On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by yeukhon on Saturday February 22, 2014 @09:33PM (#7284676)

I'd be really really surprised they didn't run this through static analysis. I will, to be honest, then maybe people are right about "it's stupid they make such stupid mistake."

I am not familiar with running static analysis and looking output, only did very minimal undefined behavior santisizer detection.

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by bsdetector on Sunday February 23, 2014 @05:51AM (#7285537)

I haven't been keeping up, but a year ago Google wasn't using any static analyzer at all on Chrome. They didn't use a real memory access checker like valgrind even to load a blank page, although they came up with a weaker memcheck that mostly works.

Lax development is par for the course at these mega corps.

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by asvitkine on Sunday February 23, 2014 @01:53PM (#7287007)

We've been using valgrind bots for a long time on the Chromium project - certainly for much longer than a year.

For example, according to the Wayback Machine, our sites page had an entry about it since 2009:

http://web.archive.org/web/20091123132855/http://www.chromiu...

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by bsdetector on Monday February 24, 2014 @09:21AM (#7290850)

I was thinking of this:

http://www.reddit.com/r/programming/comments/mw2sn/googles_a...

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by Nitramp on Sunday February 23, 2014 @08:14AM (#7285801)

I cannot comment on Chrome itself, but internal C++ development at Google has a pretty comprehensive array of checks, both static and dynamic.

[ Parent | on HN ]