On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by spiralpolitik on Saturday February 22, 2014 @08:38PM (#7284574)

The vp of engineering should have invested in a good static analysis tool which would have spotted this section in about five seconds. Failing that turning on a sensible set of defaults in the compiler (warning about unreachable code) would have also drawn attention to it.

There are many many ways this should have been caught before it even left the building by numerous automated tools. Heck most modern IDEs will flag unreachable code in the editor so there is no real excuse for this. (Adding -Wunreachable-code to a sample project in Xcode immediately flags the next line).

The programmer is human which is why automated verification tools exist.

(AppCode's default inspections will also flag the issue providing you run them)

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by yeukhon on Saturday February 22, 2014 @09:33PM (#7284676)

I'd be really really surprised they didn't run this through static analysis. I will, to be honest, then maybe people are right about "it's stupid they make such stupid mistake."

I am not familiar with running static analysis and looking output, only did very minimal undefined behavior santisizer detection.

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by bsdetector on Sunday February 23, 2014 @05:51AM (#7285537)

I haven't been keeping up, but a year ago Google wasn't using any static analyzer at all on Chrome. They didn't use a real memory access checker like valgrind even to load a blank page, although they came up with a weaker memcheck that mostly works.

Lax development is par for the course at these mega corps.

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by asvitkine on Sunday February 23, 2014 @01:53PM (#7287007)

We've been using valgrind bots for a long time on the Chromium project - certainly for much longer than a year.

For example, according to the Wayback Machine, our sites page had an entry about it since 2009:

http://web.archive.org/web/20091123132855/http://www.chromiu...

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by bsdetector on Monday February 24, 2014 @09:21AM (#7290850)

I was thinking of this:

http://www.reddit.com/r/programming/comments/mw2sn/googles_a...

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by Nitramp on Sunday February 23, 2014 @08:14AM (#7285801)

I cannot comment on Chrome itself, but internal C++ development at Google has a pretty comprehensive array of checks, both static and dynamic.

[ Parent | on HN ]