OpenSSL Security Advisory - 26 Sep 2016

Re:OpenSSL Security Advisory - 26 Sep 2016 by adekok on Monday September 26, 2016 @09:04AM (#12581430)

There is a lot of room for improvement in the current OpenSSL code base. Simple cleanups, for one. Code formatting. Removing duplicate code. Static analysis. Unit tests.

The OpenSSL maintainers seem to be doing something other than all that. The historical defence for this was that they had minimal funding (which is no longer true), and that the funding they did have was for adding new features.

That's just not an acceptable excuse. And it never was an acceptable excuse.

Cleaning up code should be part of normal software development. Re-factoring code, adding unit tests, etc. Adding static analysis builds (clang is free, and Coverity is free for open source projects).

It's 2016. Why are some people still using software practices from 1992?

[ Parent | on HN ]

Re:OpenSSL Security Advisory - 26 Sep 2016 by jeltz on Monday September 26, 2016 @12:40PM (#12583327)

They are cleaning up the code, which I noticed when porting PostgreSQL to OpenSSL 1.1 and things were broken all over the place. I just think the code base is very bad to start with and the cleanup just start very recently.

[ Parent | on HN ]

Re:OpenSSL Security Advisory - 26 Sep 2016 by e40 on Monday September 26, 2016 @10:42AM (#12582203)

Has this been suggested to the OpenSSL devs? If so, what did they say? If not, adekok, perhaps you can do that. You are 100% correct here.

[ Parent | on HN ]

Re:OpenSSL Security Advisory - 26 Sep 2016 by adekok on Monday September 26, 2016 @11:02AM (#12582379)

That's pretty much what the LibreSSL people have done. And no, they didn't get much response or buy-in.

[ Parent | on HN ]