Skip to content

Commit 0704528

Browse files
jericsonjericson
committed
New post
1 parent c8570b6 commit 0704528

File tree

1 file changed

+139
-0
lines changed

1 file changed

+139
-0
lines changed

‎_posts/2025-01-20-conway_judo.md‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
layout: post
3+
title: Using Conway's Law for good
4+
tags: conways_law openssl
5+
comments: yes
6+
---
7+
8+
During my [first week at
9+
OpenSSL](https://openssl-library.org/post/2025-01-17-introducing-jon/),
10+
I've been learning more about the organizational structure. A question
11+
has gnawed at me since I first learned about the job: Why was the
12+
Foundation split off from the Corporation? I can [read about the
13+
decision](https://openssl-library.org/post/2024-07-24-openssl-new-governance-structure/),
14+
but as an outsider I don't really have the background needed to truly
15+
understand how OpenSSL got here.
16+
17+
## A brief history of OpenSSL
18+
19+
The OpenSSL project is synonymous with the SSL protocol [developed by
20+
Netscape in
21+
1995](https://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_1.0,_2.0,_and_3.0). This
22+
enabled secure communication between the Netscape Navigator browser
23+
and the Netscape Commerce Server.^[You can read the [Netscape Commerce
24+
and Communications Servers Administrator’s
25+
Guide](https://irix7.com/techpubs/007-2909-001.pdf) on the internet.]
26+
Unfortunately, some of the cryptographic algorithms required to
27+
implement the protocol were [illegal to export from the
28+
US](https://web.archive.org/web/19991012050824/http://www.columbia.edu:80/~ariel/ssleay/ssleay-legal-faq.html)
29+
at the time.^[As an act of civil disobedience, some people put copies
30+
of the RSA algorithm in [their email signatures, on T-shirts and
31+
tatoos](http://www.cypherspace.org/rsa/). It was a strange time.] So
32+
two engineers from Australia, Eric A. Young and Tim J. Hudson
33+
[developed SSLeay](https://en.wikipedia.org/wiki/SSLeay) as an
34+
open-source library that could be used by developers around the world.
35+
36+
In 1998 the developers of SSLeay were hired by [RSA
37+
Security](https://en.wikipedia.org/wiki/RSA_Security) and stopped
38+
working on the project. In order to continue to have an open source
39+
SSL library, a group of volunteers forked SSLeay to start OpenSSL. The
40+
new project relied on donations which amounted to [~$2,000 a
41+
year](https://groups.google.com/g/mailing.openssl.users/c/-P4T62ml_1I/m/cOgioSoOUPEJ). Clearly
42+
that's not enough to support even one programmer, so the project was
43+
largely developed by volunteers donating their time. So an integral
44+
part of the internet subsisted on a shoestring budget, the kindness of
45+
strangers and some consulting work.
46+
47+
Then the world of internet security changed. A subtle bug introduced
48+
in the OpenSSL code was revealed with the catchy label
49+
[Heartbleed](https://en.wikipedia.org/wiki/Heartbleed). It's not often
50+
a bug can be clearly explained in a cartoon:
51+
52+
[![Are you still there, server? It's me,
53+
Margaret.](https://imgs.xkcd.com/comics/heartbleed_explanation.png)](https://xkcd.com/1354/)
54+
55+
Given the importance of the project, Heartbleed prodded many people
56+
and organizations to take action to reduce the odds of future
57+
vulnerabilities. In particular, the Linux Foundation started the [Core
58+
Infrastructure
59+
Initiative](https://en.wikipedia.org/wiki/Core_Infrastructure_Initiative)
60+
which funded two full-time OpenSSL developers for three years. But the
61+
problem remained. How does a complicated and critically-important
62+
open-source project retain the expertise needed to fulfill its
63+
mission?
64+
65+
According to a [2023 post on the OpenSSL
66+
blog](https://openssl-foundation.org/post/2023-08-08-finances/):
67+
68+
> So since 2020, our main source of income is by selling support
69+
> contracts. Companies can purchase a contract if they need technical
70+
> help with OpenSSL or if they need access to support for older end of
71+
> life versions such as OpenSSL 1.0.2. Another driver for taking out
72+
> such contracts is FIPS, where companies may wish to have FIPS
73+
> compliant products with OpenSSL by rebranding our OpenSSL 3 FIPS
74+
> certificate.
75+
76+
So OpenSSL now has a sustainable source of income to pay for a team to
77+
manage the library for the foreseeable future.
78+
79+
## Conway Judo
80+
81+
I've [written about Conway's Law in the past](/tag/conways_law.html)
82+
in the past, but I think it's helpful to quote a summary from [the
83+
paper](https://www.melconway.com/Home/pdf/committees.pdf) it came
84+
from:
85+
86+
> The very act of organizing a design team means that certain design
87+
decisions have already been made, explicitly or otherwise. Given any
88+
design team organization, there is a class of design alternatives
89+
which cannot be effectively pursued by such an organization because
90+
the necessary communication paths do not exist. Therefore, there is no
91+
such thing as a design group which is both organized and unbiased.
92+
93+
One reading of the final sentence implies that Conway's Law always
94+
produces sub-optimal results. Would not an _unbiased_ design group be
95+
preferred to a biased team? Well, we know of several exceptions such
96+
as [adversarial legal
97+
systems](https://en.wikipedia.org/wiki/Adversarial_system) in which
98+
the parties are represented by lawyers who specifically advocate for
99+
their interests. Yes both representatives are biased, but the system
100+
as a whole is designed to give both the prosecution and defense the
101+
best possible arguments for their side of the case.
102+
103+
WE can see another example in the sometimes unseemly world of
104+
politics: [special-interest
105+
groups](https://en.wikipedia.org/wiki/Advocacy_group). By advocating
106+
for a specific policy, issue or cause, lobbyists behave in a biased
107+
way that benefits people who agree with the groups' aims. As long as
108+
an organization [avoids mission
109+
creep](/2024/12/31/warrant_canary.html), bias gives the group's
110+
purpose the best chance to overcome competing or opposing interests.
111+
112+
Everybody involved in OpenSSL cares about providing an excellent
113+
library of cryptography tools that will minimize catastrophic bugs
114+
such as Heartbleed. Securing a sustainable income stream to pay
115+
developers to work on the library aided that cause. But there's always
116+
a risk that meeting the needs of paying customers could distract from
117+
the larger goal of providing security and privacy tools to _everyone_.
118+
119+
Last year OpenSSL turned off [GitHub sponsorship for the
120+
project](https://github.com/sponsors/openssl) while it evaluated its
121+
own organizational structure. It's hard to know what to do with
122+
donations when the project can sustain itself commercially. The
123+
practical answer was to split OpenSSL into two pieces:
124+
125+
* The [OpenSSL Corporation](https://openssl-corporation.org/), which
126+
focuses on commercial interests, and
127+
* The [OpenSSL Foundation](openssl-foundation.org), which focuses on
128+
individuals, other open-source projects and academics.
129+
130+
As a result, the [Foundation accepted GitHub sponsors
131+
again](https://openssl-foundation.org/post/2024-12-11-individual-sponsorship/),
132+
which allows small donations. Those donations, in turn, fund parts of
133+
the mission that risk being overlooked in a unified structure. Our
134+
funding source changes our communication paths so that we can
135+
effectively work on features that might not have any commercial
136+
application.
137+
138+
<!-- LocalWords: Heartbleed OpenSSL SSL
139+
-->

0 commit comments

Comments
 (0)