Why CVE-2022-3602 was not detected by fuzz testing

Re:Why CVE-2022-3602 was not detected by fuzz testing by pizza234 on Monday November 21, 2022 @12:14PM (#33695045)

I'm of the opinion that in cases like this, it'd be better for the organization to close, and allow the gap to be filled naturaly.

If the current OpenSSL maintainers closed the project, given its importance, there would be a rush to follow up maintenance. Chances are, it'd be better funded; even in worst case, it'll hardly be assigned less than two devs.

This a case of the general dynamic where a barely-sufficient-but-arguably-insufficient solution prevents actors from finding and executing a proper one.

[ Parent | on HN ]

Re:Why CVE-2022-3602 was not detected by fuzz testing by SoftTalker on Monday November 21, 2022 @03:05PM (#33697220)

For a project like OpenSSL, it's not just having "enough" developers (whatever that is) it's having qualified developers. Writing good crypto code requires deep expertise. There aren't a lot of people with such expertise whose time is not already fully committed.

[ Parent | on HN ]

Re:Why CVE-2022-3602 was not detected by fuzz testing by AdamJacobMuller on Monday November 21, 2022 @03:06PM (#33697231)

You don't even have to close. You can just refuse to merge code which does not include 100% test coverage. If someone wants the feature badly enough, they will figure out a way to fill the gap. Alternatively, someone can always fork the code and release "OpenSSL-but-with-lots-of-untested-code" variant.

[ Parent | on HN ]