836.242,"body":"So, like, that's, that's"},{"startTime":834.592,"endTime":836.242,"body":"quite significant."},{"startTime":836.242,"endTime":840.532,"body":"Like, I, I wanna just give people like a"},{"startTime":836.242,"endTime":840.532,"body":"data point for like how extreme this was."},{"startTime":840.772,"endTime":845.332,"body":"We, we have, our own X.509, like path"},{"startTime":840.772,"endTime":845.332,"body":"validation code, what people would"},{"startTime":845.332,"endTime":850.122,"body":"call like X.509 verification, and,"},{"startTime":845.332,"endTime":850.122,"body":"doing our own public key parsing"},{"startTime":850.122,"endTime":854.202,"body":"that is moving the public key parsing"},{"startTime":850.122,"endTime":854.202,"body":"from OpenSSL to our own Rust code,"},{"startTime":854.382,"endTime":859.792,"body":"no other changes was a 60% performance"},{"startTime":854.382,"endTime":859.792,"body":"improvement on end-to-end X.509"},{"startTime":859.812,"endTime":863.772,"body":"validation, like that, that's just"},{"startTime":859.812,"endTime":863.772,"body":"like how extreme this overhead was to"},{"startTime":863.772,"endTime":865.782,"body":"like, what is empirically possible."},{"startTime":865.872,"endTime":868.842,"body":"So this was kind of the first"},{"startTime":865.872,"endTime":868.842,"body":"and most easily quantifiable,"},{"startTime":868.842,"endTime":870.332,"body":"the performance, was insane."},{"startTime":870.332,"endTime":870.872,"body":"And I, I think."},{"startTime":871.572,"endTime":872.592,"body":"Well, maybe we get into this more."},{"startTime":872.592,"endTime":875.652,"body":"A lot of people think, think that this"},{"startTime":872.592,"endTime":875.652,"body":"is like maybe our biggest complaint"},{"startTime":875.682,"endTime":877.662,"body":"'cause it's the easiest to quantify."},{"startTime":877.962,"endTime":880.632,"body":"But, but it, it's not, it's,"},{"startTime":877.962,"endTime":880.632,"body":"we shouldn't have put it first."},{"startTime":880.662,"endTime":884.382,"body":"'cause our real complaint is,"},{"startTime":880.662,"endTime":884.382,"body":"is the complexity that led to"},{"startTime":884.382,"endTime":885.702,"body":"the performance regressions."},{"startTime":885.702,"endTime":891.312,"body":"The fact that the provider APIs"},{"startTime":885.702,"endTime":891.312,"body":"were designed or evolved in such"},{"startTime":891.312,"endTime":893.952,"body":"a way that like the abstraction"},{"startTime":891.312,"endTime":893.952,"body":"boundaries were unclear."},{"startTime":894.282,"endTime":895.372,"body":"And, you, you had."},{"startTime":896.072,"endTime":900.812,"body":"Really extreme performance regressions"},{"startTime":896.072,"endTime":900.812,"body":"that came down to things like, if you"},{"startTime":900.812,"endTime":906.052,"body":"load a hash algorithm, through like"},{"startTime":900.812,"endTime":906.052,"body":"a function like EVP SHA-256, which"},{"startTime":906.052,"endTime":911.732,"body":"is like get the SHA-256 like hash, I,"},{"startTime":906.052,"endTime":911.732,"body":"object identifier like that is slower."},{"startTime":911.852,"endTime":915.862,"body":"'cause what that API is doing is getting"},{"startTime":911.852,"endTime":915.862,"body":"like an object that represents like"},{"startTime":915.892,"endTime":921.082,"body":"a future promise that I will call the"},{"startTime":915.892,"endTime":921.082,"body":"provider API later to like actually find"},{"startTime":921.082,"endTime":924.122,"body":"the SHA-256 API, from your provider."},{"startTime":924.122,"endTime":926.282,"body":"And like, that can change"},{"startTime":924.122,"endTime":926.282,"body":"at any time in theory."},{"startTime":926.462,"endTime":928.982,"body":"'cause like the provider APIs don't"},{"startTime":926.462,"endTime":928.982,"body":"like say like, you know, once your"},{"startTime":928.982,"endTime":932.462,"body":"program's initialized, like you can't"},{"startTime":928.982,"endTime":932.462,"body":"change where the cryptography comes from."},{"startTime":932.702,"endTime":936.512,"body":"So there's just like tons of back and"},{"startTime":932.702,"endTime":936.512,"body":"forth, lots of indirect calls, lots of"},{"startTime":936.512,"endTime":940.532,"body":"allocations, lots of locking, lots of"},{"startTime":936.512,"endTime":940.532,"body":"caches to try to compensate for that."},{"startTime":940.532,"endTime":944.252,"body":"Like the degree of complexity"},{"startTime":940.532,"endTime":944.252,"body":"in the internals got like really"},{"startTime":944.252,"endTime":947.162,"body":"extreme, but it also got pretty"},{"startTime":944.252,"endTime":947.162,"body":"extreme in the public APIs."},{"startTime":947.512,"endTime":950.542,"body":"Yeah, I mean, I, I won't add a lot here"},{"startTime":947.512,"endTime":950.542,"body":"other than to say like the, the ultimate,"},{"startTime":950.692,"endTime":954.712,"body":"uh, outcome of these like attempted"},{"startTime":950.692,"endTime":954.712,"body":"fixes for performance progressions based"},{"startTime":954.712,"endTime":960.142,"body":"on this, is that like we, we have like"},{"startTime":954.712,"endTime":960.142,"body":"full on RCU code, which has had bugs in"},{"startTime":960.142,"endTime":964.072,"body":"OpenSSL since they landed it to just to"},{"startTime":960.142,"endTime":964.072,"body":"try and resolve some of these issues."},{"startTime":964.352,"endTime":969.032,"body":"and like the nature of the DER parsers are"},{"startTime":964.352,"endTime":969.032,"body":"actually that it chains things together."},{"startTime":969.152,"endTime":972.542,"body":"Like it'll, it'll progressively try"},{"startTime":969.152,"endTime":972.542,"body":"different things, uh, which led to"},{"startTime":972.542,"endTime":975.812,"body":"a bunch of bugs DERing the OpenSSL 3"},{"startTime":972.542,"endTime":975.812,"body":"betas where they were leaving errors"},{"startTime":975.812,"endTime":979.052,"body":"on the error stack because they, they"},{"startTime":975.812,"endTime":979.052,"body":"didn't know they were doing these"},{"startTime":979.052,"endTime":980.562,"body":"chain, chain attempts to parse things."},{"startTime":981.187,"endTime":981.697,"body":"What they"},{"startTime":981.697,"endTime":982.867,"body":"were doing different."},{"startTime":983.317,"endTime":985.597,"body":"I like different implementations"},{"startTime":983.317,"endTime":985.597,"body":"of dear person and they would"},{"startTime":985.597,"endTime":988.032,"body":"like try one, and then if it"},{"startTime":985.597,"endTime":988.032,"body":"didn't throw, we would try another"},{"startTime":988.057,"endTime":988.572,"body":"So,"},{"startTime":988.807,"endTime":992.707,"body":"so OpenSSL has like these auto key"},{"startTime":988.807,"endTime":992.707,"body":"loader APIs where it's like, give"},{"startTime":992.707,"endTime":995.287,"body":"us some DER and we'll figure it out"},{"startTime":992.707,"endTime":995.287,"body":"and give you back what you want."},{"startTime":995.507,"endTime":999.017,"body":"but that like necessarily means that it's"},{"startTime":995.507,"endTime":999.017,"body":"going to try a bunch of things rather"},{"startTime":999.017,"endTime":1002.797,"body":"than simply reading the, the, the o out"},{"startTime":999.017,"endTime":1002.797,"body":"of it and then dispatching correctly."},{"startTime":1003.067,"endTime":1004.927,"body":"so you get a bunch of"},{"startTime":1003.067,"endTime":1004.927,"body":"performance issues from that"},{"startTime":1005.627,"endTime":1007.607,"body":"was that, I have two questions, right?"},{"startTime":1007.607,"endTime":1010.367,"body":"So first of all was the,"},{"startTime":1007.607,"endTime":1010.367,"body":"kind of the YOLO mode."},{"startTime":1010.367,"endTime":1012.977,"body":"Just try all the different"},{"startTime":1010.367,"endTime":1012.977,"body":"formats, key parsing thing."},{"startTime":1012.977,"endTime":1015.732,"body":"Was that an OpenSSL one thing or"},{"startTime":1012.977,"endTime":1015.732,"body":"did they come up with that in, in"},{"startTime":1015.802,"endTime":1016.732,"body":"OpenSSL 3."},{"startTime":1016.792,"endTime":1020.627,"body":"one did have the same pri uh,"},{"startTime":1016.792,"endTime":1020.627,"body":"behavior on some limited APIs,"},{"startTime":1020.627,"endTime":1024.377,"body":"like it's like D two i auto private"},{"startTime":1020.627,"endTime":1024.377,"body":"key or something of that nature."},{"startTime":1024.617,"endTime":1027.197,"body":"Uh, so that, that behavior was"},{"startTime":1024.617,"endTime":1027.197,"body":"there, but it was a much faster one"},{"startTime":1027.197,"endTime":1030.767,"body":"in that it dispatched based on the"},{"startTime":1027.197,"endTime":1030.767,"body":"OID at the time, as opposed to this"},{"startTime":1030.767,"endTime":1032.357,"body":"one, which needs the providers."},{"startTime":1032.627,"endTime":1035.597,"body":"And like every provider doesn't,"},{"startTime":1032.627,"endTime":1035.597,"body":"there's not like a mechanism for"},{"startTime":1035.597,"endTime":1037.427,"body":"providers to necessarily, um."},{"startTime":1038.057,"endTime":1040.037,"body":"Like necessarily declare"},{"startTime":1038.057,"endTime":1040.037,"body":"exactly what they support."},{"startTime":1040.037,"endTime":1042.197,"body":"So you have to just incrementally"},{"startTime":1040.037,"endTime":1042.197,"body":"try them until one works."},{"startTime":1042.897,"endTime":1045.867,"body":"I'm, I'm a little familiar"},{"startTime":1042.897,"endTime":1045.867,"body":"with the OpenSSL code or the"},{"startTime":1046.347,"endTime":1048.057,"body":"OpenSSL code of Old, right."},{"startTime":1048.297,"endTime":1052.077,"body":"I don't remember Concurrency being"},{"startTime":1048.297,"endTime":1052.077,"body":"a huge thing in that code base."},{"startTime":1052.557,"endTime":1055.237,"body":"So you, you said that there's like"},{"startTime":1052.557,"endTime":1055.237,"body":"a full line implementation of RCUs"},{"startTime":1055.257,"endTime":1059.787,"body":"now in  s like what is the, you guys"},{"startTime":1055.257,"endTime":1059.787,"body":"would know way better than we would."},{"startTime":1059.997,"endTime":1061.557,"body":"What is the concurrency situation?"},{"startTime":1061.557,"endTime":1063.237,"body":"This, if this is a, a crypto library."},{"startTime":1063.937,"endTime":1067.957,"body":"Yeah, it's a crypto library, but"},{"startTime":1063.937,"endTime":1067.957,"body":"like you have like various APIs for"},{"startTime":1067.957,"endTime":1071.757,"body":"manipulating like global states,"},{"startTime":1067.957,"endTime":1071.757,"body":"like, adding a new provider to like"},{"startTime":1071.757,"endTime":1073.557,"body":"the global context for example."},{"startTime":1073.857,"endTime":1078.267,"body":"And so like if you haven't done anything"},{"startTime":1073.857,"endTime":1078.267,"body":"to preclude like that happening at"},{"startTime":1078.267,"endTime":1080.187,"body":"arbitrary points in the runtime,"},{"startTime":1080.622,"endTime":1082.512,"body":"wait, wait, wait, wait, wait, wait, wait."},{"startTime":1082.692,"endTime":1086.967,"body":"Why am I, why am I adding new providers"},{"startTime":1082.692,"endTime":1086.967,"body":"to the runtime State of a running program,"},{"startTime":1087.297,"endTime":1088.647,"body":"I mean, that's roughly the question."},{"startTime":1088.647,"endTime":1091.017,"body":"Like Paul and I would ask, like"},{"startTime":1088.647,"endTime":1091.017,"body":"we think that's just like a design"},{"startTime":1091.017,"endTime":1092.787,"body":"mistake that you can support that."},{"startTime":1092.787,"endTime":1097.977,"body":"But like if you've chosen to support that"},{"startTime":1092.787,"endTime":1097.977,"body":"and are now like going back to like, you"},{"startTime":1097.977,"endTime":1101.397,"body":"know, you don't, you're not quite sure"},{"startTime":1097.977,"endTime":1101.397,"body":"like what your API contract with users is."},{"startTime":1101.397,"endTime":1105.217,"body":"Like, and not now you have to like"},{"startTime":1101.397,"endTime":1105.217,"body":"deal with like concurrency bugs."},{"startTime":1105.217,"endTime":1109.297,"body":"People are reporting like tsan"},{"startTime":1105.217,"endTime":1109.297,"body":"issues or like performance issues."},{"startTime":1109.297,"endTime":1112.387,"body":"Like not, not like, yeah, like,"},{"startTime":1112.582,"endTime":1113.842,"body":"hold on, hold on, hold on."},{"startTime":1114.022,"endTime":1119.662,"body":"Rcu are what you use when you're locking"},{"startTime":1114.022,"endTime":1119.662,"body":"so much and so many hot paths that you"},{"startTime":1119.662,"endTime":1123.082,"body":"can't actually do mutexes, that you"},{"startTime":1119.662,"endTime":1123.082,"body":"actually need an optimized concurrency"},{"startTime":1123.082,"endTime":1126.982,"body":"primitive because you're, I, I get"},{"startTime":1123.082,"endTime":1126.982,"body":"like, you need to lock because you"},{"startTime":1126.982,"endTime":1130.882,"body":"can add a provider, can you like add"},{"startTime":1126.982,"endTime":1130.882,"body":"and remove providers in a hot path?"},{"startTime":1131.582,"endTime":1133.272,"body":"Nothing precludes you from doing that."},{"startTime":1133.972,"endTime":1134.262,"body":"Yeah."},{"startTime":1134.267,"endTime":1134.557,"body":"Yeah."},{"startTime":1134.767,"endTime":1137.347,"body":"There, there's no, there was,"},{"startTime":1134.767,"endTime":1137.347,"body":"there was not necessarily like,"},{"startTime":1137.377,"endTime":1138.547,"body":"I, I wanna be charitable here."},{"startTime":1138.547,"endTime":1143.137,"body":"So like, maybe the, the answer may not"},{"startTime":1138.547,"endTime":1143.137,"body":"be that they didn't have a design ethos"},{"startTime":1143.137,"endTime":1146.557,"body":"around it, but like, for whatever reason,"},{"startTime":1143.137,"endTime":1146.557,"body":"as they went down the path of implementing"},{"startTime":1146.557,"endTime":1151.327,"body":"this, the answer of support, everything"},{"startTime":1146.557,"endTime":1151.327,"body":"at all times became the correct answer."},{"startTime":1151.597,"endTime":1154.537,"body":"And like that led inexorably"},{"startTime":1151.597,"endTime":1154.537,"body":"to these types of choices."},{"startTime":1154.897,"endTime":1158.047,"body":"Because, because engines in OpenSSL"},{"startTime":1154.897,"endTime":1158.047,"body":"that was there for like people"},{"startTime":1158.047,"endTime":1159.277,"body":"doing like crypto card stuff."},{"startTime":1159.277,"endTime":1159.697,"body":"Right."},{"startTime":1160.267,"endTime":1163.357,"body":"And at the time it was for like"},{"startTime":1160.267,"endTime":1163.357,"body":"people with co-processor accelerators."},{"startTime":1163.357,"endTime":1163.777,"body":"Right?"},{"startTime":1163.807,"endTime":1168.337,"body":"So the idea here is like you're supporting"},{"startTime":1163.807,"endTime":1168.337,"body":"a use case where somebody has like, you"},{"startTime":1168.337,"endTime":1170.287,"body":"know, a card or something like that."},{"startTime":1170.317,"endTime":1173.617,"body":"They're inserting and removing"},{"startTime":1170.317,"endTime":1173.617,"body":"like several times per millisecond"},{"startTime":1174.247,"endTime":1175.322,"body":"is why you would need rcu."},{"startTime":1175.622,"endTime":1179.362,"body":"I, I think the, I mean the RCU"},{"startTime":1175.622,"endTime":1179.362,"body":"component is just the, the component."},{"startTime":1179.422,"endTime":1182.242,"body":"What comes out of the fact that"},{"startTime":1179.422,"endTime":1182.242,"body":"they have to do locking in so many"},{"startTime":1182.242,"endTime":1187.082,"body":"places just to check the, the actual"},{"startTime":1182.242,"endTime":1187.082,"body":"reality is like they, as best I can"},{"startTime":1187.082,"endTime":1190.322,"body":"understand it, again, steel manning"},{"startTime":1187.082,"endTime":1190.322,"body":"the concepts of the provider, there"},{"startTime":1190.322,"endTime":1196.052,"body":"is a design goal in OpenSSL that  it"},{"startTime":1190.322,"endTime":1196.052,"body":"is an abstracted substrate upon which"},{"startTime":1196.052,"endTime":1199.082,"body":"anyone can do anything, including"},{"startTime":1196.052,"endTime":1199.082,"body":"adding features that were never"},{"startTime":1199.082,"endTime":1201.092,"body":"considered by the OpenSSL people."},{"startTime":1201.692,"endTime":1204.362,"body":"Like basically linked into"},{"startTime":1201.692,"endTime":1204.362,"body":"any arbitrary program, right?"},{"startTime":1204.362,"endTime":1208.262,"body":"So like, oh, in the future, 10"},{"startTime":1204.362,"endTime":1208.262,"body":"years from now, I can load arbitrary"},{"startTime":1208.262,"endTime":1212.042,"body":"providers into some old piece"},{"startTime":1208.262,"endTime":1212.042,"body":"of, uh, kit and get new stuff."},{"startTime":1212.582,"endTime":1216.812,"body":"Yeah, and like you do see examples"},{"startTime":1212.582,"endTime":1216.812,"body":"this like before OpenSSL had post"},{"startTime":1216.812,"endTime":1218.522,"body":"quantum crypto algorithms in it."},{"startTime":1218.792,"endTime":1222.542,"body":"There were third party providers"},{"startTime":1218.792,"endTime":1222.542,"body":"that would provide them."},{"startTime":1222.752,"endTime":1226.892,"body":"And so like you could get an ML KEM inside"},{"startTime":1222.752,"endTime":1226.892,"body":"OpenSSL before OpenSSL supported it."},{"startTime":1227.592,"endTime":1229.872,"body":"Like I, I think we would say"},{"startTime":1227.592,"endTime":1229.872,"body":"like, this is just like not the"},{"startTime":1229.872,"endTime":1233.692,"body":"correct allocation of resources"},{"startTime":1229.872,"endTime":1233.692,"body":"to like towards your problems, but"},{"startTime":1234.452,"endTime":1236.312,"body":"it, it makes me so nervous."},{"startTime":1236.312,"endTime":1239.372,"body":"Like I, you know, I don't have, I"},{"startTime":1236.312,"endTime":1239.372,"body":"don't maintain a project like this."},{"startTime":1239.372,"endTime":1243.222,"body":"Like I've maintained large Rust"},{"startTime":1239.372,"endTime":1243.222,"body":"projects, but like, no, like,"},{"startTime":1243.672,"endTime":1243.692,"body":"is like,"},{"startTime":1244.392,"endTime":1244.692,"body":"lib."},{"startTime":1244.692,"endTime":1246.552,"body":"SDL works kind of like this."},{"startTime":1247.182,"endTime":1250.992,"body":"It's designed to both be statically,"},{"startTime":1247.182,"endTime":1250.992,"body":"which it's a, it's a like cross platform"},{"startTime":1250.992,"endTime":1253.842,"body":"graphics library that's designed to"},{"startTime":1250.992,"endTime":1253.842,"body":"be statically linked, but also like,"},{"startTime":1253.842,"endTime":1256.362,"body":"sometimes it gets swapped out and"},{"startTime":1253.842,"endTime":1256.362,"body":"replaced with a different one because,"},{"startTime":1256.362,"endTime":1259.452,"body":"you know, maybe valve like made it"},{"startTime":1256.362,"endTime":1259.452,"body":"run on Linux, but wants it to look"},{"startTime":1259.452,"endTime":1263.382,"body":"like it's windows to trick some game"},{"startTime":1259.452,"endTime":1263.382,"body":"from 10 years ago to run on Linux."},{"startTime":1263.712,"endTime":1265.572,"body":"And you can kind of see"},{"startTime":1263.712,"endTime":1265.572,"body":"how you end up there."},{"startTime":1265.752,"endTime":1271.042,"body":"I don't quite understand what the,"},{"startTime":1265.752,"endTime":1271.042,"body":"like surrounding ecosystem is where you"},{"startTime":1271.042,"endTime":1276.512,"body":"need to do this for cryptography, um,"},{"startTime":1271.042,"endTime":1276.512,"body":"as opposed to like games which are, I"},{"startTime":1276.512,"endTime":1279.662,"body":"was about to say notorious for being"},{"startTime":1276.512,"endTime":1279.662,"body":"developed once and then left on for years."},{"startTime":1279.662,"endTime":1281.732,"body":"But then I just realized"},{"startTime":1279.662,"endTime":1281.732,"body":"I was describing HSMs."},{"startTime":1282.032,"endTime":1286.577,"body":"Yeah, I mean, I, I think what I would"},{"startTime":1282.032,"endTime":1286.577,"body":"say is that like if you really sat down"},{"startTime":1286.577,"endTime":1290.267,"body":"with a, we want to make more things"},{"startTime":1286.577,"endTime":1290.267,"body":"pluggable, like I think there is probably"},{"startTime":1290.267,"endTime":1295.097,"body":"a design you could get for providers"},{"startTime":1290.267,"endTime":1295.097,"body":"where you put state in the right places."},{"startTime":1295.097,"endTime":1298.217,"body":"You have like the indirect function"},{"startTime":1295.097,"endTime":1298.217,"body":"call in kind of the right place in"},{"startTime":1298.217,"endTime":1303.617,"body":"the stack that like balances the"},{"startTime":1298.217,"endTime":1303.617,"body":"complexity and the performance and the,"},{"startTime":1303.677,"endTime":1305.327,"body":"like, maintainability of the system."},{"startTime":1305.327,"endTime":1310.457,"body":"Like I, you know, I, I think there are"},{"startTime":1305.327,"endTime":1310.457,"body":"useful points on the like, trade off"},{"startTime":1310.517,"endTime":1315.657,"body":"curve that are not just like everything is"},{"startTime":1310.517,"endTime":1315.657,"body":"static, but I, I think the point OpenSSL"},{"startTime":1315.677,"endTime":1320.897,"body":"ended up on where, like the SHA-256"},{"startTime":1315.677,"endTime":1320.897,"body":"or like the result of EVP SHA-256 is"},{"startTime":1320.897,"endTime":1324.347,"body":"like an abstract object which will like"},{"startTime":1320.897,"endTime":1324.347,"body":"call something on the provider later."},{"startTime":1324.347,"endTime":1326.597,"body":"And that's allowed to change"},{"startTime":1324.347,"endTime":1326.597,"body":"at like arbitrary points"},{"startTime":1326.657,"endTime":1329.687,"body":"is like not a particularly"},{"startTime":1326.657,"endTime":1329.687,"body":"useful point on that trade off"},{"startTime":1329.987,"endTime":1330.277,"body":"Yeah."},{"startTime":1330.617,"endTime":1331.357,"body":"No, God."},{"startTime":1331.697,"endTime":1334.667,"body":"I was, I was, I was set"},{"startTime":1331.697,"endTime":1334.667,"body":"off on the whole RCU thing."},{"startTime":1334.667,"endTime":1337.607,"body":"So I was wondering, it kind of made"},{"startTime":1334.667,"endTime":1337.607,"body":"sense to me that if they did a whole"},{"startTime":1337.607,"endTime":1340.847,"body":"bunch of new concurrency stuff, like"},{"startTime":1337.607,"endTime":1340.847,"body":"that's a way I could see you getting"},{"startTime":1341.057,"endTime":1343.277,"body":"like a six x performance regression."},{"startTime":1343.277,"endTime":1343.727,"body":"Right."},{"startTime":1343.757,"endTime":1344.237,"body":"Because Okay."},{"startTime":1344.237,"endTime":1347.217,"body":"You're just like, you know,"},{"startTime":1344.237,"endTime":1347.217,"body":"you're contending on locks"},{"startTime":1347.217,"endTime":1347.877,"body":"or something like that."},{"startTime":1348.162,"endTime":1348.402,"body":"Mm-hmm."},{"startTime":1348.762,"endTime":1351.102,"body":"I, I mean, and there certainly"},{"startTime":1348.762,"endTime":1351.102,"body":"are a lot of locks, particularly"},{"startTime":1351.102,"endTime":1352.572,"body":"in the earliest profiles."},{"startTime":1352.887,"endTime":1353.307,"body":"Okay."},{"startTime":1354.007,"endTime":1357.607,"body":"But it's not, it's not your sense that"},{"startTime":1354.007,"endTime":1357.607,"body":"it's, I'm, the vibe I get from you"},{"startTime":1357.607,"endTime":1360.367,"body":"is that it's literally just calling"},{"startTime":1357.607,"endTime":1360.367,"body":"through bullshit indirection code."},{"startTime":1360.547,"endTime":1362.137,"body":"It's not waiting on locks."},{"startTime":1362.182,"endTime":1364.642,"body":"I, I, I don't wanna say"},{"startTime":1362.182,"endTime":1364.642,"body":"there's no locks anymore."},{"startTime":1364.702,"endTime":1368.812,"body":"Like the point of RCU is like, now you're"},{"startTime":1364.702,"endTime":1368.812,"body":"spending less time waiting on the locks."},{"startTime":1369.072,"endTime":1371.652,"body":"but like, like I said, it's still"},{"startTime":1369.072,"endTime":1371.652,"body":"three x lower than we think."},{"startTime":1371.652,"endTime":1373.742,"body":"It's like a reasonable"},{"startTime":1371.652,"endTime":1373.742,"body":"baseline for like parsing DER."},{"startTime":1374.422,"endTime":1377.062,"body":"And, and I, I will note that I think"},{"startTime":1374.422,"endTime":1377.062,"body":"we've, we've fallen to the same"},{"startTime":1377.062,"endTime":1379.552,"body":"trap because of the performance"},{"startTime":1377.062,"endTime":1379.552,"body":"stuff is so easy to talk about."},{"startTime":1379.882,"endTime":1383.692,"body":"Uh, but like, again, the performance"},{"startTime":1379.882,"endTime":1383.692,"body":"is not our critical concern here."},{"startTime":1383.692,"endTime":1385.577,"body":"It is the complexity"},{"startTime":1383.692,"endTime":1385.577,"body":"that led to that issue."},{"startTime":1386.122,"endTime":1386.412,"body":"Yeah."},{"startTime":1386.412,"endTime":1388.447,"body":"Which I, I think it's worth"},{"startTime":1386.412,"endTime":1388.447,"body":"building on kind of the."},{"startTime":1389.077,"endTime":1392.967,"body":"Complexity in the public APIs is"},{"startTime":1389.077,"endTime":1392.967,"body":"like a really important other, thing"},{"startTime":1392.967,"endTime":1397.317,"body":"that is, is like honestly like maybe"},{"startTime":1392.967,"endTime":1397.317,"body":"the most pressing thing for us,"},{"startTime":1397.362,"endTime":1401.212,"body":"Yeah, you mentioned OSLs, O-S-L-O-S-S-L,"},{"startTime":1401.282,"endTime":1402.272,"body":"param,"},{"startTime":1402.292,"endTime":1406.492,"body":"and like, you know, I'm, I'm poking"},{"startTime":1402.292,"endTime":1406.492,"body":"around in there, in, in OpenSSL for,"},{"startTime":1406.492,"endTime":1409.702,"body":"you know, post quantum stuff, and"},{"startTime":1406.492,"endTime":1409.702,"body":"I'm seeing this all over the place."},{"startTime":1409.762,"endTime":1414.507,"body":"And like, tell what, where does OSL"},{"startTime":1409.762,"endTime":1414.507,"body":"param come from and why, why is it there?"},{"startTime":1414.967,"endTime":1415.207,"body":"Yeah."},{"startTime":1415.207,"endTime":1419.587,"body":"So OSL pram is, is another one of"},{"startTime":1415.207,"endTime":1419.587,"body":"the kind of new APIs from OpenSSL 3."},{"startTime":1420.317,"endTime":1424.007,"body":"And like it is effectively, like"},{"startTime":1420.317,"endTime":1424.007,"body":"many, many public API functions."},{"startTime":1424.007,"endTime":1428.237,"body":"Instead of like taking like a list of"},{"startTime":1424.007,"endTime":1428.237,"body":"like arguments to a function, take,"},{"startTime":1428.307,"endTime":1432.747,"body":"a an array of OSL paras, which is"},{"startTime":1428.307,"endTime":1432.747,"body":"basically an array of key value pairs."},{"startTime":1433.047,"endTime":1437.657,"body":"So like, instead of passing, I don't know"},{"startTime":1433.047,"endTime":1437.657,"body":"if you, you're calling like argon, two,"},{"startTime":1437.717,"endTime":1439.487,"body":"like you've got a key derivation function."},{"startTime":1439.487,"endTime":1442.097,"body":"Like you've got, uh, you've"},{"startTime":1439.487,"endTime":1442.097,"body":"got your key material."},{"startTime":1442.217,"endTime":1445.907,"body":"You've got like your salt and"},{"startTime":1442.217,"endTime":1445.907,"body":"your salt le maybe a length."},{"startTime":1445.967,"endTime":1448.217,"body":"'cause you know it's c so you got"},{"startTime":1445.967,"endTime":1448.217,"body":"your pointer and your length fine,"},{"startTime":1448.577,"endTime":1450.407,"body":"uh, and your like desired output."},{"startTime":1450.557,"endTime":1455.677,"body":"And, the RN and I can't remember the"},{"startTime":1450.557,"endTime":1455.677,"body":"third parameters name, like e instead"},{"startTime":1455.677,"endTime":1458.587,"body":"of like, you pass each one of those"},{"startTime":1455.677,"endTime":1458.587,"body":"to function to a function as like"},{"startTime":1458.587,"endTime":1464.227,"body":"arguments, the way this works in OpenSSL"},{"startTime":1458.587,"endTime":1464.227,"body":"3 is that you create an OSL parameter."},{"startTime":1464.927,"endTime":1472.527,"body":"and it's got, you know, you know, string"},{"startTime":1464.927,"endTime":1472.527,"body":"key pointer to the key string, uh, salt"},{"startTime":1472.527,"endTime":1474.777,"body":"pointer to the past salt len and like."},{"startTime":1475.477,"endTime":1476.587,"body":"That is like how it works."},{"startTime":1476.587,"endTime":1478.597,"body":"And you know, you've got"},{"startTime":1476.587,"endTime":1478.597,"body":"types for each of the values."},{"startTime":1478.627,"endTime":1479.887,"body":"'cause like you wouldn't wanna"},{"startTime":1479.967,"endTime":1481.507,"body":"Yeah, I was, I'm looking at that now."},{"startTime":1481.957,"endTime":1484.897,"body":"I'm looking at the, the Claude summary"},{"startTime":1481.957,"endTime":1484.897,"body":"on this now, and it's like integer,"},{"startTime":1485.107,"endTime":1487.237,"body":"unset integer, UTF string octe."},{"startTime":1487.937,"endTime":1489.347,"body":"Does it really have octet string?"},{"startTime":1489.992,"endTime":1490.682,"body":"it does."},{"startTime":1491.382,"endTime":1493.692,"body":"you wanna pass like arbitrary"},{"startTime":1491.382,"endTime":1493.692,"body":"bites, like what you want."},{"startTime":1493.692,"endTime":1495.492,"body":"You think your salt"},{"startTime":1493.692,"endTime":1495.492,"body":"should be like UTF eight?"},{"startTime":1496.192,"endTime":1498.532,"body":"I mean, it sounds like"},{"startTime":1496.192,"endTime":1498.532,"body":"they've created C-J-S-O-N"},{"startTime":1499.232,"endTime":1499.892,"body":"Oh goodness."},{"startTime":1499.952,"endTime":1500.582,"body":"Yeah."},{"startTime":1500.642,"endTime":1501.002,"body":"But like."},{"startTime":1501.167,"endTime":1502.967,"body":"C JSON TypeScript interface."},{"startTime":1503.327,"endTime":1503.597,"body":"Yeah."},{"startTime":1503.597,"endTime":1508.307,"body":"And like, you know, a again, to like try"},{"startTime":1503.597,"endTime":1508.307,"body":"to steel man, this, like our understanding"},{"startTime":1508.307,"endTime":1512.717,"body":"of like, this is part of just like the"},{"startTime":1508.307,"endTime":1512.717,"body":"make things very abstract theory of like,"},{"startTime":1512.927,"endTime":1516.497,"body":"well you could write a program that like,"},{"startTime":1512.927,"endTime":1516.497,"body":"I don't know, has a configuration file"},{"startTime":1516.497,"endTime":1518.087,"body":"and like read some parameters from it."},{"startTime":1518.477,"endTime":1521.417,"body":"And like that would mean that like"},{"startTime":1518.477,"endTime":1521.417,"body":"somebody could bring a new algorithm"},{"startTime":1521.417,"endTime":1523.487,"body":"and new types of parameters and"},{"startTime":1521.417,"endTime":1523.487,"body":"like, you'd never have to update"},{"startTime":1523.487,"endTime":1527.217,"body":"your program 'cause like it all flows"},{"startTime":1523.487,"endTime":1527.217,"body":"through like this abstract OSSL_PARAM."},{"startTime":1527.597,"endTime":1530.957,"body":"In practice, our experience for like"},{"startTime":1527.597,"endTime":1530.957,"body":"the things we are trying to do is,"},{"startTime":1530.957,"endTime":1534.227,"body":"it means, it's very difficult to tell"},{"startTime":1530.957,"endTime":1534.227,"body":"what arguments the function takes."},{"startTime":1534.317,"endTime":1536.447,"body":"It's very difficult to tell,"},{"startTime":1534.317,"endTime":1536.447,"body":"you're passing 'em correctly."},{"startTime":1536.447,"endTime":1539.027,"body":"You're, you are losing a whole"},{"startTime":1536.447,"endTime":1539.027,"body":"bunch of like static like."},{"startTime":1539.087,"endTime":1542.357,"body":"Static type checking that you would"},{"startTime":1539.087,"endTime":1542.357,"body":"normally get from a computer program."},{"startTime":1542.717,"endTime":1545.627,"body":"It makes things slow and it"},{"startTime":1542.717,"endTime":1545.627,"body":"makes the OpenSSL code like"},{"startTime":1545.627,"endTime":1546.707,"body":"much more complex, right?"},{"startTime":1546.707,"endTime":1549.287,"body":"Like if you think like, oh, I"},{"startTime":1546.707,"endTime":1549.287,"body":"have the name of a variable."},{"startTime":1549.287,"endTime":1550.517,"body":"That's an argument to my function."},{"startTime":1550.697,"endTime":1553.097,"body":"Like that's just like clearly"},{"startTime":1550.697,"endTime":1553.097,"body":"much simpler than I'm gonna"},{"startTime":1553.097,"endTime":1554.537,"body":"go root around in the array."},{"startTime":1554.717,"endTime":1560.027,"body":"And in fact, many C Source files in"},{"startTime":1554.717,"endTime":1560.027,"body":"OpenSSL's  source now have a custom"},{"startTime":1560.077,"endTime":1562.397,"body":"Perl pre-processor to like make dealing"},{"startTime":1562.562,"endTime":1562.832,"body":"wait,"},{"startTime":1563.027,"endTime":1564.827,"body":"Oh, no, no."},{"startTime":1564.962,"endTime":1566.847,"body":"wait, wait, So wait, wait."},{"startTime":1566.957,"endTime":1568.922,"body":"Hold on, hold on, hold on."},{"startTime":1569.072,"endTime":1573.872,"body":"In the new OSSL_PARAM world and"},{"startTime":1569.072,"endTime":1573.872,"body":"OpenSSL 3, none of the cryptography"},{"startTime":1573.872,"endTime":1575.462,"body":"interfaces are type safe anymore."},{"startTime":1575.792,"endTime":1578.312,"body":"They all just take abstract"},{"startTime":1575.792,"endTime":1578.312,"body":"arrays of parameters."},{"startTime":1578.582,"endTime":1579.422,"body":"All the checking is,"},{"startTime":1579.887,"endTime":1580.907,"body":"none of the new ones."},{"startTime":1580.907,"endTime":1582.467,"body":"Like they're still old APIs"},{"startTime":1582.602,"endTime":1584.552,"body":"it's all run, it's all runtime checking."},{"startTime":1584.552,"endTime":1586.902,"body":"Now they're just like, okay."},{"startTime":1587.352,"endTime":1587.832,"body":"Correct."},{"startTime":1587.832,"endTime":1587.982,"body":"Yeah."},{"startTime":1588.232,"endTime":1588.452,"body":"So"},{"startTime":1588.952,"endTime":1589.702,"body":"we're going backwards."},{"startTime":1589.837,"endTime":1594.427,"body":"yeah, any new interface like Eeb,"},{"startTime":1589.837,"endTime":1594.427,"body":"E-V-P-K-D-F, and E-V-P-A-E-A-D, those"},{"startTime":1594.427,"endTime":1599.767,"body":"are all interfaces that now require"},{"startTime":1594.427,"endTime":1599.767,"body":"OSSL Perra, uh, and almost any new"},{"startTime":1599.767,"endTime":1601.727,"body":"feature added, does require it."},{"startTime":1601.727,"endTime":1605.577,"body":"have spent a lot of time and energy"},{"startTime":1601.727,"endTime":1605.577,"body":"like trying to not use OSSL_PARAM"},{"startTime":1605.597,"endTime":1608.927,"body":"except where necessary, and I think we"},{"startTime":1605.597,"endTime":1608.927,"body":"currently have two places we consume"},{"startTime":1608.927,"endTime":1612.437,"body":"it, but we actually abstracted away"},{"startTime":1608.927,"endTime":1612.437,"body":"by pushing it into Rust OpenSSL."},{"startTime":1613.022,"endTime":1614.642,"body":"Let me, let me steal man."},{"startTime":1614.642,"endTime":1615.272,"body":"This design."},{"startTime":1615.422,"endTime":1616.022,"body":"All right."},{"startTime":1616.412,"endTime":1620.042,"body":"What if the idea here is that no"},{"startTime":1616.412,"endTime":1620.042,"body":"normal person is ever supposed"},{"startTime":1620.042,"endTime":1622.772,"body":"to use this interface, which"},{"startTime":1620.042,"endTime":1622.772,"body":"is the only way I can think."},{"startTime":1623.282,"endTime":1626.192,"body":"The only way I can think to"},{"startTime":1623.282,"endTime":1626.192,"body":"describe a, A cryptography."},{"startTime":1626.612,"endTime":1631.112,"body":"A cryptography interface where like the"},{"startTime":1626.612,"endTime":1631.112,"body":"IV isn't type safe at, at compile time."},{"startTime":1631.322,"endTime":1635.462,"body":"So you're saying me and my"},{"startTime":1631.322,"endTime":1635.462,"body":"collaborators are not normal 'cause we"},{"startTime":1635.462,"endTime":1636.717,"body":"did just that the other day."},{"startTime":1636.857,"endTime":1638.027,"body":"on, hold on."},{"startTime":1638.267,"endTime":1641.297,"body":"I'm saying only two people in"},{"startTime":1638.267,"endTime":1641.297,"body":"the world are ever supposed"},{"startTime":1641.297,"endTime":1641.957,"body":"to consume"},{"startTime":1642.227,"endTime":1645.647,"body":"OSSL_PARAM, and it's Alex and Paul,"},{"startTime":1642.227,"endTime":1645.647,"body":"and what you guys are supposed"},{"startTime":1645.647,"endTime":1648.977,"body":"to do is take that and then turn"},{"startTime":1645.647,"endTime":1648.977,"body":"it into something reasonable."},{"startTime":1649.677,"endTime":1654.997,"body":"So I, I mean, I think what I would say is"},{"startTime":1649.677,"endTime":1654.997,"body":"like, if you, you like, you'd come to the"},{"startTime":1655.697,"endTime":1661.307,"body":"idea that like your, internal APIs needed"},{"startTime":1655.697,"endTime":1661.307,"body":"to have this for whatever reason, right."},{"startTime":1661.307,"endTime":1664.087,"body":"You, you needed, you know, more"},{"startTime":1661.307,"endTime":1664.087,"body":"flexibility and like the provider"},{"startTime":1664.087,"endTime":1667.477,"body":"API, 'cause like that a BI had"},{"startTime":1664.087,"endTime":1667.477,"body":"to be the same for forever."},{"startTime":1667.477,"endTime":1669.517,"body":"Like, if you, if you had like a"},{"startTime":1667.477,"endTime":1669.517,"body":"theory of that, like this needed"},{"startTime":1669.517,"endTime":1671.017,"body":"to be kind of your internals."},{"startTime":1671.377,"endTime":1675.707,"body":"I like, I think the, like I, I'm not sure"},{"startTime":1671.377,"endTime":1675.707,"body":"I would ever reach that conclusion, but"},{"startTime":1675.707,"endTime":1680.477,"body":"like if I did, it seems like what I would"},{"startTime":1675.707,"endTime":1680.477,"body":"want to do is like, have public APIs that"},{"startTime":1680.477,"endTime":1684.197,"body":"are like entirely like type, safe and"},{"startTime":1680.477,"endTime":1684.197,"body":"like construct these things internally."},{"startTime":1684.377,"endTime":1685.907,"body":"And it's just like not the case."},{"startTime":1685.907,"endTime":1690.757,"body":"Like if, for example, if the thing you"},{"startTime":1685.907,"endTime":1690.757,"body":"would like to do is configure, OpenSSL to"},{"startTime":1690.757,"endTime":1697.797,"body":"do elliptic curve, signatures that use,"},{"startTime":1690.757,"endTime":1697.797,"body":"uh, deterministic nonces like specified"},{"startTime":1697.797,"endTime":1700.017,"body":"in RFC, like the way you do that."},{"startTime":1700.257,"endTime":1700.647,"body":"Yeah."},{"startTime":1700.737,"endTime":1701.487,"body":"on, hold on."},{"startTime":1701.937,"endTime":1702.627,"body":"Hold on a second."},{"startTime":1703.327,"endTime":1705.127,"body":"You're telling me that in the new system."},{"startTime":1705.827,"endTime":1711.887,"body":"If I wanna like do GCM or something"},{"startTime":1705.827,"endTime":1711.887,"body":"and I'm passing a nonce, it has to do a"},{"startTime":1711.887,"endTime":1714.532,"body":"string compared to find the nonce key."},{"startTime":1715.167,"endTime":1715.737,"body":"Correct."},{"startTime":1715.767,"endTime":1720.057,"body":"like I, I mean, I think in practice"},{"startTime":1715.767,"endTime":1720.057,"body":"there's like old APIs that were"},{"startTime":1720.057,"endTime":1723.867,"body":"type safe for like things like just"},{"startTime":1720.057,"endTime":1723.867,"body":"like doing a symmetric encryption,"},{"startTime":1724.017,"endTime":1724.227,"body":"but"},{"startTime":1724.277,"endTime":1726.557,"body":"I would say, Alex, they've been"},{"startTime":1724.277,"endTime":1726.557,"body":"significantly re-implementing some of"},{"startTime":1726.557,"endTime":1729.827,"body":"the old APIs, using the new APIs so"},{"startTime":1726.557,"endTime":1729.827,"body":"that like underneath the hood, they"},{"startTime":1729.827,"endTime":1733.097,"body":"generate OSSL pers, and then there's"},{"startTime":1729.827,"endTime":1733.097,"body":"definitely a string comparison."},{"startTime":1733.397,"endTime":1735.467,"body":"So like, that's better than"},{"startTime":1733.397,"endTime":1735.467,"body":"making me know about them."},{"startTime":1735.467,"endTime":1738.977,"body":"'cause like literally, if you want to do"},{"startTime":1735.467,"endTime":1738.977,"body":"an elliptic curve, private key signature,"},{"startTime":1739.097,"endTime":1744.347,"body":"and you wanna use a deterministic nonce"},{"startTime":1739.097,"endTime":1744.347,"body":"RFC 69 79, the way you do that is you"},{"startTime":1744.347,"endTime":1749.657,"body":"create an OSSL paras with two entries,"},{"startTime":1744.347,"endTime":1749.657,"body":"one of which is a bool indicating true."},{"startTime":1749.777,"endTime":1752.447,"body":"And the other is like the marker for"},{"startTime":1749.777,"endTime":1752.447,"body":"like, this is the end of the params."},{"startTime":1752.717,"endTime":1756.317,"body":"And like you pass that to like"},{"startTime":1752.717,"endTime":1756.317,"body":"EVPP key, like set paras or"},{"startTime":1756.317,"endTime":1757.517,"body":"whatever the function's named."},{"startTime":1757.907,"endTime":1761.757,"body":"Like, you can't just pass bull to like,"},{"startTime":1757.907,"endTime":1761.757,"body":"you know, enable deterministic nonce."},{"startTime":1761.777,"endTime":1763.077,"body":"Like you  create"},{"startTime":1763.092,"endTime":1765.972,"body":"It is like, it's like"},{"startTime":1763.092,"endTime":1765.972,"body":"they're implementing Ruby,"},{"startTime":1766.672,"endTime":1767.302,"body":"I, yes."},{"startTime":1767.302,"endTime":1770.632,"body":"So this like, I, so like I used to"},{"startTime":1767.302,"endTime":1770.632,"body":"be a programming languages person."},{"startTime":1770.632,"endTime":1774.172,"body":"Like I, like Paul mentioned, like I got"},{"startTime":1770.632,"endTime":1774.172,"body":"my start working on cryptography stuff."},{"startTime":1774.172,"endTime":1777.622,"body":"'cause I, I was working on pi pi,"},{"startTime":1774.172,"endTime":1777.622,"body":"the Python implementation and like,"},{"startTime":1777.622,"endTime":1780.322,"body":"yes, this is what it looks like if"},{"startTime":1777.622,"endTime":1780.322,"body":"you're like writing an interpreter"},{"startTime":1780.442,"endTime":1784.522,"body":"and like, you know, a user can"},{"startTime":1780.442,"endTime":1784.522,"body":"define arbitrary length functions."},{"startTime":1784.522,"endTime":1786.322,"body":"Like, so you have to have"},{"startTime":1784.522,"endTime":1786.322,"body":"an array of parameters."},{"startTime":1786.322,"endTime":1788.302,"body":"Like, yeah, this one"},{"startTime":1786.322,"endTime":1788.302,"body":"interpreter looks like,"},{"startTime":1789.022,"endTime":1789.352,"body":"It It"},{"startTime":1789.577,"endTime":1792.217,"body":"you don't get to get out of"},{"startTime":1789.577,"endTime":1792.217,"body":"this discussion without noting."},{"startTime":1792.217,"endTime":1793.582,"body":"You also worked on pie Ruby."},{"startTime":1793.982,"endTime":1796.952,"body":"it was not called pyro, but it"},{"startTime":1793.982,"endTime":1796.952,"body":"was called Topaz, but yes, yes,"},{"startTime":1796.952,"endTime":1798.212,"body":"I created a Ruby interpreter."},{"startTime":1798.912,"endTime":1799.122,"body":"Yeah."},{"startTime":1799.822,"endTime":1803.122,"body":"I will say every time I end up doing"},{"startTime":1799.822,"endTime":1803.122,"body":"OSSL_PARAM things, what it feels"},{"startTime":1803.122,"endTime":1807.082,"body":"like to me is actually like, Apple's"},{"startTime":1803.122,"endTime":1807.082,"body":"design aesthetic from next step era."},{"startTime":1807.232,"endTime":1811.582,"body":"Like Ns, mutable dictionaries everywhere"},{"startTime":1807.232,"endTime":1811.582,"body":"with all the same sort of challenges"},{"startTime":1811.582,"endTime":1816.242,"body":"where like maybe the, like maybe the,"},{"startTime":1811.582,"endTime":1816.242,"body":"principle like golden path has been"},{"startTime":1816.242,"endTime":1819.872,"body":"tested, but God help you if you pass"},{"startTime":1816.242,"endTime":1819.872,"body":"anything outta the ordinary, who knows"},{"startTime":1819.872,"endTime":1821.312,"body":"what's gonna happen, which I think"},{"startTime":1821.312,"endTime":1822.392,"body":"I gotta say,"},{"startTime":1822.752,"endTime":1823.232,"body":"to testing."},{"startTime":1823.932,"endTime":1828.162,"body":"I gotta say, passing in its parameters"},{"startTime":1823.932,"endTime":1828.162,"body":"to a function, a dictionary of"},{"startTime":1828.162,"endTime":1831.612,"body":"random string keys and values"},{"startTime":1828.162,"endTime":1831.612,"body":"does feel very python to me."},{"startTime":1832.312,"endTime":1837.022,"body":"Hmm, but it's, but this is the part"},{"startTime":1832.312,"endTime":1837.022,"body":"that's in OpenSSL,  supposed to"},{"startTime":1837.022,"endTime":1838.792,"body":"be C library, but apparently"},{"startTime":1838.792,"endTime":1839.152,"body":"it's getting"},{"startTime":1839.362,"endTime":1839.782,"body":"OSL"},{"startTime":1839.782,"endTime":1839.902,"body":"with"},{"startTime":1839.902,"endTime":1840.392,"body":"param"},{"startTime":1840.412,"endTime":1844.597,"body":"to just rename OSL per to qua, and"},{"startTime":1840.412,"endTime":1844.597,"body":"suddenly you guys would be all over it."},{"startTime":1845.297,"endTime":1848.117,"body":"I mean, it's not really our"},{"startTime":1845.297,"endTime":1848.117,"body":"design aesthetic for Python."},{"startTime":1848.117,"endTime":1852.497,"body":"Like, you know, I think we have like"},{"startTime":1848.117,"endTime":1852.497,"body":"pretty strongly typed APIs within the"},{"startTime":1852.497,"endTime":1856.367,"body":"Python world, but like y yeah, like"},{"startTime":1852.497,"endTime":1856.367,"body":"that would be a recognizable like di"},{"startTime":1856.607,"endTime":1858.287,"body":"dynamic programming language aesthetic."},{"startTime":1858.287,"endTime":1859.757,"body":"That is like definitely true."},{"startTime":1860.027,"endTime":1863.847,"body":"I just don't see why you would"},{"startTime":1860.027,"endTime":1863.847,"body":"bring that aesthetic to C  like,"},{"startTime":1863.847,"endTime":1865.302,"body":"that's not Steve's problem."},{"startTime":1865.602,"endTime":1871.542,"body":"So all of this dynamic stuff and lack"},{"startTime":1865.602,"endTime":1871.542,"body":"of static validation and verification"},{"startTime":1871.812,"endTime":1875.607,"body":"seems like it would make it, hard"},{"startTime":1871.812,"endTime":1875.607,"body":"to test, or at least harder to test."},{"startTime":1876.307,"endTime":1879.667,"body":"So we definitely, it's, it's"},{"startTime":1876.307,"endTime":1879.667,"body":"definitely a difficult thing to test."},{"startTime":1879.717,"endTime":1882.867,"body":"it is also the case that the OpenSSL"},{"startTime":1879.717,"endTime":1882.867,"body":"project was founded in the nineties"},{"startTime":1882.867,"endTime":1883.947,"body":"when aesthetics were different."},{"startTime":1884.347,"endTime":1888.522,"body":"however, over the course of the, the"},{"startTime":1884.347,"endTime":1888.522,"body":"decades the Open SS l project was been"},{"startTime":1888.562,"endTime":1891.907,"body":"around and including the time now where"},{"startTime":1888.562,"endTime":1891.907,"body":"they are a very well-funded organization"},{"startTime":1891.937,"endTime":1895.927,"body":"with more full-time engineers than work"},{"startTime":1891.937,"endTime":1895.927,"body":"on any of the forks, to our knowledge."},{"startTime":1896.527,"endTime":1896.977,"body":"They,"},{"startTime":1897.732,"endTime":1897.972,"body":"yeah."},{"startTime":1898.002,"endTime":1898.752,"body":"And a foundation."},{"startTime":1899.022,"endTime":1903.942,"body":"And a corporation and, 17 different,"},{"startTime":1899.022,"endTime":1903.942,"body":"like interest groups at this point."},{"startTime":1904.352,"endTime":1904.622,"body":"they."},{"startTime":1904.842,"endTime":1905.952,"body":"they still struggle with testing."},{"startTime":1906.012,"endTime":1910.122,"body":"So like Alex and I consistently joke that"},{"startTime":1906.012,"endTime":1910.122,"body":"like the Python Cryptographic Authority is"},{"startTime":1910.122,"endTime":1913.422,"body":"a CI engineering project that incidentally"},{"startTime":1910.122,"endTime":1913.422,"body":"produces a cryptography library."},{"startTime":1913.962,"endTime":1917.682,"body":"and part of the reason we make that joke"},{"startTime":1913.962,"endTime":1917.682,"body":"is that like, it, it, it reflects our"},{"startTime":1917.682,"endTime":1922.662,"body":"real belief that like, that type of infa"},{"startTime":1917.682,"endTime":1922.662,"body":"investment in continuous, in integration"},{"startTime":1922.692,"endTime":1927.432,"body":"and testing pays dividends in terms of"},{"startTime":1922.692,"endTime":1927.432,"body":"like software engineering velocity and"},{"startTime":1927.432,"endTime":1929.232,"body":"the quality of, of the product we deliver."},{"startTime":1929.892,"endTime":1932.502,"body":"we spend so much time on it"},{"startTime":1929.892,"endTime":1932.502,"body":"that like it can almost make the"},{"startTime":1932.502,"endTime":1933.912,"body":"other work we do seem trivial."},{"startTime":1934.382,"endTime":1938.972,"body":"unfortunately the OpenSSL project, I mean,"},{"startTime":1934.382,"endTime":1938.972,"body":"we've worked with a lot of these folks."},{"startTime":1938.972,"endTime":1940.622,"body":"We, we, we, we like these people."},{"startTime":1940.622,"endTime":1943.982,"body":"But like it, it's important to, to"},{"startTime":1940.622,"endTime":1943.982,"body":"note where, where struggles continue."},{"startTime":1944.102,"endTime":1947.112,"body":"And one of those things is that"},{"startTime":1944.102,"endTime":1947.112,"body":"despite all this time the OpenSSL"},{"startTime":1947.132,"endTime":1950.432,"body":"project does not prize testing"},{"startTime":1947.132,"endTime":1950.432,"body":"in the way that we prize testing."},{"startTime":1950.982,"endTime":1951.942,"body":"we have seen."},{"startTime":1952.642,"endTime":1955.482,"body":"There are, there are many ways, we,"},{"startTime":1952.642,"endTime":1955.482,"body":"in which you can judge this, but one"},{"startTime":1955.482,"endTime":1959.622,"body":"of the ways which is fairly prominent"},{"startTime":1955.482,"endTime":1959.622,"body":"is go and look at any bug fix or"},{"startTime":1959.622,"endTime":1963.852,"body":"new feature set that lands on, uh,"},{"startTime":1959.622,"endTime":1963.852,"body":"OpenSSL and look to see whether or"},{"startTime":1963.852,"endTime":1970.082,"body":"not there are tests, now new features"},{"startTime":1963.852,"endTime":1970.082,"body":"typically, yes, bug fixes frequently no."},{"startTime":1970.612,"endTime":1973.312,"body":"and if you ask about them, they"},{"startTime":1970.612,"endTime":1973.312,"body":"won't say they shouldn't be"},{"startTime":1973.312,"endTime":1974.962,"body":"tests, but they may not happen."},{"startTime":1974.992,"endTime":1978.352,"body":"They're not prioritized in the way that"},{"startTime":1974.992,"endTime":1978.352,"body":"you would expect a project like this."},{"startTime":1978.952,"endTime":1981.472,"body":"Similarly, you have a large CI matrix."},{"startTime":1982.172,"endTime":1985.022,"body":"Alex and I spend a lot of time"},{"startTime":1982.172,"endTime":1985.022,"body":"and energy making sure our CI"},{"startTime":1985.022,"endTime":1988.027,"body":"matrix is clean and fast because"},{"startTime":1985.022,"endTime":1988.027,"body":"not otherwise is very painful."},{"startTime":1988.622,"endTime":1992.582,"body":"In fact, uh, as, as a, as a related"},{"startTime":1988.622,"endTime":1992.582,"body":"note, OpenSSL ship, the bug fix release"},{"startTime":1992.582,"endTime":1995.742,"body":"today, which meant we ship the release"},{"startTime":1992.582,"endTime":1995.742,"body":"because we statically link OpenSSL"},{"startTime":1995.762,"endTime":1997.442,"body":"in our binary artifacts, the wheels."},{"startTime":1998.142,"endTime":2001.982,"body":"And because we've spent two weeks"},{"startTime":1998.142,"endTime":2001.982,"body":"with Windows arm 64 builders failing,"},{"startTime":2002.192,"endTime":2004.172,"body":"we removed Windows, arm 64 support."},{"startTime":2004.442,"endTime":2006.122,"body":"That's how serious we are"},{"startTime":2004.442,"endTime":2006.122,"body":"about this sort of thing."},{"startTime":2006.822,"endTime":2007.452,"body":"Failing."},{"startTime":2007.452,"endTime":2010.542,"body":"Not like, 'cause we landed a regression,"},{"startTime":2007.452,"endTime":2010.542,"body":"but due to like a platform issue in"},{"startTime":2010.632,"endTime":2013.122,"body":"GitHub's, uh, windows arm 64 runners."},{"startTime":2013.767,"endTime":2014.247,"body":"Yeah, yeah."},{"startTime":2014.247,"endTime":2014.547,"body":"This,"},{"startTime":2014.682,"endTime":2017.262,"body":"it wa it was because of the, the runners."},{"startTime":2017.457,"endTime":2017.747,"body":"Yeah."},{"startTime":2017.997,"endTime":2019.167,"body":"The runners themselves have"},{"startTime":2019.187,"endTime":2019.387,"body":"platform"},{"startTime":2020.187,"endTime":2022.287,"body":"and it's not the first time"},{"startTime":2020.187,"endTime":2022.287,"body":"we've had issues like this."},{"startTime":2022.317,"endTime":2026.787,"body":"This is not a, a conversation about how"},{"startTime":2022.317,"endTime":2026.787,"body":"Microsoft owns GitHub and yet somehow they"},{"startTime":2026.817,"endTime":2029.007,"body":"don't prioritize Windows Arm 64 at all."},{"startTime":2029.157,"endTime":2029.667,"body":"But like,"},{"startTime":2030.147,"endTime":2033.837,"body":"we, we've had enough issues and that"},{"startTime":2030.147,"endTime":2033.837,"body":"like be, we gave them a lot of time,"},{"startTime":2033.867,"endTime":2036.657,"body":"but we care very deeply about our"},{"startTime":2033.867,"endTime":2036.657,"body":"CI working and being performant."},{"startTime":2036.687,"endTime":2039.627,"body":"And so we were willing to remove it"},{"startTime":2036.687,"endTime":2039.627,"body":"even though it, it, it is painful."},{"startTime":2040.222,"endTime":2043.462,"body":"that's indefinitely until"},{"startTime":2040.222,"endTime":2043.462,"body":"those things can work again."},{"startTime":2043.867,"endTime":2044.047,"body":"Yeah."},{"startTime":2044.047,"endTime":2044.677,"body":"When, and"},{"startTime":2044.752,"endTime":2046.312,"body":"they work and we have"},{"startTime":2044.752,"endTime":2046.312,"body":"confidence they'll stay"},{"startTime":2046.312,"endTime":2046.762,"body":"working."},{"startTime":2047.332,"endTime":2047.737,"body":"Exactly."},{"startTime":2047.737,"endTime":2048.997,"body":"I need a track record behind it."},{"startTime":2049.027,"endTime":2051.667,"body":"'cause fixing it is fine, but like"},{"startTime":2049.027,"endTime":2051.667,"body":"I need to see it working for an"},{"startTime":2051.667,"endTime":2054.427,"body":"extended period of time and that"},{"startTime":2051.667,"endTime":2054.427,"body":"like, they actually respond in a"},{"startTime":2054.427,"endTime":2055.897,"body":"timely fashion to future issues."},{"startTime":2056.462,"endTime":2059.282,"body":"a failure is just flapping all"},{"startTime":2056.462,"endTime":2059.282,"body":"the time, then it's, it's a noisy"},{"startTime":2059.282,"endTime":2060.722,"body":"signal and it's not a useful signal,"},{"startTime":2060.722,"endTime":2061.412,"body":"and then it's"},{"startTime":2061.712,"endTime":2062.012,"body":"yeah."},{"startTime":2062.072,"endTime":2064.892,"body":"Flip flapping at the all the time"},{"startTime":2062.072,"endTime":2064.892,"body":"is like a, a useful segue into"},{"startTime":2064.892,"endTime":2066.272,"body":"like, that is a big problem with"},{"startTime":2066.972,"endTime":2068.082,"body":"Yeah."},{"startTime":2068.562,"endTime":2073.122,"body":"really the apex of this was"},{"startTime":2068.562,"endTime":2073.122,"body":"OpenSSL 3.0 0.4 had a buffer"},{"startTime":2073.122,"endTime":2079.192,"body":"overflow in the RSA implementation,"},{"startTime":2073.122,"endTime":2079.192,"body":"for a VX five 12 capable CPUs."},{"startTime":2079.462,"endTime":2084.542,"body":"And in fact, this failed in CI sometimes"},{"startTime":2079.462,"endTime":2084.542,"body":"when the CI runner happened to be"},{"startTime":2084.542,"endTime":2087.272,"body":"allocated on a machine with AVX five 12."},{"startTime":2087.482,"endTime":2087.992,"body":"But it didn't"},{"startTime":2088.142,"endTime":2088.412,"body":"but,"},{"startTime":2088.892,"endTime":2091.922,"body":"but it was doing a different architecture,"},{"startTime":2092.252,"endTime":2092.522,"body":"like."},{"startTime":2092.522,"endTime":2093.397,"body":"it was randomly"},{"startTime":2093.947,"endTime":2094.817,"body":"GitHub action."},{"startTime":2094.817,"endTime":2098.627,"body":"Well, so GitHub actions doesn't guarantee"},{"startTime":2094.817,"endTime":2098.627,"body":"like which CPU class you'll get."},{"startTime":2098.777,"endTime":2100.937,"body":"And so like sometimes you"},{"startTime":2098.777,"endTime":2100.937,"body":"built on a machine with AVX"},{"startTime":2100.937,"endTime":2102.737,"body":"five 12, sometimes you didn't."},{"startTime":2102.857,"endTime":2106.667,"body":"And so like when you were on"},{"startTime":2102.857,"endTime":2106.667,"body":"AVX five 12, your tests probably"},{"startTime":2106.667,"endTime":2108.387,"body":"failed, like as a buffer overflow."},{"startTime":2108.387,"endTime":2111.607,"body":"So there's always an element of"},{"startTime":2108.387,"endTime":2111.607,"body":"luck, but it was not noticed."},{"startTime":2111.697,"endTime":2113.737,"body":"'cause tests were kind of always flaky."},{"startTime":2114.127,"endTime":2116.147,"body":"And, you know, I think"},{"startTime":2114.127,"endTime":2116.147,"body":"this reflects two issues."},{"startTime":2116.147,"endTime":2119.657,"body":"One tests being flaky all the time,"},{"startTime":2116.147,"endTime":2119.657,"body":"which is a really persistent issue."},{"startTime":2119.657,"endTime":2124.497,"body":"Like the day we wrote our slides, for the"},{"startTime":2119.657,"endTime":2124.497,"body":"original talk version of this, five of the"},{"startTime":2124.557,"endTime":2127.472,"body":"10 recent commits had failing, ci checks."},{"startTime":2127.562,"endTime":2130.802,"body":"And when we checked again the day"},{"startTime":2127.562,"endTime":2130.802,"body":"before we get delivered, our talk,"},{"startTime":2130.952,"endTime":2133.902,"body":"every single commit, had failing"},{"startTime":2130.952,"endTime":2133.902,"body":"builds for cross compilation."},{"startTime":2134.022,"endTime":2137.292,"body":"This is like the first issue, just like"},{"startTime":2134.022,"endTime":2137.292,"body":"lack of really prioritizing stability."},{"startTime":2137.562,"endTime":2141.432,"body":"The second issue is like lack of"},{"startTime":2137.562,"endTime":2141.432,"body":"investment in the kind of infrastructure."},{"startTime":2142.182,"endTime":2145.392,"body":"for like open a sales, a project"},{"startTime":2142.182,"endTime":2145.392,"body":"with lots of like per platform"},{"startTime":2145.392,"endTime":2147.582,"body":"assembler, per platform assembly."},{"startTime":2147.702,"endTime":2151.662,"body":"And Intel in fact, offers a tool"},{"startTime":2147.702,"endTime":2151.662,"body":"called Intel, SDE, which basically"},{"startTime":2151.662,"endTime":2154.902,"body":"lets you dynamically toggle,"},{"startTime":2151.662,"endTime":2154.902,"body":"uh, CPU features on and off."},{"startTime":2154.902,"endTime":2158.622,"body":"So you can, you know, simulate"},{"startTime":2154.902,"endTime":2158.622,"body":"A CPU without a VX five 12"},{"startTime":2158.622,"endTime":2160.872,"body":"A CPU without SSE three."},{"startTime":2160.962,"endTime":2164.232,"body":"And so you can in fact test all of"},{"startTime":2160.962,"endTime":2164.232,"body":"the combinations of assembly you have."},{"startTime":2164.532,"endTime":2168.882,"body":"And there are forks that use this in"},{"startTime":2164.532,"endTime":2168.882,"body":"their CI to verify all of their assembly."},{"startTime":2168.882,"endTime":2172.852,"body":"And it, you know, this is"},{"startTime":2168.882,"endTime":2172.852,"body":"not present in OpenSSL ci."},{"startTime":2172.852,"endTime":2173.992,"body":"And like, we think that's a real miss."},{"startTime":2173.992,"endTime":2175.612,"body":"Like that's just a missed opportunity."},{"startTime":2175.617,"endTime":2178.507,"body":"Like I'm, look, I'm, I was, I was"},{"startTime":2175.617,"endTime":2178.507,"body":"stunned that you're like, you can't"},{"startTime":2178.777,"endTime":2183.307,"body":"make sure that you get like an AVX"},{"startTime":2178.777,"endTime":2183.307,"body":"backend runner in GitHub actions."},{"startTime":2183.307,"endTime":2188.617,"body":"And like the answer is okay, maybe"},{"startTime":2183.307,"endTime":2188.617,"body":"you can't, but that means you put your"},{"startTime":2188.617,"endTime":2191.527,"body":"A VX specific stuff behind a flag."},{"startTime":2191.707,"endTime":2194.887,"body":"You put, online your own custom runner."},{"startTime":2195.157,"endTime":2199.177,"body":"You, you rack your own hardware or"},{"startTime":2195.157,"endTime":2199.177,"body":"you pay someone to rack the hardware,"},{"startTime":2199.237,"endTime":2204.637,"body":"and then you have the flag so that"},{"startTime":2199.237,"endTime":2204.637,"body":"when you do allocate to your custom"},{"startTime":2204.637,"endTime":2208.357,"body":"runner that always runs on AV X, then"},{"startTime":2204.637,"endTime":2208.357,"body":"you unflag your flag and then you test"},{"startTime":2208.357,"endTime":2210.307,"body":"your AV X specific implementation."},{"startTime":2210.517,"endTime":2212.887,"body":"I know lots of projects that do this."},{"startTime":2213.442,"endTime":2213.742,"body":"Yeah."},{"startTime":2213.802,"endTime":2217.102,"body":"now a word from our sponsor,"},{"startTime":2213.802,"endTime":2217.102,"body":"fly.io, provider of a VA escapable."},{"startTime":2217.802,"endTime":2220.712,"body":"And from the official hot sauce"},{"startTime":2217.802,"endTime":2220.712,"body":"of security, cryptography,"},{"startTime":2220.712,"endTime":2222.422,"body":"whatever, crystal hot sauce."},{"startTime":2223.122,"endTime":2224.472,"body":"that a salt brand?"},{"startTime":2225.172,"endTime":2228.932,"body":"It's also you're thinking of a diamond."},{"startTime":2228.962,"endTime":2229.682,"body":"Diamond crystal."},{"startTime":2230.222,"endTime":2230.762,"body":"Yes."},{"startTime":2230.762,"endTime":2231.242,"body":"Yes."},{"startTime":2231.632,"endTime":2234.542,"body":"I am gonna be very disappointed if that"},{"startTime":2231.632,"endTime":2234.542,"body":"doesn't make it into the co podcast."},{"startTime":2234.822,"endTime":2235.312,"body":"Leaving"},{"startTime":2235.327,"endTime":2238.987,"body":"the, uh, so like, I mean there's,"},{"startTime":2235.327,"endTime":2238.987,"body":"as you noted, Deirdre, there's a"},{"startTime":2238.987,"endTime":2241.837,"body":"bunch of ways where you can, you"},{"startTime":2238.987,"endTime":2241.837,"body":"can slice this such that you get the"},{"startTime":2241.837,"endTime":2243.007,"body":"type of testing coverage you want."},{"startTime":2243.337,"endTime":2246.637,"body":"It's also the case that OpenSSL is"},{"startTime":2243.337,"endTime":2246.637,"body":"at this point, a big tent with a"},{"startTime":2246.637,"endTime":2248.437,"body":"wide variety of supported things."},{"startTime":2248.587,"endTime":2251.287,"body":"And they actually do have"},{"startTime":2248.587,"endTime":2251.287,"body":"leverage in this ecosystem."},{"startTime":2251.527,"endTime":2255.817,"body":"So like if and when someone comes"},{"startTime":2251.527,"endTime":2255.817,"body":"and says, I would like you to land."},{"startTime":2256.402,"endTime":2260.842,"body":"Like architecture specific assembly"},{"startTime":2256.402,"endTime":2260.842,"body":"for my pet architecture, it would not"},{"startTime":2260.842,"endTime":2263.182,"body":"be out of the bounds for them to say."},{"startTime":2263.882,"endTime":2267.452,"body":"Supporting that in our, in our system"},{"startTime":2263.882,"endTime":2267.452,"body":"looks like the following and it look"},{"startTime":2267.452,"endTime":2270.062,"body":"would pro, frankly, it would probably"},{"startTime":2267.452,"endTime":2270.062,"body":"look similar to what Alex and I have"},{"startTime":2270.062,"endTime":2274.322,"body":"said in the past around Power PC 64,"},{"startTime":2270.062,"endTime":2274.322,"body":"little endian support or Windows arm"},{"startTime":2274.322,"endTime":2278.897,"body":"64, which is you will provide, you know,"},{"startTime":2274.322,"endTime":2278.897,"body":"ephemeral runners that can maintain no"},{"startTime":2278.897,"endTime":2282.332,"body":"state and integrate into our CI such"},{"startTime":2278.897,"endTime":2282.332,"body":"that we do not have the responsibility"},{"startTime":2282.332,"endTime":2286.112,"body":"of, of like managing them and they"},{"startTime":2282.332,"endTime":2286.112,"body":"will work in the following fashion,"},{"startTime":2286.397,"endTime":2288.332,"body":"And if they do not, we drop you."},{"startTime":2288.732,"endTime":2289.337,"body":"yeah, yeah."},{"startTime":2289.337,"endTime":2291.467,"body":"I mean, I give a real"},{"startTime":2289.337,"endTime":2291.467,"body":"concrete example there."},{"startTime":2291.497,"endTime":2295.997,"body":"There's an open bug right now against"},{"startTime":2291.497,"endTime":2295.997,"body":"OpenSSL for the assembly, for Spark for"},{"startTime":2295.997,"endTime":2301.197,"body":"doing, I don't even know what, and it's,"},{"startTime":2295.997,"endTime":2301.197,"body":"it's got some bug in an optimization pass."},{"startTime":2301.457,"endTime":2304.007,"body":"And you know, the OpenSSL folks"},{"startTime":2301.457,"endTime":2304.007,"body":"have basically said like, look,"},{"startTime":2304.007,"endTime":2306.257,"body":"SPARC assembly is not maintained"},{"startTime":2304.007,"endTime":2306.257,"body":"by the OpenSSL core team."},{"startTime":2306.257,"endTime":2307.637,"body":"Like this is community maintained."},{"startTime":2307.907,"endTime":2311.237,"body":"Like what I would encourage"},{"startTime":2307.907,"endTime":2311.237,"body":"them to do is say like."},{"startTime":2311.937,"endTime":2312.657,"body":"This is a bug."},{"startTime":2312.657,"endTime":2316.017,"body":"Therefore, like we're disabling this"},{"startTime":2312.657,"endTime":2316.017,"body":"optimization If like the maintainer"},{"startTime":2316.017,"endTime":2320.007,"body":"of the SPARC platform wants to"},{"startTime":2316.017,"endTime":2320.007,"body":"like, contribute CI or contribute"},{"startTime":2320.007,"endTime":2321.597,"body":"fixes, like we will accept those."},{"startTime":2321.597,"endTime":2325.347,"body":"But like we don't wanna ship this buggy"},{"startTime":2321.597,"endTime":2325.347,"body":"thing and we don't wanna give users like"},{"startTime":2325.347,"endTime":2330.177,"body":"the impression that like, you know, give"},{"startTime":2325.347,"endTime":2330.177,"body":"them like, we, we don't wanna carry all of"},{"startTime":2330.177,"endTime":2332.307,"body":"this performance sensitive and buggy code."},{"startTime":2332.487,"endTime":2335.727,"body":"We would rather slip the ship,"},{"startTime":2332.487,"endTime":2335.727,"body":"the slower thing that's guaranteed"},{"startTime":2335.727,"endTime":2339.777,"body":"to work and put really the onus"},{"startTime":2335.727,"endTime":2339.777,"body":"on like, if the spark owner wants"},{"startTime":2339.777,"endTime":2343.227,"body":"that to be a fast OpenSSL supported"},{"startTime":2339.777,"endTime":2343.227,"body":"thing, like they should do the work."},{"startTime":2343.257,"endTime":2346.317,"body":"And so like, you know, if the OpenSSL,"},{"startTime":2343.257,"endTime":2346.317,"body":"project like pushed on things like"},{"startTime":2346.317,"endTime":2347.577,"body":"that, we'd be very supportive."},{"startTime":2347.977,"endTime":2352.477,"body":"we haven't even touched on all the"},{"startTime":2347.977,"endTime":2352.477,"body":"work that the, the Python Cryptography"},{"startTime":2352.477,"endTime":2357.067,"body":"Authority has done on moving towards"},{"startTime":2352.477,"endTime":2357.067,"body":"doing a lot of the riskiest stuff"},{"startTime":2357.097,"endTime":2359.617,"body":"in, a memory safe language like Rust."},{"startTime":2360.007,"endTime":2363.787,"body":"But like you, just, the"},{"startTime":2360.007,"endTime":2363.787,"body":"two of you and your project"},{"startTime":2363.787,"endTime":2366.877,"body":"did it a ton of stuff on"},{"startTime":2363.787,"endTime":2366.877,"body":"your own, and we're not,"},{"startTime":2367.577,"endTime":2369.797,"body":"it's 20, it's 2025 at this"},{"startTime":2370.082,"endTime":2370.502,"body":"it's"},{"startTime":2370.697,"endTime":2372.587,"body":"All, all of it's 20."},{"startTime":2372.587,"endTime":2374.327,"body":"I'm sorry, it's 2026."},{"startTime":2375.027,"endTime":2376.392,"body":"It's 2026."},{"startTime":2376.782,"endTime":2379.692,"body":"It's like the most scrutinized"},{"startTime":2376.782,"endTime":2379.692,"body":"C code on the planet."},{"startTime":2380.112,"endTime":2382.902,"body":"All of like the low hanging fruit,"},{"startTime":2380.112,"endTime":2382.902,"body":"memory, corruption, and open."},{"startTime":2383.412,"endTime":2385.152,"body":"An OpenSSL gone now, right?"},{"startTime":2385.152,"endTime":2386.412,"body":"Like how likely"},{"startTime":2386.412,"endTime":2387.342,"body":"one today,"},{"startTime":2387.492,"endTime":2388.752,"body":"so I was gonna say, like we, we were"},{"startTime":2388.842,"endTime":2389.322,"body":"literally"},{"startTime":2389.412,"endTime":2389.762,"body":"today."},{"startTime":2389.892,"endTime":2390.372,"body":"we were, or"},{"startTime":2390.897,"endTime":2392.337,"body":"Tuesday the 27th."},{"startTime":2392.637,"endTime":2396.762,"body":"We were originally scheduled to record"},{"startTime":2392.637,"endTime":2396.762,"body":"this podcast yesterday, and if we had"},{"startTime":2396.822,"endTime":2399.912,"body":"recorded this podcast yesterday, we"},{"startTime":2396.822,"endTime":2399.912,"body":"would not have been able to discuss it."},{"startTime":2399.912,"endTime":2403.242,"body":"There were several pieces of"},{"startTime":2399.912,"endTime":2403.242,"body":"memory corruption in OpenSSL"},{"startTime":2403.242,"endTime":2404.322,"body":"that were disclosed today."},{"startTime":2404.472,"endTime":2405.132,"body":"And like"},{"startTime":2405.202,"endTime":2405.622,"body":"Goodie"},{"startTime":2406.242,"endTime":2408.677,"body":"If we had recorded yesterday, I"},{"startTime":2406.242,"endTime":2408.677,"body":"would've had you with that argument."},{"startTime":2409.377,"endTime":2409.497,"body":"I."},{"startTime":2409.897,"endTime":2413.797,"body":"I'm kind of like with you, Thomas,"},{"startTime":2409.897,"endTime":2413.797,"body":"like adults understand how to"},{"startTime":2413.797,"endTime":2417.637,"body":"write small bits of C code without"},{"startTime":2413.797,"endTime":2417.637,"body":"like totally screwing it up."},{"startTime":2417.907,"endTime":2421.507,"body":"Part of that is having the judgment"},{"startTime":2417.907,"endTime":2421.507,"body":"to not write large bits of c code,"},{"startTime":2422.207,"endTime":2425.277,"body":"parsers for like length, type value."},{"startTime":2425.727,"endTime":2430.067,"body":"And, you know, deterministically"},{"startTime":2425.727,"endTime":2430.067,"body":"bites in, bites out functions."},{"startTime":2430.067,"endTime":2435.297,"body":"Like we should be able to write in"},{"startTime":2430.067,"endTime":2435.297,"body":"Rust or, or excuse me, in assembly"},{"startTime":2435.297,"endTime":2437.967,"body":"in sea without making huge mistakes."},{"startTime":2438.112,"endTime":2438.352,"body":"So,"},{"startTime":2438.412,"endTime":2442.312,"body":"the people that are working on OpenSSL"},{"startTime":2438.412,"endTime":2442.312,"body":"don't seem to be able to do this."},{"startTime":2442.642,"endTime":2445.402,"body":"Many people exist who are"},{"startTime":2442.642,"endTime":2445.402,"body":"capable of doing this."},{"startTime":2445.642,"endTime":2447.622,"body":"Many of them have been"},{"startTime":2445.642,"endTime":2447.622,"body":"guests on this podcast."},{"startTime":2447.922,"endTime":2448.037,"body":"Huh."},{"startTime":2448.252,"endTime":2450.112,"body":"So I I, I'll agree partially with that."},{"startTime":2450.112,"endTime":2453.922,"body":"Like f folks who are familiar with my"},{"startTime":2450.112,"endTime":2453.922,"body":"work know that, like I talk a lot about"},{"startTime":2453.922,"endTime":2458.632,"body":"memory safety as a language level concern"},{"startTime":2453.922,"endTime":2458.632,"body":"and about how in the long term we need to"},{"startTime":2458.632,"endTime":2462.802,"body":"be looking at CNC plus plus replacements"},{"startTime":2458.632,"endTime":2462.802,"body":"or, or to the extent the CNC plus plus"},{"startTime":2462.802,"endTime":2466.252,"body":"standards committees have any openness"},{"startTime":2462.802,"endTime":2466.252,"body":"to make their languages memory safe."},{"startTime":2466.522,"endTime":2470.572,"body":"But it is absolutely true that"},{"startTime":2466.522,"endTime":2470.572,"body":"you can write small, where small"},{"startTime":2470.572,"endTime":2474.532,"body":"is like probably less than a few"},{"startTime":2470.572,"endTime":2474.532,"body":"thousand lines of like c code for"},{"startTime":2474.532,"endTime":2478.282,"body":"well-defined tasks that don't change"},{"startTime":2474.532,"endTime":2478.282,"body":"very often and maintain memory safety."},{"startTime":2478.402,"endTime":2482.302,"body":"Like that's, that's like an observable"},{"startTime":2478.402,"endTime":2482.302,"body":"fact that like boring SSL is a code base"},{"startTime":2482.302,"endTime":2485.902,"body":"like this that has like a very low rate of"},{"startTime":2482.302,"endTime":2485.902,"body":"vulnerabilities because it's maintainers"},{"startTime":2485.902,"endTime":2488.122,"body":"are like very diligent maintainers."},{"startTime":2488.212,"endTime":2489.562,"body":"They take testing seriously."},{"startTime":2489.712,"endTime":2491.842,"body":"They just like think hard about"},{"startTime":2489.712,"endTime":2491.842,"body":"the changes they're making."},{"startTime":2492.472,"endTime":2499.762,"body":"But it is also just true that complexity"},{"startTime":2492.472,"endTime":2499.762,"body":"and velocity are real world phenomena"},{"startTime":2500.092,"endTime":2504.512,"body":"and, Part of how BoringSSL is able to be"},{"startTime":2500.092,"endTime":2504.512,"body":"that diligent is by having a very narrow"},{"startTime":2504.512,"endTime":2507.902,"body":"scope that is like roughly the set of"},{"startTime":2504.512,"endTime":2507.902,"body":"things Google exclusively cares about."},{"startTime":2508.082,"endTime":2511.532,"body":"And open cell does intend to"},{"startTime":2508.082,"endTime":2511.532,"body":"cater to a larger audience."},{"startTime":2511.532,"endTime":2513.842,"body":"It has more features,"},{"startTime":2511.532,"endTime":2513.842,"body":"supports more functionality."},{"startTime":2513.842,"endTime":2515.912,"body":"And that's like reasonable"},{"startTime":2513.842,"endTime":2515.912,"body":"and like very useful."},{"startTime":2516.092,"endTime":2519.572,"body":"Like when we compare the set of"},{"startTime":2516.092,"endTime":2519.572,"body":"features, open cell has that boring, a"},{"startTime":2519.572,"endTime":2522.722,"body":"cell does not, like, there are things"},{"startTime":2519.572,"endTime":2522.722,"body":"missing that we would like, for example."},{"startTime":2522.962,"endTime":2525.992,"body":"so like complexity and velocity"},{"startTime":2522.962,"endTime":2525.992,"body":"are real world phenomena."},{"startTime":2526.232,"endTime":2527.792,"body":"Scope is a real world phenomena."},{"startTime":2527.852,"endTime":2532.292,"body":"And so you need approaches to security"},{"startTime":2527.852,"endTime":2532.292,"body":"that are responsive to the real world,"},{"startTime":2532.322,"endTime":2534.002,"body":"to those real world constraints."},{"startTime":2534.122,"endTime":2537.812,"body":"And so, we think you just have to"},{"startTime":2534.122,"endTime":2537.812,"body":"have a design approach and like a"},{"startTime":2537.812,"endTime":2542.702,"body":"memory, safe programming language is"},{"startTime":2537.812,"endTime":2542.702,"body":"by far the strongest one to not have"},{"startTime":2542.702,"endTime":2544.202,"body":"certain classes of vulnerabilities."},{"startTime":2544.202,"endTime":2547.742,"body":"Like formal verification is another"},{"startTime":2544.202,"endTime":2547.742,"body":"thing from that bucket for like right."},{"startTime":2547.742,"endTime":2550.112,"body":"How do you write certain"},{"startTime":2547.742,"endTime":2550.112,"body":"types of programs?"},{"startTime":2550.382,"endTime":2551.902,"body":"Very, very safely."},{"startTime":2552.602,"endTime":2556.382,"body":"I wanna, I wanna talk a little bit"},{"startTime":2552.602,"endTime":2556.382,"body":"more about how you guys are SSL"},{"startTime":2556.382,"endTime":2560.502,"body":"of Theseus-ying, the, uh, OpenSSL"},{"startTime":2556.382,"endTime":2560.502,"body":"library with your own Rust code."},{"startTime":2560.682,"endTime":2565.482,"body":"But before we do that, like, the thing"},{"startTime":2560.682,"endTime":2565.482,"body":"today was if you give open LAP seven"},{"startTime":2565.482,"endTime":2569.622,"body":"file that, um, is encrypted with an"},{"startTime":2565.482,"endTime":2569.622,"body":"A 80 cipher is encrypted with GCM or"},{"startTime":2569.622,"endTime":2574.482,"body":"whatever the EVP code, the high level"},{"startTime":2569.622,"endTime":2574.482,"body":"OpenSSL library when it goes and tries"},{"startTime":2574.482,"endTime":2579.832,"body":"to parse the P seven file and like"},{"startTime":2574.482,"endTime":2579.832,"body":"pull the nons out of the it's DERight?"},{"startTime":2579.852,"endTime":2581.412,"body":"Or it's BER, is it BER or DER in P"},{"startTime":2581.412,"endTime":2581.697,"body":"seven."},{"startTime":2581.997,"endTime":2582.807,"body":"It can be either."},{"startTime":2583.507,"endTime":2583.987,"body":"Wonderful."},{"startTime":2584.107,"endTime":2584.467,"body":"Okay."},{"startTime":2584.617,"endTime":2587.797,"body":"When it goes to, when it goes to"},{"startTime":2584.617,"endTime":2587.797,"body":"pull out the, the, you know, the,"},{"startTime":2587.797,"endTime":2589.777,"body":"the nons slot of the goo right."},{"startTime":2589.897,"endTime":2593.062,"body":"it, it, it spills that goo"},{"startTime":2589.897,"endTime":2593.062,"body":"all over the stack, right?"},{"startTime":2593.092,"endTime":2596.852,"body":"So, like, I guess the, the first"},{"startTime":2593.092,"endTime":2596.852,"body":"question I have is, does that, we"},{"startTime":2596.852,"endTime":2599.462,"body":"were, we were talking about this"},{"startTime":2596.852,"endTime":2599.462,"body":"earlier, but I'm still wondering if"},{"startTime":2599.462,"endTime":2600.902,"body":"this does or does not hit you guys."},{"startTime":2601.602,"endTime":2602.522,"body":"this doesn't hit us."},{"startTime":2602.782,"endTime":2604.932,"body":"while we do have, some, uh."},{"startTime":2605.467,"endTime":2609.377,"body":"Pkcs, seven APIs that do still use"},{"startTime":2605.467,"endTime":2609.377,"body":"OpenSSL for parsing, for reasons we"},{"startTime":2609.377,"endTime":2615.282,"body":"can talk about our pkcs, decryption"},{"startTime":2609.377,"endTime":2615.282,"body":"APIs use our own, Rust, DER library."},{"startTime":2615.552,"endTime":2618.222,"body":"And it's a, you know,"},{"startTime":2615.552,"endTime":2618.222,"body":"totally memory safe parsing."},{"startTime":2619.102,"endTime":2622.832,"body":"are like, this is a little, this"},{"startTime":2619.102,"endTime":2622.832,"body":"is a little off topic, but like"},{"startTime":2622.982,"endTime":2625.742,"body":"for somebody who's asking what"},{"startTime":2622.982,"endTime":2625.742,"body":"the attack surface is for P seven"},{"startTime":2625.742,"endTime":2626.942,"body":"files, what does that look like?"},{"startTime":2627.292,"endTime":2630.952,"body":"so Pkcs seven is like a pretty"},{"startTime":2627.292,"endTime":2630.952,"body":"widely used container format, like"},{"startTime":2630.952,"endTime":2633.682,"body":"it pops up in all sorts of places."},{"startTime":2633.682,"endTime":2635.542,"body":"Like Mime is A-P-K-C-S."},{"startTime":2635.542,"endTime":2638.572,"body":"So like, if you're doing like,"},{"startTime":2635.542,"endTime":2638.572,"body":"encrypted email, like not pg, not"},{"startTime":2638.572,"endTime":2642.482,"body":"like pg p, but like, you know what,"},{"startTime":2638.572,"endTime":2642.482,"body":"like what, what Microsoft Exchange"},{"startTime":2642.482,"endTime":2646.232,"body":"will like, encrypt your emails with,"},{"startTime":2642.482,"endTime":2646.232,"body":"like, that's a PKC S seven format."},{"startTime":2646.812,"endTime":2651.942,"body":"I think Microsoft's like code signing"},{"startTime":2646.812,"endTime":2651.942,"body":"format does it, like it pops up in"},{"startTime":2651.942,"endTime":2653.172,"body":"all sorts of like places like this."},{"startTime":2653.172,"endTime":2656.292,"body":"Like if the thing you were shipping is"},{"startTime":2653.172,"endTime":2656.292,"body":"like roughly a signature and encrypted"},{"startTime":2656.292,"endTime":2658.482,"body":"blob and like some metadata and like."},{"startTime":2659.037,"endTime":2661.707,"body":"Particularly if it's like maybe a"},{"startTime":2659.037,"endTime":2661.707,"body":"slightly older standard, like I, I"},{"startTime":2661.707,"endTime":2665.607,"body":"think modern es, modern cryptographic"},{"startTime":2661.707,"endTime":2665.607,"body":"aesthetics or like container formats"},{"startTime":2665.607,"endTime":2666.957,"body":"like this are not particularly useful."},{"startTime":2666.957,"endTime":2670.167,"body":"But like in, in older things"},{"startTime":2666.957,"endTime":2670.167,"body":"they were like super common."},{"startTime":2670.782,"endTime":2671.712,"body":"Yeah, it's actually, uh."},{"startTime":2672.202,"endTime":2676.882,"body":"I forget what the underlying weird"},{"startTime":2672.202,"endTime":2676.882,"body":"name for the like, uh, standard is,"},{"startTime":2676.882,"endTime":2681.982,"body":"but Apple Pay also actually uses Pkcs"},{"startTime":2676.882,"endTime":2681.982,"body":"seven signatures, uh, in the backend."},{"startTime":2682.682,"endTime":2683.267,"body":"But not with"},{"startTime":2688.637,"endTime":2698.147,"body":"OpenSSLI."},{"startTime":2699.287,"endTime":2702.017,"body":"I looked, I looked today, and"},{"startTime":2699.287,"endTime":2702.017,"body":"Libra SSL didn't have the bug."},{"startTime":2702.017,"endTime":2705.617,"body":"Libra ss l in the code where they"},{"startTime":2702.017,"endTime":2705.617,"body":"pull the, the, the non Sout, is"},{"startTime":2705.617,"endTime":2706.877,"body":"doing an explicit length check."},{"startTime":2706.907,"endTime":2708.347,"body":"Does boring SSL have the bug?"},{"startTime":2708.887,"endTime":2708.977,"body":"I"},{"startTime":2709.047,"endTime":2709.557,"body":"believe so."},{"startTime":2709.557,"endTime":2709.857,"body":"No."},{"startTime":2709.857,"endTime":2713.132,"body":"I, I. Pretty so BoringSSL"},{"startTime":2709.857,"endTime":2713.132,"body":"actually published today."},{"startTime":2713.132,"endTime":2717.902,"body":"A whole bunch of like notes from past"},{"startTime":2713.132,"endTime":2717.902,"body":"OpenSSL, vulnerabilities on, you know,"},{"startTime":2717.932,"endTime":2719.042,"body":"what, whether they were infected."},{"startTime":2719.042,"endTime":2721.412,"body":"Like what, what customers"},{"startTime":2719.042,"endTime":2721.412,"body":"of BoringSSL need to know."},{"startTime":2721.742,"endTime":2725.282,"body":"And I'm almost positive that this is"},{"startTime":2721.742,"endTime":2725.282,"body":"one of the ones that marked like this"},{"startTime":2725.282,"endTime":2727.022,"body":"bug was introduced after we forked"},{"startTime":2727.617,"endTime":2728.037,"body":"Mm-hmm."},{"startTime":2728.737,"endTime":2728.947,"body":"Okay."},{"startTime":2729.647,"endTime":2729.782,"body":"Ah,"},{"startTime":2729.917,"endTime":2732.077,"body":"So like, you guys missed this bug."},{"startTime":2732.332,"endTime":2736.967,"body":"You, you missed out on all the fun"},{"startTime":2732.332,"endTime":2736.967,"body":"because you rewrote part of OpenSSL"},{"startTime":2737.197,"endTime":2738.752,"body":"I wouldn't say they're missing it,"},{"startTime":2738.872,"endTime":2742.842,"body":"Yeah, we, we missed this bug there,"},{"startTime":2738.872,"endTime":2742.842,"body":"there were a handful of other bugs, in"},{"startTime":2742.842,"endTime":2746.052,"body":"today's release that, that did impact us."},{"startTime":2746.152,"endTime":2748.607,"body":"I, I'd have to go back and like,"},{"startTime":2746.152,"endTime":2748.607,"body":"look, look at the full list"},{"startTime":2748.607,"endTime":2749.907,"body":"to tell you which ones, but"},{"startTime":2750.362,"endTime":2753.092,"body":"How, how much of OpenSSL are"},{"startTime":2750.362,"endTime":2753.092,"body":"you guys gonna rewrite in Rust?"},{"startTime":2753.557,"endTime":2753.792,"body":"Hmm."},{"startTime":2753.792,"endTime":2757.122,"body":"Anything that's not cryptographic"},{"startTime":2753.792,"endTime":2757.122,"body":"crypto cryptography itself."},{"startTime":2757.152,"endTime":2758.382,"body":"The core crypto like"},{"startTime":2758.412,"endTime":2758.952,"body":"routines are"},{"startTime":2759.102,"endTime":2759.402,"body":"that"},{"startTime":2759.402,"endTime":2759.642,"body":"one"},{"startTime":2759.642,"endTime":2762.912,"body":"before we opened with how that's false."},{"startTime":2763.302,"endTime":2763.632,"body":"Yeah."},{"startTime":2763.662,"endTime":2766.852,"body":"so like, we're, the things I"},{"startTime":2763.662,"endTime":2766.852,"body":"would say is like, we will do"},{"startTime":2766.852,"endTime":2769.552,"body":"anything that is like parsing that."},{"startTime":2769.552,"endTime":2772.642,"body":"It, it's, you know, serialization,"},{"startTime":2769.552,"endTime":2772.642,"body":"deserialization that is like"},{"startTime":2772.792,"endTime":2776.752,"body":"orchestrating cryptography, like"},{"startTime":2772.792,"endTime":2776.752,"body":"kind of the HPKE that we mentioned."},{"startTime":2777.142,"endTime":2777.502,"body":"But"},{"startTime":2777.772,"endTime":2778.642,"body":"encodings."},{"startTime":2779.032,"endTime":2782.662,"body":"yeah, we're pretty close"},{"startTime":2779.032,"endTime":2782.662,"body":"to saturated on this stuff."},{"startTime":2782.662,"endTime":2787.222,"body":"Like almost all parsing at this"},{"startTime":2782.662,"endTime":2787.222,"body":"point, whether it's, you know, public"},{"startTime":2787.222,"endTime":2790.882,"body":"keys, private keys, whether it's"},{"startTime":2787.222,"endTime":2790.882,"body":"like X.509 certificates and CRLs,"},{"startTime":2791.077,"endTime":2792.832,"body":"all, all of that stuff is in Rust."},{"startTime":2793.112,"endTime":2793.622,"body":"Yeah, I think the"},{"startTime":2793.712,"endTime":2794.192,"body":"5 0 9"},{"startTime":2794.312,"endTime":2794.702,"body":"path"},{"startTime":2794.732,"endTime":2795.212,"body":"building."},{"startTime":2795.692,"endTime":2796.112,"body":"Yeah."},{"startTime":2796.532,"endTime":2799.022,"body":"the only exception to this point is"},{"startTime":2796.532,"endTime":2799.022,"body":"actually what Alex alluded to earlier,"},{"startTime":2799.022,"endTime":2804.102,"body":"which is that because, p Pkcs seven"},{"startTime":2799.022,"endTime":2804.102,"body":"does support BER in addition to DER"},{"startTime":2804.432,"endTime":2808.542,"body":"we do have in one code path a fallback"},{"startTime":2804.432,"endTime":2808.542,"body":"where if we can't parse it using our DER"},{"startTime":2808.542,"endTime":2812.492,"body":"parser, we hand it to OpenSSL because"},{"startTime":2808.542,"endTime":2812.492,"body":"we have not implemented BER and Rust."},{"startTime":2813.192,"endTime":2813.882,"body":"For, for and for"},{"startTime":2813.942,"endTime":2814.557,"body":"but you're going to."},{"startTime":2815.257,"endTime":2816.612,"body":"no, we probably won't for, for those"},{"startTime":2816.912,"endTime":2817.152,"body":"Yeah."},{"startTime":2817.152,"endTime":2820.302,"body":"For those who are in this like alphabet"},{"startTime":2817.152,"endTime":2820.302,"body":"soup of like BER and DER just as like"},{"startTime":2820.302,"endTime":2825.312,"body":"causing their eyes to glaze over, they're,"},{"startTime":2820.302,"endTime":2825.312,"body":"the, the really short version is BER and"},{"startTime":2825.312,"endTime":2830.072,"body":"DER are two different ways of serializing,"},{"startTime":2825.312,"endTime":2830.072,"body":"kind of the same as n one data."},{"startTime":2830.382,"endTime":2834.402,"body":"And DER is a subset of BER that"},{"startTime":2830.382,"endTime":2834.402,"body":"like basically takes away all"},{"startTime":2834.402,"endTime":2836.052,"body":"of the flexibility that BER has."},{"startTime":2836.052,"endTime":2840.432,"body":"Like BER will let you do kind of like very"},{"startTime":2836.052,"endTime":2840.432,"body":"bizarre things that makes it like much"},{"startTime":2840.432,"endTime":2844.332,"body":"more complicated to parse and like, we"},{"startTime":2840.432,"endTime":2844.332,"body":"basically decided like BER is a bad idea"},{"startTime":2844.332,"endTime":2846.132,"body":"for all modern cryptographic standards"},{"startTime":2846.192,"endTime":2846.422,"body":"and"},{"startTime":2846.422,"endTime":2849.822,"body":"like DER is just like a mu"},{"startTime":2846.422,"endTime":2849.822,"body":"much more compact from a,"},{"startTime":2849.882,"endTime":2852.192,"body":"like a surface perspective."},{"startTime":2852.192,"endTime":2856.032,"body":"So like we, we restrict ourselves to"},{"startTime":2852.192,"endTime":2856.032,"body":"DR and like, that's the only thing you"},{"startTime":2856.032,"endTime":2860.452,"body":"need to care about for things like X.509"},{"startTime":2856.032,"endTime":2860.452,"body":"certificates, kind of standards that are"},{"startTime":2861.112,"endTime":2865.702,"body":"less well tended than X.509 is, maybe"},{"startTime":2861.112,"endTime":2865.702,"body":"I'll say it like PKCS seven still have"},{"startTime":2865.702,"endTime":2867.902,"body":"a lot of BER in their ecosystems, and."},{"startTime":2868.337,"endTime":2871.937,"body":"And when we refuse to support BER, and"},{"startTime":2868.337,"endTime":2871.937,"body":"so we'll use OpenSSL in the places we"},{"startTime":2871.937,"endTime":2873.697,"body":"have a compatibility need to parse BER."},{"startTime":2874.467,"endTime":2874.587,"body":"So"},{"startTime":2874.677,"endTime":2876.357,"body":"has that, how has that gone for you guys?"},{"startTime":2876.357,"endTime":2880.017,"body":"How has that I, I'm, I keep stepping on"},{"startTime":2876.357,"endTime":2880.017,"body":"Deirdre and I'm sorry, but I, I, I want"},{"startTime":2880.017,"endTime":2883.527,"body":"to hear, like, I, I want to hear the"},{"startTime":2880.017,"endTime":2883.527,"body":"story about how it's gone taking PICA"},{"startTime":2883.527,"endTime":2886.227,"body":"cryptography and making it a Rust project."},{"startTime":2886.927,"endTime":2887.737,"body":"I think it's gone."},{"startTime":2887.752,"endTime":2889.597,"body":"that's like a whole"},{"startTime":2887.752,"endTime":2889.597,"body":"podcast of its own, but."},{"startTime":2889.602,"endTime":2889.892,"body":"yeah."},{"startTime":2889.897,"endTime":2890.377,"body":"Yeah."},{"startTime":2890.552,"endTime":2891.097,"body":"And, and"},{"startTime":2891.142,"endTime":2893.992,"body":"So it was, it was complicated"},{"startTime":2891.142,"endTime":2893.992,"body":"and dramatic, and not a great"},{"startTime":2893.992,"endTime":2894.997,"body":"experience is what I'm hearing."},{"startTime":2895.357,"endTime":2896.407,"body":"No, no."},{"startTime":2896.407,"endTime":2900.077,"body":"I mean, so we, we gave a talk at, about"},{"startTime":2896.407,"endTime":2900.077,"body":"this at Pycon a couple of years ago that"},{"startTime":2900.077,"endTime":2904.097,"body":"really focuses on like the initial release"},{"startTime":2900.077,"endTime":2904.097,"body":"and like what that migration looks like."},{"startTime":2904.457,"endTime":2907.217,"body":"but and, and to be clear, there,"},{"startTime":2904.457,"endTime":2907.217,"body":"there were challenges and some"},{"startTime":2907.217,"endTime":2909.517,"body":"drama early on where like, we, we,"},{"startTime":2909.647,"endTime":2912.082,"body":"is early on, like how"},{"startTime":2909.647,"endTime":2912.082,"body":"many years ago was this?"},{"startTime":2912.607,"endTime":2914.707,"body":"2022, I wanna say"},{"startTime":2915.007,"endTime":2916.117,"body":"not that long ago."},{"startTime":2916.117,"endTime":2916.127,"body":"Oh."},{"startTime":2916.427,"endTime":2917.317,"body":"2021."},{"startTime":2917.467,"endTime":2918.367,"body":"No, it's 2021."},{"startTime":2918.367,"endTime":2919.117,"body":"Alex, I'm, I'm"},{"startTime":2919.117,"endTime":2919.417,"body":"Okay."},{"startTime":2919.417,"endTime":2919.957,"body":"20. Yeah."},{"startTime":2919.987,"endTime":2921.877,"body":"It's like February, 2021."},{"startTime":2922.267,"endTime":2922.507,"body":"Yeah."},{"startTime":2922.507,"endTime":2922.687,"body":"Yeah."},{"startTime":2922.687,"endTime":2925.087,"body":"February, 2021, we do our initial release."},{"startTime":2925.237,"endTime":2926.917,"body":"So it's like five years ago now."},{"startTime":2927.187,"endTime":2929.047,"body":"and the initial release"},{"startTime":2927.187,"endTime":2929.047,"body":"has some, has some drama."},{"startTime":2929.047,"endTime":2932.977,"body":"Like we, we were pretty aggressive in"},{"startTime":2929.047,"endTime":2932.977,"body":"like pushing Rust into the ecosystem."},{"startTime":2933.217,"endTime":2937.447,"body":"Users who were getting not getting"},{"startTime":2933.217,"endTime":2937.447,"body":"wheels, they had to compile themselves,"},{"startTime":2937.447,"endTime":2940.967,"body":"like were, and if they weren't per"},{"startTime":2937.447,"endTime":2940.967,"body":"pinning their versions, like they"},{"startTime":2940.967,"endTime":2945.567,"body":"woke up one morning and were like,"},{"startTime":2940.967,"endTime":2945.567,"body":"why is my, Ansible CI pipeline failing"},{"startTime":2945.567,"endTime":2947.157,"body":"with like no Rust sea on my path?"},{"startTime":2947.397,"endTime":2948.567,"body":"Like, what is this garbage?"},{"startTime":2948.847,"endTime":2952.967,"body":"but like we have with lots of help"},{"startTime":2948.847,"endTime":2952.967,"body":"from like other folks in the community,"},{"startTime":2953.177,"endTime":2954.497,"body":"we have like pushed past that."},{"startTime":2954.497,"endTime":2957.797,"body":"Like we now we ship wheels for"},{"startTime":2954.497,"endTime":2957.797,"body":"a great many platforms like"},{"startTime":2958.007,"endTime":2959.387,"body":"that is no longer a problem."},{"startTime":2959.657,"endTime":2961.907,"body":"And so like I, you know, I think"},{"startTime":2959.657,"endTime":2961.907,"body":"your question is mostly about like,"},{"startTime":2962.087,"endTime":2964.757,"body":"how has migrating our own code been?"},{"startTime":2964.757,"endTime":2966.347,"body":"And like, I think it's pretty."},{"startTime":2966.752,"endTime":2969.002,"body":"Much just been like an"},{"startTime":2966.752,"endTime":2969.002,"body":"across the board win."},{"startTime":2969.272,"endTime":2972.662,"body":"We have much better performance"},{"startTime":2969.272,"endTime":2972.662,"body":"on like all of our parsing APIs."},{"startTime":2972.662,"endTime":2974.672,"body":"As we kind of alluded to earlier."},{"startTime":2974.792,"endTime":2978.242,"body":"We have a much clearer"},{"startTime":2974.792,"endTime":2978.242,"body":"compatibility surface."},{"startTime":2978.242,"endTime":2981.812,"body":"Like, because we own the parsing,"},{"startTime":2978.242,"endTime":2981.812,"body":"we understand exactly what are the"},{"startTime":2981.812,"endTime":2986.552,"body":"places we're being lax because like,"},{"startTime":2981.812,"endTime":2986.552,"body":"you know, the, the specification is"},{"startTime":2986.552,"endTime":2990.542,"body":"like kind of in an ht ML style, like"},{"startTime":2986.552,"endTime":2990.542,"body":"diverged from like common practice."},{"startTime":2990.632,"endTime":2992.192,"body":"And we know where we're being strict."},{"startTime":2992.552,"endTime":2997.142,"body":"we have a much, just much clearer,"},{"startTime":2992.552,"endTime":2997.142,"body":"abstraction layers between things."},{"startTime":2997.142,"endTime":2999.512,"body":"So like, I'll give you a concrete example"},{"startTime":2997.142,"endTime":2999.512,"body":"of, I think that's just like better."},{"startTime":2999.782,"endTime":3003.382,"body":"so we used to, we, we have a bunch"},{"startTime":2999.782,"endTime":3003.382,"body":"of Acts 5 0 9, like certificate APIs."},{"startTime":3003.872,"endTime":3007.332,"body":"we used to implement those"},{"startTime":3003.872,"endTime":3007.332,"body":"on top of OpenSSL X.509."},{"startTime":3007.392,"endTime":3008.022,"body":"APIs."},{"startTime":3008.172,"endTime":3012.222,"body":"And so when you did something like"},{"startTime":3008.172,"endTime":3012.222,"body":"sign an X.509 certificate, right?"},{"startTime":3012.432,"endTime":3015.322,"body":"Creating a new X five nine certificate"},{"startTime":3012.432,"endTime":3015.322,"body":"and you do a signature, and you'd"},{"startTime":3015.322,"endTime":3019.102,"body":"pass in a private key to like do that"},{"startTime":3015.322,"endTime":3019.102,"body":"signature, but actually that private"},{"startTime":3019.102,"endTime":3021.622,"body":"key had to be an OpenSSL private key."},{"startTime":3021.832,"endTime":3025.522,"body":"Like we, we nominally had these like"},{"startTime":3021.832,"endTime":3025.522,"body":"abstract APIs that like you could"},{"startTime":3025.522,"endTime":3028.762,"body":"implement, for a private key, but like"},{"startTime":3025.522,"endTime":3028.762,"body":"if you didn't pass an OpenSSL private"},{"startTime":3028.762,"endTime":3032.422,"body":"key, we didn't have a private key to"},{"startTime":3028.762,"endTime":3032.422,"body":"pass to the OpenSSL signature API."},{"startTime":3032.662,"endTime":3035.362,"body":"So like there's this real like"},{"startTime":3032.662,"endTime":3035.362,"body":"abstraction failure and it's,"},{"startTime":3035.392,"endTime":3036.502,"body":"it's not an uncommon one."},{"startTime":3036.502,"endTime":3038.902,"body":"Like you, you see this in a bunch"},{"startTime":3036.502,"endTime":3038.902,"body":"of things that like try to do,"},{"startTime":3039.262,"endTime":3040.162,"body":"abstraction layers like this."},{"startTime":3040.162,"endTime":3043.312,"body":"Like I believe the Java crypto APIs"},{"startTime":3040.162,"endTime":3043.312,"body":"have like a whole bunch of like fast"},{"startTime":3043.312,"endTime":3047.252,"body":"paths and slow paths depending on what"},{"startTime":3043.312,"endTime":3047.252,"body":"kind of, pri private key you've got."},{"startTime":3047.402,"endTime":3050.012,"body":"But now that we own X five"},{"startTime":3047.402,"endTime":3050.012,"body":"nine parsing top to bottom."},{"startTime":3050.597,"endTime":3055.037,"body":"What happens when you try to do a, a"},{"startTime":3050.597,"endTime":3055.037,"body":"sign a new certificate is that we use the"},{"startTime":3055.037,"endTime":3059.777,"body":"public sign, API and like any private key"},{"startTime":3055.037,"endTime":3059.777,"body":"you've got, whether it's one of the ones"},{"startTime":3059.777,"endTime":3065.287,"body":"we provide or you have like a third party"},{"startTime":3059.777,"endTime":3065.287,"body":"implementation of, of our private key APIs"},{"startTime":3065.527,"endTime":3070.177,"body":"that uses that, I don't know, talks like"},{"startTime":3065.527,"endTime":3070.177,"body":"A-W-S-K-M-S for example, or GCP or like"},{"startTime":3070.177,"endTime":3072.157,"body":"any, any cloud providers key management."},{"startTime":3072.247,"endTime":3073.327,"body":"Now that just works."},{"startTime":3073.417,"endTime":3076.507,"body":"So like we have a much"},{"startTime":3073.417,"endTime":3076.507,"body":"cleaner compatibility surface."},{"startTime":3076.627,"endTime":3080.827,"body":"We have much more coherent story"},{"startTime":3076.627,"endTime":3080.827,"body":"for things like third party keys."},{"startTime":3080.857,"endTime":3084.467,"body":"Like, it's just like, like I don't"},{"startTime":3080.857,"endTime":3084.467,"body":"have any bad to say about the migration"},{"startTime":3084.647,"endTime":3088.797,"body":"besides like the initial like stumbling"},{"startTime":3084.647,"endTime":3088.797,"body":"with like, the kind of pain of lots"},{"startTime":3088.797,"endTime":3090.207,"body":"of people having it to adopt to Rust."},{"startTime":3090.207,"endTime":3092.697,"body":"But Paul, I don't know if you have"},{"startTime":3090.207,"endTime":3092.697,"body":"like a different reflection on this."},{"startTime":3093.397,"endTime":3097.207,"body":"Yeah, I mean, I, I think I generally"},{"startTime":3093.397,"endTime":3097.207,"body":"agree like pa past the initial teething,"},{"startTime":3097.207,"endTime":3100.627,"body":"like one of the components of that, that"},{"startTime":3097.207,"endTime":3100.627,"body":"entire project is Alex and I decided that."},{"startTime":3101.327,"endTime":3103.217,"body":"This was worth the breakage budget."},{"startTime":3103.247,"endTime":3105.437,"body":"We knew our position in the"},{"startTime":3103.247,"endTime":3105.437,"body":"ecosystem was important."},{"startTime":3105.437,"endTime":3109.187,"body":"We knew that it was going to cause"},{"startTime":3105.437,"endTime":3109.187,"body":"us, us pain as well as some user pain."},{"startTime":3109.397,"endTime":3113.057,"body":"But we wanted to, you know, both"},{"startTime":3109.397,"endTime":3113.057,"body":"manage, manage our, uh, manage our"},{"startTime":3113.057,"endTime":3116.867,"body":"long-term pain as maintainers and"},{"startTime":3113.057,"endTime":3116.867,"body":"also drive down the pain for the"},{"startTime":3116.867,"endTime":3118.697,"body":"adopters as quickly as possible."},{"startTime":3118.877,"endTime":3121.877,"body":"So we were able to work across"},{"startTime":3118.877,"endTime":3121.877,"body":"the ecosystem, basically blaze the"},{"startTime":3121.877,"endTime":3125.327,"body":"trail, such that like future Rust,"},{"startTime":3121.877,"endTime":3125.327,"body":"Python projects have effectively"},{"startTime":3125.327,"endTime":3127.007,"body":"the ability to deploy with no fear."},{"startTime":3127.037,"endTime":3130.007,"body":"Where we, five years ago,"},{"startTime":3127.037,"endTime":3130.007,"body":"obviously had a lot of work to do."},{"startTime":3130.547,"endTime":3132.767,"body":"on the actual Rust development"},{"startTime":3130.547,"endTime":3132.767,"body":"side, I would say that like."},{"startTime":3133.457,"endTime":3137.397,"body":"The only piece of pain that we've"},{"startTime":3133.457,"endTime":3137.397,"body":"really experienced, I'm not, not"},{"startTime":3137.397,"endTime":3140.787,"body":"even MSRV, although MSRV has its"},{"startTime":3137.397,"endTime":3140.787,"body":"own like that's minimum supported"},{"startTime":3140.787,"endTime":3143.997,"body":"Rust version for, for folks who"},{"startTime":3140.787,"endTime":3143.997,"body":"are not deep in the Rust ecosystem."},{"startTime":3144.387,"endTime":3147.207,"body":"Uh, there was some work there we had"},{"startTime":3144.387,"endTime":3147.207,"body":"to do, but like the only real thing"},{"startTime":3147.207,"endTime":3151.567,"body":"was that in our ci Rust compilation"},{"startTime":3147.207,"endTime":3151.567,"body":"is slower than what we had before."},{"startTime":3151.627,"endTime":3155.137,"body":"And so we ended up spending a lot of time"},{"startTime":3151.627,"endTime":3155.137,"body":"and energy looking at what it meant to"},{"startTime":3155.137,"endTime":3158.677,"body":"cache intermediate artifacts and make"},{"startTime":3155.137,"endTime":3158.677,"body":"sure the caches don't do bad things."},{"startTime":3158.707,"endTime":3161.317,"body":"'cause we had a few incidents"},{"startTime":3158.707,"endTime":3161.317,"body":"where our caches were pretty bad."},{"startTime":3161.737,"endTime":3164.107,"body":"but once we got past that,"},{"startTime":3161.737,"endTime":3164.107,"body":"we were in really good shape."},{"startTime":3164.227,"endTime":3167.177,"body":"And like, I, I mean, even right now"},{"startTime":3164.227,"endTime":3167.177,"body":"there's, there's a current, feature"},{"startTime":3167.177,"endTime":3172.997,"body":"Alex and I are working on where we were"},{"startTime":3167.177,"endTime":3172.997,"body":"unhappy with the Python APIs, uh, that"},{"startTime":3172.997,"endTime":3175.097,"body":"would allow us to express what we needed."},{"startTime":3175.187,"endTime":3178.427,"body":"And so we're likely to rewrite this"},{"startTime":3175.187,"endTime":3178.427,"body":"piece in Rust simply so we can have"},{"startTime":3178.427,"endTime":3180.077,"body":"the visibility control that we want."},{"startTime":3180.417,"endTime":3180.707,"body":"Yeah."},{"startTime":3180.742,"endTime":3184.517,"body":"Yeah, I, so like, I don't know if I"},{"startTime":3180.742,"endTime":3184.517,"body":"had to register a complaint, like my"},{"startTime":3184.547,"endTime":3189.587,"body":"number one complaint might be like, the"},{"startTime":3184.547,"endTime":3189.587,"body":"Rust coverage support is, not quite as"},{"startTime":3189.587,"endTime":3192.407,"body":"stable as like pythons coverage pie."},{"startTime":3192.677,"endTime":3196.547,"body":"Like, th this is like the level of like"},{"startTime":3192.677,"endTime":3196.547,"body":"complaint we have, you know, about five"},{"startTime":3196.547,"endTime":3198.462,"body":"years of like maintaining this Rust code."},{"startTime":3199.162,"endTime":3208.112,"body":"so you, you ate the pain of supporting"},{"startTime":3199.162,"endTime":3208.112,"body":"Rust in your extremely widely"},{"startTime":3208.112,"endTime":3212.102,"body":"supported, in terms of platforms, a"},{"startTime":3208.112,"endTime":3212.102,"body":"diversity of platforms where it is,"},{"startTime":3212.102,"endTime":3213.932,"body":"is used and it needs to be supported."},{"startTime":3214.142,"endTime":3219.062,"body":"Did you have to drop any platforms"},{"startTime":3214.142,"endTime":3219.062,"body":"that PI Crypto was supported on"},{"startTime":3219.062,"endTime":3220.982,"body":"in order to ship the Rust stuff?"},{"startTime":3221.387,"endTime":3225.167,"body":"We dropped no platforms we officially"},{"startTime":3221.387,"endTime":3225.167,"body":"supported is a good way to say that."},{"startTime":3225.417,"endTime":3228.427,"body":"one of the tricky bits of a migration"},{"startTime":3225.417,"endTime":3228.427,"body":"like this, and I'm sorry Alex, I'll, I'll"},{"startTime":3228.612,"endTime":3230.097,"body":"no, you we're gonna say the same thing."},{"startTime":3230.397,"endTime":3231.842,"body":"but yeah, one of the tricky bits about."},{"startTime":3232.542,"endTime":3236.202,"body":"Having a project that's just C"},{"startTime":3232.542,"endTime":3236.202,"body":"and Python is that C and like"},{"startTime":3236.262,"endTime":3239.652,"body":"Python is not a compiled language"},{"startTime":3236.262,"endTime":3239.652,"body":"and c is a compiler that exists."},{"startTime":3239.712,"endTime":3241.842,"body":"Like there's a compiler that"},{"startTime":3239.712,"endTime":3241.842,"body":"exists for every platform under"},{"startTime":3241.842,"endTime":3245.532,"body":"the sun, including things that are"},{"startTime":3241.842,"endTime":3245.532,"body":"weird, like 31 bit architectures."},{"startTime":3246.017,"endTime":3250.227,"body":"and so like implicitly, when you ship"},{"startTime":3246.017,"endTime":3250.227,"body":"software like this, you end up with"},{"startTime":3250.227,"endTime":3254.632,"body":"consumers at some level who maybe they"},{"startTime":3250.227,"endTime":3254.632,"body":"only want to compile it to prove they"},{"startTime":3254.632,"endTime":3259.927,"body":"can, but there's a set of folks who are"},{"startTime":3254.632,"endTime":3259.927,"body":"like, we, like I was able to compile this"},{"startTime":3259.927,"endTime":3261.277,"body":"and therefore it should be supported."},{"startTime":3261.517,"endTime":3264.637,"body":"And so one of the things that did come"},{"startTime":3261.517,"endTime":3264.637,"body":"out of our Rust migration was a much"},{"startTime":3264.637,"endTime":3268.747,"body":"more obvious, like a much more clear"},{"startTime":3264.637,"endTime":3268.747,"body":"and obvious statement of like, we"},{"startTime":3268.747,"endTime":3273.127,"body":"support architectures that have enough"},{"startTime":3268.747,"endTime":3273.127,"body":"support that LLVM has been ported to it."},{"startTime":3273.577,"endTime":3277.717,"body":"Uh, and one of the, one of the, perhaps"},{"startTime":3273.577,"endTime":3277.717,"body":"most prominent, and Alex and I might"},{"startTime":3277.717,"endTime":3281.197,"body":"be overly patting ourselves on the back"},{"startTime":3277.717,"endTime":3281.197,"body":"for it, but also it really feels like"},{"startTime":3281.197,"endTime":3285.367,"body":"we, we might be responsible is that IBM"},{"startTime":3281.197,"endTime":3285.367,"body":"recent, I guess now it's about a year"},{"startTime":3285.367,"endTime":3288.217,"body":"ago, but, uh, IBM ported Rust to AIX."},{"startTime":3288.472,"endTime":3291.922,"body":"And one of their headline messages"},{"startTime":3288.472,"endTime":3291.922,"body":"on the blog post where they announced"},{"startTime":3291.922,"endTime":3293.887,"body":"it was Python Cryptography will work."},{"startTime":3294.587,"endTime":3296.147,"body":"Oh, that's pretty nice."},{"startTime":3296.652,"endTime":3296.847,"body":"Yeah."},{"startTime":3296.847,"endTime":3298.122,"body":"And like this is,"},{"startTime":3298.822,"endTime":3300.497,"body":"You're perpetuating A IX."},{"startTime":3300.527,"endTime":3301.177,"body":"It's not nice."},{"startTime":3301.807,"endTime":3306.607,"body":"I know, but like, the fact that"},{"startTime":3301.807,"endTime":3306.607,"body":"they, like they are that good"},{"startTime":3307.267,"endTime":3307.537,"body":"at"},{"startTime":3307.537,"endTime":3308.467,"body":"This is a positive"},{"startTime":3308.467,"endTime":3310.357,"body":"sum interaction, is"},{"startTime":3308.467,"endTime":3310.357,"body":"the way I would say it."},{"startTime":3310.357,"endTime":3315.277,"body":"Like I, IBM like gets better support"},{"startTime":3310.357,"endTime":3315.277,"body":"for whatever customers A IX has."},{"startTime":3315.697,"endTime":3320.557,"body":"We can point users at a IX who like show"},{"startTime":3315.697,"endTime":3320.557,"body":"up at our issue tracker and like IBM,"},{"startTime":3320.557,"endTime":3324.427,"body":"like they maintain your stuff and like,"},{"startTime":3320.557,"endTime":3324.427,"body":"I think this is like a good message"},{"startTime":3324.607,"endTime":3330.547,"body":"to like projects, to like when you get"},{"startTime":3324.607,"endTime":3330.547,"body":"requests for like weirdo, particularly"},{"startTime":3330.547,"endTime":3334.837,"body":"commercial operating systems or"},{"startTime":3330.547,"endTime":3334.837,"body":"architectures, like push back and like"},{"startTime":3335.167,"endTime":3338.077,"body":"try, try to make people go to like the"},{"startTime":3335.167,"endTime":3338.077,"body":"company they have a support contract"},{"startTime":3338.077,"endTime":3340.447,"body":"with and not like pawn it off on you."},{"startTime":3340.747,"endTime":3343.027,"body":"You know, if you, if you're not"},{"startTime":3340.747,"endTime":3343.027,"body":"interested in maintaining that."},{"startTime":3343.327,"endTime":3347.062,"body":"Let's, let's talk about like that"},{"startTime":3343.327,"endTime":3347.062,"body":"aspect a little more before we get back"},{"startTime":3347.062,"endTime":3348.872,"body":"to like broader points about OpenSSL."},{"startTime":3349.352,"endTime":3355.252,"body":"both you, Alex and Paul have been"},{"startTime":3349.352,"endTime":3355.252,"body":"doing like, open, open source, I say"},{"startTime":3355.252,"endTime":3359.352,"body":"in quotes, for, you know, like 13 years"},{"startTime":3355.252,"endTime":3359.352,"body":"here, you have more than that, but this"},{"startTime":3359.352,"endTime":3362.272,"body":"specific project, it's very widely used."},{"startTime":3362.702,"endTime":3365.792,"body":"but, well I, I don't know Paul"},{"startTime":3362.702,"endTime":3365.792,"body":"as well, but Alex seems like a"},{"startTime":3365.792,"endTime":3367.442,"body":"fairly emotionally stable person."},{"startTime":3367.832,"endTime":3373.342,"body":"and, Like you see a lot of discourse"},{"startTime":3367.832,"endTime":3373.342,"body":"around open source of like, oh, there's"},{"startTime":3373.342,"endTime":3375.442,"body":"all these like, people freeloading off me."},{"startTime":3375.442,"endTime":3376.792,"body":"I don't have enough time now."},{"startTime":3376.792,"endTime":3377.902,"body":"I hate this project."},{"startTime":3378.492,"endTime":3382.652,"body":"but at the same time and kinda look"},{"startTime":3378.492,"endTime":3382.652,"body":"over at you guys and you've been able to"},{"startTime":3382.652,"endTime":3387.212,"body":"both kind of keep some amount of support"},{"startTime":3382.652,"endTime":3387.212,"body":"for like a lot of, or, or, or keep a"},{"startTime":3387.212,"endTime":3391.322,"body":"lot of support for a lot of platforms"},{"startTime":3387.212,"endTime":3391.322,"body":"you've been able to get Intel to do."},{"startTime":3391.842,"endTime":3394.652,"body":"or excuse me, or who, whoever to do AIX."},{"startTime":3395.002,"endTime":3400.012,"body":"and like you're, you're still chugging"},{"startTime":3395.002,"endTime":3400.012,"body":"along and to some extent, like the"},{"startTime":3400.012,"endTime":3404.392,"body":"Rust thing, like you chose to do"},{"startTime":3400.012,"endTime":3404.392,"body":"that in Rust in part because of your"},{"startTime":3404.452,"endTime":3408.532,"body":"like personal preferences around"},{"startTime":3404.452,"endTime":3408.532,"body":"memory safety, which I agree with."},{"startTime":3408.772,"endTime":3411.682,"body":"But like you could have also just been"},{"startTime":3408.772,"endTime":3411.682,"body":"like, well, we'll control our own parer"},{"startTime":3411.682,"endTime":3413.632,"body":"by writing c code that doesn't like suck."},{"startTime":3414.342,"endTime":3417.132,"body":"so like you're able to like"},{"startTime":3414.342,"endTime":3417.132,"body":"kind of push your personal"},{"startTime":3417.132,"endTime":3418.692,"body":"opinions into the project and."},{"startTime":3419.392,"endTime":3421.252,"body":"Kind of have fun without dying."},{"startTime":3421.312,"endTime":3425.902,"body":"Like what's your approach to this that"},{"startTime":3421.312,"endTime":3425.902,"body":"like, lets you both kind of keep doing"},{"startTime":3425.902,"endTime":3432.152,"body":"this, but also like doesn't necessarily"},{"startTime":3425.902,"endTime":3432.152,"body":"result in either the drama or BERnout"},{"startTime":3432.172,"endTime":3433.822,"body":"that you hear a lot about in open source?"},{"startTime":3433.822,"endTime":3437.782,"body":"And how do you feel about, like, like are"},{"startTime":3433.822,"endTime":3437.782,"body":"you being funded sufficiently for this?"},{"startTime":3437.782,"endTime":3440.782,"body":"Or like, like how does"},{"startTime":3437.782,"endTime":3440.782,"body":"money fit into this, if at"},{"startTime":3440.802,"endTime":3445.102,"body":"So very early on in the project's history,"},{"startTime":3440.802,"endTime":3445.102,"body":"actually, like Paul and my employer,"},{"startTime":3445.102,"endTime":3446.632,"body":"like, gave us both time to work on it."},{"startTime":3446.812,"endTime":3449.782,"body":"That's close to 10 years"},{"startTime":3446.812,"endTime":3449.782,"body":"ago at this point for me."},{"startTime":3449.932,"endTime":3451.462,"body":"Maybe it's more than 10 years ago."},{"startTime":3451.642,"endTime":3455.252,"body":"So it's, it's, you know, for the last 10"},{"startTime":3451.642,"endTime":3455.252,"body":"years at least, this has been a, you know,"},{"startTime":3455.312,"endTime":3457.822,"body":"labor of, you know, my, my personal time."},{"startTime":3458.182,"endTime":3461.332,"body":"as for like, I guess how"},{"startTime":3458.182,"endTime":3461.332,"body":"we think about it, I think."},{"startTime":3462.032,"endTime":3464.702,"body":"You know, I'm not, I'm not sure we"},{"startTime":3462.032,"endTime":3464.702,"body":"have like a documented philosophy of"},{"startTime":3464.702,"endTime":3467.792,"body":"this or something, but like, we would"},{"startTime":3464.702,"endTime":3467.792,"body":"like working on this project to be,"},{"startTime":3467.912,"endTime":3474.792,"body":"sustainable and enjoyable and a, product"},{"startTime":3467.912,"endTime":3474.792,"body":"that is like, you know, advances things"},{"startTime":3474.792,"endTime":3476.142,"body":"we care about in the world, right?"},{"startTime":3476.142,"endTime":3478.992,"body":"Like we think, you know, crypto"},{"startTime":3476.142,"endTime":3478.992,"body":"cryptography, the ability to"},{"startTime":3478.992,"endTime":3480.402,"body":"build secure systems is important."},{"startTime":3480.402,"endTime":3482.322,"body":"Like we're, this is like"},{"startTime":3480.402,"endTime":3482.322,"body":"a positive contribution."},{"startTime":3482.322,"endTime":3485.382,"body":"If we can make that easier in the"},{"startTime":3482.322,"endTime":3485.382,"body":"Python ecosystem, if we can advance"},{"startTime":3485.382,"endTime":3488.772,"body":"memory safety like that is, that is"},{"startTime":3485.382,"endTime":3488.772,"body":"a, like, good thing for the world."},{"startTime":3489.012,"endTime":3491.622,"body":"And so, like part of what you"},{"startTime":3489.012,"endTime":3491.622,"body":"hear when you hear us talking"},{"startTime":3491.622,"endTime":3495.102,"body":"about like the importance of like"},{"startTime":3491.622,"endTime":3495.102,"body":"really robust testing is that."},{"startTime":3495.802,"endTime":3499.252,"body":"For a thing you work on in your"},{"startTime":3495.802,"endTime":3499.252,"body":"spare time, it's like really,"},{"startTime":3499.252,"endTime":3504.322,"body":"really valuable for the way things"},{"startTime":3499.252,"endTime":3504.322,"body":"come to you to be predictable"},{"startTime":3504.322,"endTime":3505.852,"body":"and not emergencies, for example."},{"startTime":3505.852,"endTime":3510.472,"body":"So like, it is a thousand times more"},{"startTime":3505.852,"endTime":3510.472,"body":"preferable to like spend some time, you"},{"startTime":3510.472,"endTime":3515.052,"body":"know, getting a PR degree, because like I"},{"startTime":3510.472,"endTime":3515.052,"body":"control when I'm working on that than to"},{"startTime":3515.052,"endTime":3516.762,"body":"have like a vulnerability reported to us."},{"startTime":3516.762,"endTime":3519.732,"body":"Like I, you know, if you're like a"},{"startTime":3516.762,"endTime":3519.732,"body":"company, you talk about this in terms of"},{"startTime":3519.732,"endTime":3523.962,"body":"like shift left and like your developer"},{"startTime":3519.732,"endTime":3523.962,"body":"productivity, but like for in your a"},{"startTime":3523.962,"endTime":3528.192,"body":"volunteer project, like what I'm saying"},{"startTime":3523.962,"endTime":3528.192,"body":"is like, it's really good to like not"},{"startTime":3528.192,"endTime":3529.542,"body":"have a vulnerability get reported."},{"startTime":3529.542,"endTime":3532.782,"body":"Like when I'm busy with life, like I"},{"startTime":3529.542,"endTime":3532.782,"body":"can, you know, I can take a week or two"},{"startTime":3532.782,"endTime":3536.877,"body":"off this project because it is stable"},{"startTime":3532.782,"endTime":3536.877,"body":"and like, that's, that's really good."},{"startTime":3537.177,"endTime":3539.902,"body":"and the stuff that you're"},{"startTime":3537.177,"endTime":3539.902,"body":"working on, the time is not like."},{"startTime":3540.602,"endTime":3547.142,"body":"Just trying to debug a flap, ECI or"},{"startTime":3540.602,"endTime":3547.142,"body":"like trying to fig, like wasting time"},{"startTime":3547.352,"endTime":3552.242,"body":"just trying to make something functional"},{"startTime":3547.352,"endTime":3552.242,"body":"and workable as opposed to like, Hey,"},{"startTime":3552.242,"endTime":3554.162,"body":"here's a new feature that people want."},{"startTime":3554.162,"endTime":3555.392,"body":"I need to go ship it."},{"startTime":3555.392,"endTime":3558.482,"body":"Or a new primitive or making"},{"startTime":3555.392,"endTime":3558.482,"body":"something better, like"},{"startTime":3558.782,"endTime":3562.977,"body":"we put a lot of time to ci like,"},{"startTime":3558.782,"endTime":3562.977,"body":"you know, it, I don't know if it's"},{"startTime":3562.977,"endTime":3565.527,"body":"literally the majority of our time,"},{"startTime":3562.977,"endTime":3565.527,"body":"but it, it's really plausible."},{"startTime":3565.527,"endTime":3570.057,"body":"It's the majority of our time, but it's"},{"startTime":3565.527,"endTime":3570.057,"body":"almost just overwhelmingly like proactive"},{"startTime":3570.057,"endTime":3573.507,"body":"time, like improving it so that like"},{"startTime":3570.057,"endTime":3573.507,"body":"when there's a feature work site about"},{"startTime":3573.507,"endTime":3575.127,"body":"like, we're just working on that feature,"},{"startTime":3575.457,"endTime":3576.747,"body":"that's the thing you can schedule on."},{"startTime":3576.777,"endTime":3579.927,"body":"I mean, did David, to your like,"},{"startTime":3576.777,"endTime":3579.927,"body":"question about like funding, I mean"},{"startTime":3579.927,"endTime":3582.297,"body":"the, the way I think I would say it,"},{"startTime":3579.927,"endTime":3582.297,"body":"like particularly for the last 10"},{"startTime":3582.297,"endTime":3586.557,"body":"years is like, I think working on this"},{"startTime":3582.297,"endTime":3586.557,"body":"project has been incredibly, like,"},{"startTime":3586.557,"endTime":3590.067,"body":"positive some, and I, I think it's a"},{"startTime":3586.557,"endTime":3590.067,"body":"concept that like doesn't get, it's due"},{"startTime":3590.067,"endTime":3592.137,"body":"these days just in the sense of like."},{"startTime":3592.837,"endTime":3595.807,"body":"We think we provided things that's"},{"startTime":3592.837,"endTime":3595.807,"body":"like valuable to many companies."},{"startTime":3595.887,"endTime":3598.737,"body":"and even though it's the case, like"},{"startTime":3595.887,"endTime":3598.737,"body":"at least I have not been paid for"},{"startTime":3598.737,"endTime":3600.237,"body":"the, to work on this in quite a while."},{"startTime":3600.387,"endTime":3602.067,"body":"Like, I'm like very confident."},{"startTime":3602.067,"endTime":3605.787,"body":"I've gotten lots of opportunities, whether"},{"startTime":3602.067,"endTime":3605.787,"body":"it's to travel and give talks or meet"},{"startTime":3605.787,"endTime":3609.387,"body":"people or just professional opportunities"},{"startTime":3605.787,"endTime":3609.387,"body":"because like I work on this and like"},{"startTime":3609.507,"endTime":3614.157,"body":"that, that is for me, like an exchange"},{"startTime":3609.507,"endTime":3614.157,"body":"of like, you know, my time and like,"},{"startTime":3614.907,"endTime":3618.897,"body":"for like remuneration that like really"},{"startTime":3614.907,"endTime":3618.897,"body":"seems fair and like very positive sums."},{"startTime":3618.897,"endTime":3619.617,"body":"So like, I, I don't know."},{"startTime":3619.617,"endTime":3620.037,"body":"I don't know."},{"startTime":3620.157,"endTime":3620.937,"body":"I don't have any complaints."},{"startTime":3620.937,"endTime":3621.867,"body":"How you feeling Paul?"},{"startTime":3622.267,"endTime":3625.987,"body":"I mean, I think I found that like"},{"startTime":3622.267,"endTime":3625.987,"body":"over the course of 13 years, like"},{"startTime":3626.317,"endTime":3628.987,"body":"again, yeah, I got time for my"},{"startTime":3626.317,"endTime":3628.987,"body":"employer when we first started."},{"startTime":3628.987,"endTime":3632.227,"body":"I have not gotten time since I left"},{"startTime":3628.987,"endTime":3632.227,"body":"that employer, so it has been 10"},{"startTime":3632.227,"endTime":3636.097,"body":"years roughly since I, I was, I was"},{"startTime":3632.227,"endTime":3636.097,"body":"quote, paid to work on this project."},{"startTime":3636.467,"endTime":3640.017,"body":"We, I mean, I think a lot of the"},{"startTime":3636.467,"endTime":3640.017,"body":"sustainability for this is that, like"},{"startTime":3640.047,"endTime":3642.907,"body":"Alex and I are a small team, right?"},{"startTime":3642.937,"endTime":3646.417,"body":"It's, it's two primary contributors to"},{"startTime":3642.937,"endTime":3646.417,"body":"this project, which means that when we"},{"startTime":3646.417,"endTime":3650.737,"body":"wanna make major decisions, this is not"},{"startTime":3646.417,"endTime":3650.737,"body":"like a large scale, long-term effort."},{"startTime":3650.737,"endTime":3654.127,"body":"It is a conversation between two people"},{"startTime":3650.737,"endTime":3654.127,"body":"who largely think very similarly."},{"startTime":3654.557,"endTime":3658.187,"body":"that means we can, we can make big"},{"startTime":3654.557,"endTime":3658.187,"body":"decisions, we can execute against"},{"startTime":3658.187,"endTime":3662.557,"body":"them, without a lot of, BEReaucratic"},{"startTime":3658.187,"endTime":3662.557,"body":"time or a lot of like, politicking"},{"startTime":3662.557,"endTime":3663.877,"body":"to determine what's good or bad."},{"startTime":3664.087,"endTime":3667.537,"body":"Now, that has its disadvantages too,"},{"startTime":3664.087,"endTime":3667.537,"body":"but so far inside this project that"},{"startTime":3667.537,"endTime":3668.827,"body":"they've been largely advantages."},{"startTime":3669.227,"endTime":3673.247,"body":"it is also the case that like we"},{"startTime":3669.227,"endTime":3673.247,"body":"have built the project such that"},{"startTime":3673.247,"endTime":3676.817,"body":"like when people come and they"},{"startTime":3673.247,"endTime":3676.817,"body":"ask for something unreasonable,"},{"startTime":3676.967,"endTime":3678.647,"body":"we feel comfortable pushing back."},{"startTime":3678.977,"endTime":3681.407,"body":"Uh, we feel comfortable telling"},{"startTime":3678.977,"endTime":3681.407,"body":"people they should not be, you know,"},{"startTime":3681.407,"endTime":3683.957,"body":"they shouldn't behave certain ways"},{"startTime":3681.407,"endTime":3683.957,"body":"in an issue tracker when they behave"},{"startTime":3683.957,"endTime":3685.277,"body":"in ways that are inappropriate."},{"startTime":3685.667,"endTime":3686.207,"body":"Uh, and we."},{"startTime":3686.762,"endTime":3688.952,"body":"Built the system so that"},{"startTime":3686.762,"endTime":3688.952,"body":"it's enjoyable to use, right?"},{"startTime":3688.952,"endTime":3691.922,"body":"Like, uh, one of the unofficial"},{"startTime":3688.952,"endTime":3691.922,"body":"rules of thumb Alex and I have used"},{"startTime":3691.922,"endTime":3695.912,"body":"for a long, long time now is anytime"},{"startTime":3691.922,"endTime":3695.912,"body":"the CI exceeds 10 minutes, we spend"},{"startTime":3695.912,"endTime":3697.387,"body":"time on it because it annoys us."},{"startTime":3698.187,"endTime":3701.217,"body":"and so like those types of"},{"startTime":3698.187,"endTime":3701.217,"body":"things just make it continuously"},{"startTime":3701.217,"endTime":3702.357,"body":"pleasurable to work on."},{"startTime":3702.587,"endTime":3705.317,"body":"it is also the case that it is"},{"startTime":3702.587,"endTime":3705.317,"body":"a large bully pulpit, right?"},{"startTime":3705.317,"endTime":3709.307,"body":"Like we, we have a lot of influence"},{"startTime":3705.317,"endTime":3709.307,"body":"and, and we are cognizant and respectful"},{"startTime":3709.307,"endTime":3713.237,"body":"of the fact that we can use that bully"},{"startTime":3709.307,"endTime":3713.237,"body":"pulpit, but we do want to be able"},{"startTime":3713.237,"endTime":3717.677,"body":"to use it to like, pursue things we"},{"startTime":3713.237,"endTime":3717.677,"body":"consider, worthwhile in the ecosystem."},{"startTime":3717.782,"endTime":3718.247,"body":"Y yeah."},{"startTime":3718.247,"endTime":3721.037,"body":"May maybe to really"},{"startTime":3718.247,"endTime":3721.037,"body":"tie these two together."},{"startTime":3721.257,"endTime":3725.757,"body":"I, I think for Paul and I, a really big"},{"startTime":3721.257,"endTime":3725.757,"body":"indicator, what, one of the things that,"},{"startTime":3725.757,"endTime":3728.427,"body":"at least for me, more than anything,"},{"startTime":3725.757,"endTime":3728.427,"body":"led to like us giving this talk and"},{"startTime":3728.427,"endTime":3732.827,"body":"writing this, statement about where"},{"startTime":3728.427,"endTime":3732.827,"body":"OpenSSL was, is that we found that"},{"startTime":3732.827,"endTime":3740.212,"body":"working with these new SSL APIs, looking"},{"startTime":3732.827,"endTime":3740.212,"body":"at things like argon two or ML KEM, it,"},{"startTime":3740.272,"endTime":3741.832,"body":"it was becoming like really unpleasant."},{"startTime":3741.832,"endTime":3745.942,"body":"Like it, like if you had like a log"},{"startTime":3741.832,"endTime":3745.942,"body":"of all of our chats, you would see"},{"startTime":3745.942,"endTime":3749.162,"body":"like the profanity really went up."},{"startTime":3749.162,"endTime":3752.607,"body":"Like we were experiencing a"},{"startTime":3749.162,"endTime":3752.607,"body":"lot of fRustration and like."},{"startTime":3753.307,"endTime":3757.697,"body":"That, that's like a pretty marked"},{"startTime":3753.307,"endTime":3757.697,"body":"difference from, what came before, like"},{"startTime":3757.787,"endTime":3761.027,"body":"that, that was just like, kind of not"},{"startTime":3757.787,"endTime":3761.027,"body":"the emotional valence we had about,"},{"startTime":3761.107,"endTime":3762.847,"body":"you know, adding new features before."},{"startTime":3762.997,"endTime":3765.517,"body":"And so like that, that"},{"startTime":3762.997,"endTime":3765.517,"body":"was a big signal to us."},{"startTime":3765.517,"endTime":3768.187,"body":"Like, Hey, something has gone wrong."},{"startTime":3768.187,"endTime":3771.247,"body":"Like we, we need to take stock of"},{"startTime":3768.187,"endTime":3771.247,"body":"like, what's, what's happening here?"},{"startTime":3771.947,"endTime":3772.067,"body":"and"},{"startTime":3772.067,"endTime":3775.337,"body":"so that basically leads"},{"startTime":3772.067,"endTime":3775.337,"body":"you to the two of you."},{"startTime":3775.397,"endTime":3778.727,"body":"You're generally on the same page about"},{"startTime":3775.397,"endTime":3778.727,"body":"everything, and it's not that difficult"},{"startTime":3778.727,"endTime":3784.127,"body":"for you to finally de declare and come"},{"startTime":3778.727,"endTime":3784.127,"body":"to the conclusion that you basically have"},{"startTime":3784.127,"endTime":3788.987,"body":"to move away from OpenSSL for at least"},{"startTime":3784.127,"endTime":3788.987,"body":"some things for Python cryptography."},{"startTime":3789.687,"endTime":3793.107,"body":"Yeah, so the, the, the core thesis"},{"startTime":3789.687,"endTime":3793.107,"body":"of the statement we, we issued"},{"startTime":3793.107,"endTime":3795.487,"body":"is that OpenSSL as a project has."},{"startTime":3796.187,"endTime":3800.327,"body":"Slowly diverged toward, from, from"},{"startTime":3796.187,"endTime":3800.327,"body":"paths that we find aesthetically"},{"startTime":3800.327,"endTime":3804.167,"body":"appealing, technically acceptable,"},{"startTime":3800.327,"endTime":3804.167,"body":"et cetera, uh, to the point where we"},{"startTime":3804.167,"endTime":3808.947,"body":"are now actively seeking mechanisms"},{"startTime":3804.167,"endTime":3808.947,"body":"by which we could end our dependence."},{"startTime":3809.607,"endTime":3811.497,"body":"Now, that is a difficult thing to do."},{"startTime":3811.527,"endTime":3814.197,"body":"There are a variety of reasons"},{"startTime":3811.527,"endTime":3814.197,"body":"why, like compliance reasons."},{"startTime":3814.197,"endTime":3817.757,"body":"We have downstream consumers that care"},{"startTime":3814.197,"endTime":3817.757,"body":"deeply about the support of OpenSSL."},{"startTime":3818.037,"endTime":3821.577,"body":"We have feature gaps based on like"},{"startTime":3818.037,"endTime":3821.577,"body":"what, what the different forks support."},{"startTime":3821.697,"endTime":3825.517,"body":"There's a bunch of things that make"},{"startTime":3821.697,"endTime":3825.517,"body":"this challenging, but like while"},{"startTime":3825.517,"endTime":3828.637,"body":"OpenSSL continues on its current"},{"startTime":3825.517,"endTime":3828.637,"body":"trajectory, and to be clear, it is"},{"startTime":3828.637,"endTime":3830.137,"body":"possible for them to course correct."},{"startTime":3830.187,"endTime":3832.417,"body":"but it is a difficult thing,"},{"startTime":3830.187,"endTime":3832.417,"body":"based on the fact that we've"},{"startTime":3832.417,"endTime":3833.887,"body":"spent years advocating for it."},{"startTime":3834.357,"endTime":3837.637,"body":"but if they fail to course correct,"},{"startTime":3834.357,"endTime":3837.637,"body":"if they fail to, to, provide material"},{"startTime":3837.637,"endTime":3841.327,"body":"improvement in the, on the axes that"},{"startTime":3837.637,"endTime":3841.327,"body":"we've defined, then we will be trying"},{"startTime":3841.327,"endTime":3846.397,"body":"to at the very least, remove OpenSSL"},{"startTime":3841.327,"endTime":3846.397,"body":"as our default wheel configuration."},{"startTime":3846.577,"endTime":3851.557,"body":"And potentially based on the, what Alex"},{"startTime":3846.577,"endTime":3851.557,"body":"and I consider sustainable for ourselves"},{"startTime":3851.557,"endTime":3853.392,"body":"in the long term OpenSSL entirely."},{"startTime":3854.092,"endTime":3857.687,"body":"Do you have any other wheel"},{"startTime":3854.092,"endTime":3857.687,"body":"configurations besides OpenSSL right now?"},{"startTime":3858.387,"endTime":3863.007,"body":"we support build against,"},{"startTime":3858.387,"endTime":3863.007,"body":"LibreSSL, BoringSSL or aws-lc."},{"startTime":3863.187,"endTime":3864.147,"body":"But you have to bring your own."},{"startTime":3864.147,"endTime":3866.927,"body":"We don't, we don't, uh, ship,"},{"startTime":3864.147,"endTime":3866.927,"body":"prebuilt, wheels for those."},{"startTime":3867.297,"endTime":3867.597,"body":"But"},{"startTime":3867.597,"endTime":3867.837,"body":"the,"},{"startTime":3868.017,"endTime":3872.157,"body":"it, it's not difficult for y'all"},{"startTime":3868.017,"endTime":3872.157,"body":"to just sort of start, experiment"},{"startTime":3872.157,"endTime":3873.447,"body":"with just building those in."},{"startTime":3873.477,"endTime":3876.417,"body":"'cause you already have the"},{"startTime":3873.477,"endTime":3876.417,"body":"work to, to link, to hook them"},{"startTime":3876.487,"endTime":3879.102,"body":"yeah, so we're perfectly"},{"startTime":3876.487,"endTime":3879.102,"body":"capable of doing it right now."},{"startTime":3879.132,"endTime":3882.342,"body":"The challenge is that like there's"},{"startTime":3879.132,"endTime":3882.342,"body":"no, there's no concept of like"},{"startTime":3882.342,"endTime":3885.012,"body":"wheel variance that would say"},{"startTime":3882.342,"endTime":3885.012,"body":"like, oh, I want cryptography,"},{"startTime":3885.012,"endTime":3886.302,"body":"but with a different backend."},{"startTime":3886.492,"endTime":3889.222,"body":"and even if there was that concept,"},{"startTime":3886.492,"endTime":3889.222,"body":"which there's actually some PEPs that"},{"startTime":3889.222,"endTime":3893.752,"body":"might make that possible, even if that"},{"startTime":3889.222,"endTime":3893.752,"body":"concept did exist, I think that's not"},{"startTime":3893.932,"endTime":3898.262,"body":"a thing I, I can expect a consumer to"},{"startTime":3893.932,"endTime":3898.262,"body":"understand the consequences of, Alex and"},{"startTime":3898.262,"endTime":3902.252,"body":"I believe pretty deeply in having this"},{"startTime":3898.262,"endTime":3902.252,"body":"library be the sort of like drop in, in"},{"startTime":3902.252,"endTime":3904.172,"body":"just work and it has secure defaults."},{"startTime":3904.382,"endTime":3907.022,"body":"And so I think like what we"},{"startTime":3904.382,"endTime":3907.022,"body":"wanna do is get to a point where"},{"startTime":3907.022,"endTime":3908.312,"body":"we would just swap the default."},{"startTime":3909.012,"endTime":3909.312,"body":"Right."},{"startTime":3909.312,"endTime":3912.222,"body":"So everyone is just like in,"},{"startTime":3909.312,"endTime":3912.222,"body":"in to a first approximation."},{"startTime":3912.522,"endTime":3914.802,"body":"Everyone's just gonna use the"},{"startTime":3912.522,"endTime":3914.802,"body":"default, and if the default has"},{"startTime":3914.802,"endTime":3917.507,"body":"feature gaps, then you're randomly"},{"startTime":3914.802,"endTime":3917.507,"body":"gonna blow things up for people."},{"startTime":3917.807,"endTime":3918.417,"body":"Exactly right."},{"startTime":3918.447,"endTime":3921.147,"body":"So like for example, the current"},{"startTime":3918.447,"endTime":3921.147,"body":"state of the state of the world is"},{"startTime":3921.147,"endTime":3925.107,"body":"that we sh support and ship Argon2,"},{"startTime":3921.147,"endTime":3925.107,"body":"ID and scrypt, both which are APIs"},{"startTime":3925.107,"endTime":3927.147,"body":"that live natively inside of OpenSSL."},{"startTime":3927.417,"endTime":3931.677,"body":"Not all the forks support either of"},{"startTime":3927.417,"endTime":3931.677,"body":"those, and that meant if we, if we shipped"},{"startTime":3931.677,"endTime":3935.587,"body":"a wheel with those, we would lose the"},{"startTime":3931.677,"endTime":3935.587,"body":"support for those, algorithms immediately."},{"startTime":3936.622,"endTime":3939.292,"body":"But like it's more likely that"},{"startTime":3936.622,"endTime":3939.292,"body":"you'll like, this is kind of a"},{"startTime":3939.292,"endTime":3940.972,"body":"normal engineering problem, right?"},{"startTime":3940.972,"endTime":3943.252,"body":"Like a flag day problem"},{"startTime":3940.972,"endTime":3943.252,"body":"kind of deal, right?"},{"startTime":3943.282,"endTime":3947.002,"body":"It's more likely that you'll"},{"startTime":3943.282,"endTime":3947.002,"body":"resolve that problem than that."},{"startTime":3947.007,"endTime":3949.487,"body":"OpenSSL 3 is gonna get rid of O SSL param."},{"startTime":3950.162,"endTime":3953.537,"body":"I won't try and speculate,"},{"startTime":3950.162,"endTime":3953.537,"body":"but I, I, you might be right."},{"startTime":3953.682,"endTime":3953.972,"body":"Yeah."},{"startTime":3954.092,"endTime":3956.492,"body":"a betting person, but like,"},{"startTime":3954.092,"endTime":3956.492,"body":"it, it seems plausible."},{"startTime":3956.712,"endTime":3957.612,"body":"It seems plausible."},{"startTime":3958.062,"endTime":3958.362,"body":"yeah."},{"startTime":3958.962,"endTime":3961.782,"body":"It seems like one of us could just sign"},{"startTime":3958.962,"endTime":3961.782,"body":"up for Poly Market and set this up."},{"startTime":3962.182,"endTime":3964.217,"body":"That sounds like a long, long, but"},{"startTime":3964.917,"endTime":3969.417,"body":"I mean, it seems like all you have to do"},{"startTime":3964.917,"endTime":3969.417,"body":"is violate your first rule, which you also"},{"startTime":3969.417,"endTime":3973.017,"body":"opened by saying you've already repeatedly"},{"startTime":3969.417,"endTime":3973.017,"body":"violated, which is just like write a"},{"startTime":3973.017,"endTime":3974.277,"body":"little bit of your own cryptography."},{"startTime":3974.977,"endTime":3977.722,"body":"Uh, then, then I gotta get involved"},{"startTime":3974.977,"endTime":3977.722,"body":"in FIPS more heavily, and that's"},{"startTime":3977.722,"endTime":3979.582,"body":"already too much of my life."},{"startTime":3979.882,"endTime":3983.842,"body":"Like you, you end up with things like"},{"startTime":3979.882,"endTime":3983.842,"body":"if you actually like go inside the"},{"startTime":3984.022,"endTime":3984.502,"body":"Phipps."},{"startTime":3984.752,"endTime":3986.702,"body":"Not yet, hopefully sometime soon."},{"startTime":3987.147,"endTime":3991.402,"body":"i, I If, and when NIST finishes their,"},{"startTime":3987.147,"endTime":3991.402,"body":"starts, I, I lost track of the status"},{"startTime":3991.402,"endTime":3996.202,"body":"of their, key derivation function work,"},{"startTime":3991.402,"endTime":3996.202,"body":"but like in theory, maybe someday."},{"startTime":3996.652,"endTime":4000.522,"body":"but like another example like Ed"},{"startTime":3996.652,"endTime":4000.522,"body":"4, 4 8 is I think not supported"},{"startTime":4000.522,"endTime":4002.232,"body":"by any of the forks it is"},{"startTime":4002.312,"endTime":4003.297,"body":"do you need it?"},{"startTime":4004.132,"endTime":4004.582,"body":"do We,"},{"startTime":4004.657,"endTime":4008.017,"body":"whether or not it was wild wise,"},{"startTime":4004.657,"endTime":4008.017,"body":"we, we did expose it at one point."},{"startTime":4008.347,"endTime":4009.217,"body":"Oh Lord."},{"startTime":4009.917,"endTime":4012.407,"body":"And like this is one of"},{"startTime":4009.917,"endTime":4012.407,"body":"those things where like."},{"startTime":4012.842,"endTime":4015.782,"body":"We could, we can make, we in fact"},{"startTime":4012.842,"endTime":4015.782,"body":"have made the list of like, what"},{"startTime":4015.782,"endTime":4019.802,"body":"are the things that, we ship that"},{"startTime":4015.782,"endTime":4019.802,"body":"like we think are not stupid?"},{"startTime":4019.802,"endTime":4023.342,"body":"Like there, there's some stuff that"},{"startTime":4019.802,"endTime":4023.342,"body":"like, we expose that like we don't care,"},{"startTime":4023.342,"endTime":4026.282,"body":"like I, I don't know, SEC t whatever."},{"startTime":4026.282,"endTime":4028.562,"body":"Like there's weird elliptic curves"},{"startTime":4026.282,"endTime":4028.562,"body":"that like, if we dropped them, we"},{"startTime":4028.562,"endTime":4029.852,"body":"don't think many people would care."},{"startTime":4030.122,"endTime":4031.352,"body":"We, we would be okay with it."},{"startTime":4031.502,"endTime":4036.212,"body":"But there's things like X ED 4, 4"},{"startTime":4031.502,"endTime":4036.212,"body":"8 or like, different kds or like,"},{"startTime":4036.602,"endTime":4038.852,"body":"I think various like a EAD modes."},{"startTime":4038.852,"endTime":4042.602,"body":"Like we've got a list somewhere"},{"startTime":4038.852,"endTime":4042.602,"body":"that like any one of them, like you"},{"startTime":4042.602,"endTime":4046.152,"body":"might look at and you might say,"},{"startTime":4042.602,"endTime":4046.152,"body":"ah, how likely do we think it is?"},{"startTime":4046.152,"endTime":4046.692,"body":"People use this."},{"startTime":4046.692,"endTime":4050.502,"body":"We can make an assessment of like, how"},{"startTime":4046.692,"endTime":4050.502,"body":"much breakage would it cost to do this?"},{"startTime":4050.652,"endTime":4051.792,"body":"You know, what's the likelihood?"},{"startTime":4051.792,"endTime":4053.472,"body":"Are there standards that implement this?"},{"startTime":4053.472,"endTime":4055.932,"body":"Like, you know, if I search"},{"startTime":4053.472,"endTime":4055.932,"body":"GitHub, does it like, seem like"},{"startTime":4055.932,"endTime":4057.492,"body":"there's some projects that use it?"},{"startTime":4058.012,"endTime":4058.252,"body":"but."},{"startTime":4058.952,"endTime":4061.082,"body":"For any of the given forks,"},{"startTime":4058.952,"endTime":4061.082,"body":"we're looking at like, yeah."},{"startTime":4061.142,"endTime":4065.412,"body":"Decently sized list of these like, I"},{"startTime":4061.142,"endTime":4065.412,"body":"don't know, 10, 10 or so, algorithms."},{"startTime":4065.772,"endTime":4069.492,"body":"And that's like, I don't know,"},{"startTime":4065.772,"endTime":4069.492,"body":"10 times the breakage budget"},{"startTime":4069.492,"endTime":4072.132,"body":"of the, you know, mean of them."},{"startTime":4072.282,"endTime":4073.872,"body":"So it's, it's potentially non-trivial."},{"startTime":4073.872,"endTime":4074.382,"body":"So like"},{"startTime":4075.082,"endTime":4075.162,"body":"Hmm."},{"startTime":4075.462,"endTime":4078.387,"body":"we, we would like, we wanna"},{"startTime":4075.462,"endTime":4078.387,"body":"spend our breakage budget."},{"startTime":4078.387,"endTime":4081.677,"body":"Well, is I think the way, I would say it"},{"startTime":4078.387,"endTime":4081.677,"body":"like we we're prepared to break things"},{"startTime":4081.677,"endTime":4086.017,"body":"when we think like, the ecosystem, our"},{"startTime":4081.677,"endTime":4086.017,"body":"users get like substantial benefits,"},{"startTime":4086.317,"endTime":4091.897,"body":"but, we have a lot more ability to make"},{"startTime":4086.317,"endTime":4091.897,"body":"changes like avoiding OpenSSL if we"},{"startTime":4091.897,"endTime":4096.082,"body":"were reduce, uh, the level of breakage,"},{"startTime":4091.897,"endTime":4096.082,"body":"that, that we incur in doing so."},{"startTime":4096.382,"endTime":4096.662,"body":"Mm-hmm."},{"startTime":4097.362,"endTime":4101.172,"body":"That does sound like, like you're"},{"startTime":4097.362,"endTime":4101.172,"body":"incentivized to implement some"},{"startTime":4101.172,"endTime":4105.882,"body":"of this stuff in Rust to paper"},{"startTime":4101.172,"endTime":4105.882,"body":"over the migration, away from"},{"startTime":4106.002,"endTime":4108.047,"body":"OpenSSL to another default backend."},{"startTime":4108.777,"endTime":4111.702,"body":"That that really does, that"},{"startTime":4108.777,"endTime":4111.702,"body":"does sound like what you're"},{"startTime":4112.182,"endTime":4112.542,"body":"it's"},{"startTime":4112.602,"endTime":4113.472,"body":"not impossible."},{"startTime":4113.502,"endTime":4116.742,"body":"But there are, there, there are challenges"},{"startTime":4113.502,"endTime":4116.742,"body":"there too because depending upon what"},{"startTime":4116.742,"endTime":4120.372,"body":"we need to re-implement, like we don't"},{"startTime":4116.742,"endTime":4120.372,"body":"want our downstream consumers to be"},{"startTime":4120.372,"endTime":4124.362,"body":"silently surprised when, when the thing"},{"startTime":4120.372,"endTime":4124.362,"body":"they thought was FIPS no longer can be,"},{"startTime":4124.692,"endTime":4128.202,"body":"similarly, like there are, there are"},{"startTime":4124.692,"endTime":4128.202,"body":"various like dependency requirements"},{"startTime":4128.202,"endTime":4132.342,"body":"in, in the Rust cinematic universe"},{"startTime":4128.202,"endTime":4132.342,"body":"of, of cryptography that are somewhat"},{"startTime":4132.342,"endTime":4134.052,"body":"challenging for us in some scenarios."},{"startTime":4134.442,"endTime":4138.222,"body":"and so like one of the things we mentioned"},{"startTime":4134.442,"endTime":4138.222,"body":"in our, in our statement was, graviola"},{"startTime":4138.282,"endTime":4140.112,"body":"a pure Rust cryptography library."},{"startTime":4140.437,"endTime":4142.537,"body":"that is interesting to us in the abstract."},{"startTime":4142.537,"endTime":4144.517,"body":"It's nowhere near where we"},{"startTime":4142.537,"endTime":4144.517,"body":"would need it right now."},{"startTime":4144.517,"endTime":4148.477,"body":"It's like we've spoken briefly with"},{"startTime":4144.517,"endTime":4148.477,"body":"the author and like they're, that's"},{"startTime":4148.477,"endTime":4151.867,"body":"not currently their focus for like, its"},{"startTime":4148.477,"endTime":4151.867,"body":"adoption, but it's something that we're"},{"startTime":4151.867,"endTime":4155.267,"body":"watching with interest as like maybe a"},{"startTime":4151.867,"endTime":4155.267,"body":"long-term solution, as we go forward."},{"startTime":4155.297,"endTime":4158.747,"body":"And when I say long-term, I mean"},{"startTime":4155.297,"endTime":4158.747,"body":"like on the 5, 10, 15 year time"},{"startTime":4158.747,"endTime":4163.017,"body":"horizon, Alex and I are genuinely"},{"startTime":4158.747,"endTime":4163.017,"body":"thinking in the long term here."},{"startTime":4163.467,"endTime":4167.997,"body":"because, and, and it's also why we spoke"},{"startTime":4163.467,"endTime":4167.997,"body":"up when we did, because we gave it several"},{"startTime":4167.997,"endTime":4172.617,"body":"years, but also knowing that it will"},{"startTime":4167.997,"endTime":4172.617,"body":"take us many years to, to migrate off."},{"startTime":4172.767,"endTime":4175.617,"body":"We want people to be aware of the"},{"startTime":4172.767,"endTime":4175.617,"body":"problems rather than springing"},{"startTime":4175.617,"endTime":4177.207,"body":"this on people at the last second."},{"startTime":4177.612,"endTime":4178.002,"body":"Yeah."},{"startTime":4178.002,"endTime":4178.012,"body":"Yeah,"},{"startTime":4178.312,"endTime":4182.052,"body":"I, I mean, just in that space of like,"},{"startTime":4178.312,"endTime":4182.052,"body":"you know, compliance questions and"},{"startTime":4182.052,"endTime":4188.167,"body":"libraries, I, I do, I am very hopeful"},{"startTime":4182.052,"endTime":4188.167,"body":"that, Filippo Valsorda's work on"},{"startTime":4188.167,"endTime":4193.627,"body":"FIPS support for Go is going to prove"},{"startTime":4188.167,"endTime":4193.627,"body":"as a model that is very valuable."},{"startTime":4193.627,"endTime":4196.657,"body":"So, like, I would say in the, at"},{"startTime":4193.627,"endTime":4196.657,"body":"least in the open source cryptography"},{"startTime":4196.657,"endTime":4202.007,"body":"world, OpenSSL has been one of, it"},{"startTime":4196.657,"endTime":4202.007,"body":"is like the most default choice, like"},{"startTime":4202.007,"endTime":4205.727,"body":"maybe even more of a default choice"},{"startTime":4202.007,"endTime":4205.727,"body":"than like OpenSSL, just as like open"},{"startTime":4205.727,"endTime":4207.557,"body":"source cryptography is in general."},{"startTime":4207.737,"endTime":4211.067,"body":"Like they, they had, you know, done the"},{"startTime":4207.737,"endTime":4211.067,"body":"work to like build the, like back when"},{"startTime":4211.067,"endTime":4212.717,"body":"it was called like the FIPS canister."},{"startTime":4213.047,"endTime":4218.327,"body":"and I think Felipo has really demonstrated"},{"startTime":4213.047,"endTime":4218.327,"body":"that it is possible if you were a diligent"},{"startTime":4218.327,"endTime":4222.347,"body":"and knowledgeable cryptography maintainer"},{"startTime":4218.327,"endTime":4222.347,"body":"maintainer to like take on this project."},{"startTime":4222.397,"endTime":4224.467,"body":"is not, you know, impossible."},{"startTime":4224.467,"endTime":4225.517,"body":"It's not all consuming."},{"startTime":4225.607,"endTime":4230.257,"body":"It doesn't even require changing your"},{"startTime":4225.607,"endTime":4230.257,"body":"library in that like, disturbing of"},{"startTime":4230.257,"endTime":4235.897,"body":"ways, Go's cryptography modules are still"},{"startTime":4230.257,"endTime":4235.897,"body":"kind of like a model of like clarity."},{"startTime":4236.137,"endTime":4236.327,"body":"Yeah."},{"startTime":4236.377,"endTime":4239.897,"body":"so like, I, I am hopeful that"},{"startTime":4236.377,"endTime":4239.897,"body":"serves as like, a model that, like"},{"startTime":4239.957,"endTime":4242.717,"body":"organizations that have felt like I"},{"startTime":4239.957,"endTime":4242.717,"body":"only have one choice will look and"},{"startTime":4242.717,"endTime":4244.577,"body":"be like, oh, it is actually possible."},{"startTime":4244.577,"endTime":4245.837,"body":"There are other directions."},{"startTime":4246.257,"endTime":4249.377,"body":"I, I really hope the way that he was"},{"startTime":4246.257,"endTime":4249.377,"body":"able to get that working for Golan"},{"startTime":4249.647,"endTime":4255.857,"body":"will be a, a model for like a future"},{"startTime":4249.647,"endTime":4255.857,"body":"possible Rust, like alternative, like"},{"startTime":4255.857,"endTime":4258.077,"body":"Rust does not have a standard library."},{"startTime":4258.377,"endTime":4261.017,"body":"The way that Golan has a standard"},{"startTime":4258.377,"endTime":4261.017,"body":"library, including all the"},{"startTime":4261.017,"endTime":4262.667,"body":"cryptography that comes, including"},{"startTime":4262.667,"endTime":4264.597,"body":"TLS, that comes with go."},{"startTime":4264.867,"endTime":4271.062,"body":"But I could totally see a. Library"},{"startTime":4264.867,"endTime":4271.062,"body":"project in Rust, trying to be"},{"startTime":4271.062,"endTime":4274.962,"body":"validated as a FIPS module the same"},{"startTime":4271.062,"endTime":4274.962,"body":"way that the the Go Lang one did."},{"startTime":4275.172,"endTime":4275.322,"body":"It"},{"startTime":4275.322,"endTime":4279.072,"body":"just would be its own project as opposed"},{"startTime":4275.322,"endTime":4279.072,"body":"to a piece of the standard library"},{"startTime":4279.072,"endTime":4280.542,"body":"of a language or something like that."},{"startTime":4281.242,"endTime":4281.462,"body":"So"},{"startTime":4282.162,"endTime":4285.452,"body":"I've always said, instead of rolling"},{"startTime":4282.162,"endTime":4285.452,"body":"your own crypto, you should build"},{"startTime":4285.452,"endTime":4287.932,"body":"it for someone else and then charge"},{"startTime":4285.452,"endTime":4287.932,"body":"them for the FIP certificate."},{"startTime":4288.632,"endTime":4288.902,"body":"Yeah."},{"startTime":4289.652,"endTime":4290.222,"body":"cool."},{"startTime":4290.342,"endTime":4292.772,"body":"Um, good luck in Godspeed."},{"startTime":4292.772,"endTime":4294.272,"body":"You've come 10 years."},{"startTime":4294.452,"endTime":4295.622,"body":"What's another 10?"},{"startTime":4295.652,"endTime":4301.232,"body":"To actually get away from the fundamental,"},{"startTime":4295.652,"endTime":4301.232,"body":"underlying foundation of your project."},{"startTime":4301.632,"endTime":4304.992,"body":"I'm sure Alex and I will, will be,"},{"startTime":4301.632,"endTime":4304.992,"body":"complaining about this in our retirement,"},{"startTime":4305.022,"endTime":4306.522,"body":"next to each other in the old folks home."},{"startTime":4306.922,"endTime":4308.002,"body":"Looking forward to it."},{"startTime":4308.702,"endTime":4310.052,"body":"Aw, that, that's sweet."},{"startTime":4310.452,"endTime":4313.992,"body":"Tha thank you guys very much for"},{"startTime":4310.452,"endTime":4313.992,"body":"introducing me to OSSL_PARAM."},{"startTime":4314.013,"endTime":4316.203,"body":"we're, we're glad to help and"},{"startTime":4314.013,"endTime":4316.203,"body":"thank you guys for having us."},{"startTime":4316.203,"endTime":4316.263,"body":"No."},{"startTime":4316.503,"endTime":4317.193,"body":"Absolutely."},{"startTime":4317.943,"endTime":4320.313,"body":"Paul, Alex, thank you so much."},{"startTime":4320.313,"endTime":4324.063,"body":"Security, cryptography, whatever is"},{"startTime":4320.313,"endTime":4324.063,"body":"a side project from Dear De Connolly,"},{"startTime":4324.063,"endTime":4325.533,"body":"Thomas Patrick and David Adrian."},{"startTime":4325.773,"endTime":4327.003,"body":"Our editor is Netty Smith."},{"startTime":4327.363,"endTime":4327.943,"body":"oh my God."},{"startTime":4328.043,"endTime":4329.028,"body":"What's the rest of it?"},{"startTime":4329.088,"endTime":4330.138,"body":"I haven't done this in so long."},{"startTime":4330.348,"endTime":4333.588,"body":"You can find the podcast online"},{"startTime":4330.348,"endTime":4333.588,"body":"@scwpod and the hosts online"},{"startTime":4333.588,"endTime":4336.198,"body":"@durumcrustulum, @tqbf, and @davidcadrian."},{"startTime":4336.468,"endTime":4339.718,"body":"You can buy merchandise at merch dot"},{"startTime":4336.468,"endTime":4339.718,"body":"security cryptography whatever dot com."},{"startTime":4339.738,"endTime":4341.898,"body":"If you like the pod, give us a"},{"startTime":4339.738,"endTime":4341.898,"body":"five star review wherever you"},{"startTime":4341.898,"endTime":4343.098,"body":"rate your favorite podcast."},{"startTime":4343.368,"endTime":4344.298,"body":"Thank you for listening."}]}