[{"data":1,"prerenderedAt":225},["ShallowReactive",2],{"project-10263410":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":41,"post_text":43,"what":44,"said":77,"maker_in_thread":151,"shape":160,"grid":164,"attempts":186,"same_week":187,"maker_shows":32,"maker_hidden":217,"reader_version":218,"card":219},"10263410","Neverbleed","privilege separation engine for OpenSSL and LibreSSL","title","Show HN: Neverbleed – privilege separation engine for OpenSSL and LibreSSL","https:\u002F\u002Fgithub.com\u002Fh2o\u002Fneverbleed","github.com","kazuho",1442984863,2015,47,12,598,2565,24,"shown","security_privacy","privilege separation for tls private keys","library",[24,25,26,27,28],"openssl","privilege separation","rsa","libressl","tls","debated",0.111,{"positive":32,"neutral":33,"mixed":34,"critical":33},3,2,0,7,{"performance":37,"docs":39,"idea":40},{"positive":38,"critical":33},1,{"positive":38,"critical":34},{"positive":38,"critical":34},[38,34,34,34,38,34,32,34,42,42,32,42],5,null,{"problem":45,"audience":54,"pricing":43,"motivation":43,"time_to_build":43,"stack":62,"openness":76,"stage":76,"team_size":76},{"value":46,"source":47,"evidence":48},"Keeps TLS private keys out of reach of a compromised web server process by doing RSA operations in a separate process","inferred",[49,51],{"id":50},"post",{"id":52,"by":11,"text":53},"10267752","I assume you are referring to Keyless SSL. https:\u002F\u002Fblog.cloudflare.com\u002Fkeyless-ssl-the-nitty-gritty-technical-details\u002F For Keyless SSL, it is necessary to make RSA operations…",{"value":55,"source":47,"evidence":56},"Operators of TLS servers using OpenSSL or LibreSSL",[57,58],{"id":50},{"id":59,"by":60,"text":61},"10266380","fefe23","I applaud the effort but it does not address the elephant in the room: openssl engines are synchronous. If you use openssl in an event-loop style server (coincidentally, OP's own…",[63,68,72],{"value":64,"source":65,"evidence":66},"OpenSSL","maker",[67],{"id":50},{"value":69,"source":65,"evidence":70},"LibreSSL",[71],{"id":50},{"value":73,"source":65,"evidence":74},"Unix sockets",[75],{"id":52,"by":11,"text":53},"unknown",{"praise":78,"objections":98,"requests":120,"questions":132,"alternatives":140},[79,87],{"value":80,"source":81,"evidence":82},"Simple, clearly documented API for OpenSSL users","commenter",[83],{"id":84,"by":85,"text":86},"10264568","adekok","As an implementor using OpenSSL, I like this. It has a simple API, and is clearly documented. I wish all security improvements were as simple and easy.",{"value":88,"source":81,"evidence":89},"Low overhead expected",[90,94],{"id":91,"by":92,"text":93},"10265843","acveilleux","probably lower overhead. PKCS#11 is a lot bigger than this.",{"id":95,"by":96,"text":97},"10265749","feld","Why would it matter? He already has an uphill battle with virtualization and seems a minimal amount of overhead. I expect running this on big iron should show similar or less…",[99,107,114],{"value":100,"source":81,"evidence":101},"RSA operations over IPC block the event loop in event-loop servers",[102,103],{"id":59,"by":60,"text":61},{"id":104,"by":105,"text":106},"10269275","pquerna","Inter-process IPC is going to block the event loop for longer than a inline RSA operation.",{"value":108,"source":81,"evidence":109},"Overhead may be significant on high-end termination systems, untested there",[110],{"id":111,"by":112,"text":113},"10264579","ibejoeb","Seems like a good idea, but it also seems like a lot of IPC. The author suggests that crypto costs more than IPC, so it doesn't matter much, which also seems reasonable, and I…",{"value":115,"source":81,"evidence":116},"Blocking IPC could limit new connections per second in single-threaded servers",[117],{"id":118,"by":105,"text":119},"10268192","The point is that it requires TLS handshakes to be done in a multi-threaded system for a server handling high concurrency. Many servers are multi-threaded, but many are not.…",[121,125],{"value":122,"source":81,"evidence":123},"Benchmarks on high-end server hardware",[124],{"id":111,"by":112,"text":113},{"value":126,"source":81,"evidence":127},"An LD_PRELOAD version",[128],{"id":129,"by":130,"text":131},"10265623","ryan-c","Someone should make an LD_PRELOAD hack for this. I might try throwing one together this weekend if someone doesn't beat me to it.",[133],{"value":134,"source":81,"evidence":135},"How does it differ from SoftHSM?",[136],{"id":137,"by":138,"text":139},"10264973","gg1989","How is it different than using a SoftHSM?",[141,146],{"value":142,"source":81,"evidence":143},"Keyless SSL (Cloudflare)",[144,145],{"id":59,"by":60,"text":61},{"id":52,"by":11,"text":53},{"value":147,"source":81,"evidence":148},"SoftHSM \u002F PKCS#11",[149,150],{"id":137,"by":138,"text":139},{"id":91,"by":92,"text":93},{"comments":32,"answered":34,"key":152},[153,154,157],{"id":52,"text":53},{"id":155,"text":156},"10268461","Wrong. You seem to have confusion between TLS handshakes and RSA operations. In OpenSSL (which is used by many servers including node.js, nginx), RSA operation is always…",{"id":158,"text":159},"10269883","It is true that RSA operation over IPC is slower than doing it internally. But the latter is by magnitudes faster than the former, therefore the slowdown is negligible in…",{"commenters":161,"max_depth":162,"maker_replies":32,"first_comment_mins":163,"lifespan_hours":18},9,6,437,[165,167,169,171,172,173,174,176,177,179,181,184],[59,34,38,166,60,34],"project\u002Fcritical\u002Fperformance",[52,34,34,168,11,38],"commenter\u002Fneutral\u002Fperformance",[118,34,34,170,105,34],"commenter\u002Fcritical\u002Fperformance",[155,34,34,168,11,38],[104,34,38,166,105,34],[158,34,34,168,11,38],[111,38,32,175,112,34],"project\u002Fneutral\u002Fperformance",[95,38,34,168,96,34],[84,33,42,178,85,34],"project\u002Fpositive\u002Fdocs",[129,32,42,180,130,34],"project\u002Fpositive\u002Fidea",[137,182,32,183,138,34],4,"project\u002Fneutral\u002Fidea",[91,182,42,185,92,34],"project\u002Fpositive\u002Fperformance",[],[188,193,198,203,208,212],{"id":189,"name":190,"points":191,"category":192},"10249362","%%30%30",608,"games",{"id":194,"name":195,"points":196,"category":197},"10248773","Hacker News Simulator",572,"other",{"id":199,"name":200,"points":201,"category":202},"10251686","Sheetsu",357,"dev_tools",{"id":204,"name":205,"points":206,"category":207},"10260302","Kiddo Paint",162,"creative",{"id":209,"name":210,"points":211,"category":202},"10231907","rnplay",124,{"id":213,"name":214,"points":215,"category":216},"10248566","Live Simple",80,"web_saas",false,"v2",{"id":220,"name":5,"line":6,"ai":217,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":221,"top":18,"kw":222,"maker":11,"domain":10,"tier":19,"attempts":34,"strip":223,"url":9,"mix":224,"praise":80,"objection":100,"sub":21},10263410,0.11,[24,25,26,27,28],"100010305535",[32,33,34,33],1793990930889]