OpenSSL Security Advisory

Re:OpenSSL Security Advisory by ctz on Thursday September 22, 2016 @02:01PM (#12558758)

I've spent a career of 12 years writing, reviewing and breaking C in high-security products such as HSMs. I'm still to see real world, secure C. Maybe you could point me towards the numerous real world examples of people getting this right. I'd prefer scaled-up outcomes here, not just saying 'djb wrote qmail'.

(Incidentally, I don't have a quarrel with C specifically. All memory-unsafe languages expand the range of terrible vulnerabilities available to the engineer. This is not defensible these days, in my view.)

> So please, pave the road and show us the safer OpenSSL-rust you have.

My contribution here is https://github.com/ctz/rustls

[ Parent | on HN ]

Re:OpenSSL Security Advisory by astrodust on Thursday September 22, 2016 @06:09PM (#12560749)

DJB wrote Qmail, then abandoned it like an unwanted child. He might be a good programmer, but he's a really bad maintainer.

OpenSSL was all but abandoned as well. At least now there's a lot of attention being focused on making it better and more maintainable.

There's numerous tire fires out there: ImageMagick, OpenSSL, some Linux kernel drivers, and other projects people just take for granted without pitching in to help fix things.

Re-writing in Rust is a form of helping, and maybe in the process we'll find bugs in the originals or wholesale replace them with something better.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by andrewchambers on Thursday September 22, 2016 @08:21PM (#12561444)

I think OpenBSD beg to differ.

Not to mention I would argue memory exhaustion bugs like this happen in memory safe garbage collected languages frequently too.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by lambdasquirrel on Thursday September 22, 2016 @08:44PM (#12561530)

There are edge cases for everything. A language is what it makes easy.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by captn3m0 on Thursday September 22, 2016 @03:06PM (#12559335)

Off-topic, but a quick question on your project:

> Kerberos

>broken, obsolete, badly designed, underspecified, dangerous and/or insane

Which list does Kerberos fit in?

[ Parent | on HN ]

Re:OpenSSL Security Advisory by ctz on Thursday September 22, 2016 @03:35PM (#12559622)

There are no standard kerberos ciphersuites that use anything better than RC4/IDEA/DES/3DES: http://www.iana.org/assignments/tls-parameters/tls-parameter.... So: broken and obsolete.

[ Parent | on HN ]

Re:OpenSSL Security Advisory by emmelaich on Thursday September 22, 2016 @07:51PM (#12561324)

Recent Windows, Linux and Java Kerberos all standardise on AES* and the ones you list are deprecated and for some have to be explicitly enabled.

So .. progress is being made.

[ Parent | on HN ]