News for hackers. Stuff that matters.
Re:Why CVE-2022-3602 was not detected by fuzz testing by jabart on Monday November 21, 2022 @12:29PM (#33695258)
Keep in mind that Ubuntu compiled OpenSSL using a gcc flag that turns this one byte overflow into a crash instead of a memory leak/corrpution because it has a way to do that already. It's very risky, and a very long term project to rewrite something with this level of history into a completely new language.
Re:Why CVE-2022-3602 was not detected by fuzz testing by coder543 on Monday November 21, 2022 @12:33PM (#33695332)
> It's very risky, and a very long term project to rewrite something with this level of history into a completely new language.

I did not suggest a complete rewrite of the project. However, they could choose to only write new code in something else, and they could rewrite certain critical paths too. The bulk of the code would continue to be a liability written in C.

I agree that it would be nearly impossible to rewrite OpenSSL as-is. It would take huge amounts of funding and time. In general, people with that much funding are probably better off starting from scratch and focusing on only the most commonly used functionality, as well as designing the public interface to be more ergonomic / harder to misuse.