Re: OpenSSL's MD5?

Brian Burton (Mon 01/02/06 09:19):
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> Stefan Walter wrote:
> > the FreeBSD port of spamprobe 1.2a has a local patch [1] to make use of
> > OpenSSL's MD5 functions instead of using spamprobe's own implementation of
> > the algorithm. Since the update of the port to version 1.4 would involve
> > either making a new local patch or leave the code alone in the future, I
> > was wondering what the reason is for spamprobe using its own
> > implementation. OpenSSL should be available wherever spamprobe is used,
> > and by using its routines one wouldn't have to maintain another
> > implementation.
>  >
>  > What do you think?
> 
> The original FreeBSD port maintainer and I had a discussion about this. 
>   My position is that the MD5 implementation used by SpamProbe is free, 
> small, and guaranteed to be present everywhere because it comes as part 
> of SP.  I want SP to have as few external dependencies as possible. 
> Currently you can build and run SP on a system with just a C++ compiler 
> and no extra third party libararies.  I like that and intend to keep it 
> that way.
> 
> As far as maintenance goes I would have more coding and maintenance work 
> if I tried to support two MD5 libaries (Aladdin and OpenSSL) vs the one 
> that I have now.  The SP MD5 digest does not need to interact with any 
> other MD5 implementation (i.e. the digests are used internally by SP, 
> not passed on to any other entity) so even if they are wrong (which I 
> don't believe them to be) it would not matter.  The Aladdin 
> implementation runs cleanly in valgrind so I don't believe it to have 
> any memory bugs.
> 
> So my advice is to simply use the MD5 that comes with SP and be happy. 
> Had the original maintainer done so his port would probably still work 
> trivially with 1.4.  I compile and test SP on a FreeBSD 4.5 VM and it 
> compiles cleanly so the port really shouldn't have to do any patching to 
> SP.  If you find any patches that are necessary to get SP to compile 
> please let me know and I'll correct the problem in an updated release.
> 
> All the best,
> ++Brian

I just submitted a PR for v1.4. Since the md5 patch was removed and 
subsequently re-added it seemed like there was a strong preference to 
use openssl/md5 somewhere so that's how I left it. However, I had no
problems compiling with the Aladdin md5. Running a quick test on a 
corpus of about 14k messages using auto-train showed no difference in
performance or signatures. Oh well, perhaps the patch can be removed 
in the future.

On the topic of the FreeBSD port, I didn't see a port for PBL so I 
created one, tested it with v1.4, and it seemed to work fine. Is PBL 
the preferred DB?

Zach


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click