Re: Ada's ranking of popularity at IEEE Spectrum

[Shark8 <OneWingedShark@gmail.com>]

On 10-Jul-14 18:16, Simon Clubley wrote:
> On 2014-07-10, Marius Amado-Alves <amado.alves@gmail.com> wrote:
>>> My current number one example: implementing OpenSSL in Ada is exactly
>>> the kind of thing Ada would be good at. Unfortunately, it's also not
>>> practical.
>>
>> On the contrary, it would be very practical to have AWS working well with SSL...
>> I was never able to do that on Windows.
>> AWS is a great lib, but horrible at installing.
>
> A requirement behind rewriting OpenSSL would be to enable it's use in
> _all_ the operating systems and platforms which currently use OpenSSL.
> If this isn't the case, your replacement is destined to remain a niche
> and generally forgotten product. It would also need to be compatible
> with OpenSSL's API.

What is the cost of writing an API compatibility layer compared to that 
of a formally verified implementation of SSL? What is the difficulty 
level of presenting the SSL-implementation in a manner that conforms to 
OpenSSL's API?

>
> While I focused on OpenSSL in my comments, Ada (as a language) would
> also be a good choice for replacing the client side SSL libraries such
> as Firefox's use of NSS.

If the effort to implement the protocol with formal verification is 
made, then it only makes sense to do both client and server 
implementations -- the tests for each would of necessity use the other.

>
> Unfortunately the same issues apply here because unless your SSL client
> library replacement can operate in all the same environments as the C
> language library it would replace, then it's destined to remain a niche
> and forgotten product.
>
> Simon.
>

Ridiculous -- even without availability on *every* system a secure SSL 
implementation would be welcome in servers by businesses concerned w/ 
security.

As an example, the formally verified DNS Ironsides was usable even when 
it did not support the recursive form of DNS -- now that it handles both 
the authoritative and recursive forms there is little to prevent 
adoption by [small] businesses. (I know of one semi-locally that'll be 
switching over, says the BIND configuration he has now is rather complex 
and finicky.)