Why did the OpenSSL punycode vulnerability happen

Re:Why did the OpenSSL punycode vulnerability happen by midoridensha on Thursday November 03, 2022 @12:52AM (#33447155)

>Also, as we learned back when Heartbleed was discovered, the OpenSSL code is not in good shape. It "suffers from maintenance", as one clever wag said about legacy code. There's a reason LibreSSL forked the code. More distributions need to switch away from OpenSSL.

Anyone who's ever worked with the OpenSSL API or looked at its code can tell you that it's a steaming pile of crap. It's no surprise that this vulnerability was discovered. Honestly, OpenSSL should just be banned because it's so horrible, and there are better alternatives available.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by rurban on Friday November 04, 2022 @12:38AM (#33462254)

I just started making openssl -Werror safe. Oh my, what did I get into.

Halfway through it's about 125 changed files, > 1000 changes. look at the WIP commit. The API is insane. 50% of args are unused. All the structs and vtables updates are uninitialized, ie missing methods.

https://github.com/rurban/openssl/commits/Werror

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by cratermoon on Friday November 04, 2022 @08:27PM (#33476177)

One of the (possibly first?) things the LibreSSL people did after forking OpenSSL was to enable -Wall, -Werror, -Wextra, -Wuninitialized on the code[1]. Many years ago we'd look at compiler (and linter) warnings with a skeptical eye, but these days, they really mean something. That alone smoked out a lot of lurking problems.

1 https://en.wikipedia.org/wiki/LibreSSL#Proactive_measures

[ Parent | on HN ]