Was the iOS SSL Flaw Deliberate?

Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @12:32PM (#7313501)

You think that because you learned about the bug from blog posts that just showed the diff. If that was what the developers of the stack saw, I'd agree. But of course, that isn't all they saw: you're looking at a needle in a haystack that someone has taken the time to find for you, and then wondering why it was so hard for anyone to distinguish between a needle and a blade of grass.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by pessimizer on Thursday February 27, 2014 @12:43PM (#7313592)

I'm not thinking that from the diff, I'm thinking that from the two gotos in a row.

Can you think of a reason why that would be in any computer program, and if you saw it in while reading any code, wouldn't it either indicate some weird trick that you maybe don't understand (and should look up) or an obvious error?

It doesn't look like anything that any static analysis tool wouldn't instantly scream about, either. I can't think of a less subtle error to accomplish the same thing.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @12:45PM (#7313613)

Have you been reading the same technical coverage of this story that I have? Because what I'm reading is people saying that their static analysis regimes wouldn't have caught this, starting with Adam Langley. Veracode, which exists to sell a tool designed specifically to catch stuff like this, wrote the same thing.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by pessimizer on Thursday February 27, 2014 @12:54PM (#7313678)

I haven't. I'd like links, though. If I can see with my eyes that code will never be executed, I'd like to know what's wrong with the state of current static analysis.

edit: http://blog.veracode.com/2014/02/do-not-pass-qa-do-not-goto-...

Veracode does static analysis of the binary, and says that it would be thwarted because it wouldn't know that some functions were meant to be called. Static code analysis would tell you that it was impossible for some of the code to be run.

edit 2:(the second comment on the vericode blog)

caf | February 24, 2014 11:05 pm

In the Evil Unit Tests part you can use code coverage tools to at least verify that your unit tests exercise all code paths. It won’t catch every bug, but it would have caught this one.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @01:31PM (#7313951)

Unit test coverage isn't static analysis. It's practically the opposite of static analysis.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by pessimizer on Thursday February 27, 2014 @01:58PM (#7314143)

I'm not talking about unit test coverage:) I read the comment too quickly.

I'm talking about tools like http://oclint.org/ and http://clang-analyzer.llvm.org/

If they work anything like similar tools in other languages, they would have found this bug trivially.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @02:15PM (#7314256)

Yes, along with hundreds of other issues that would have had no security impact.

[ Parent | on HN ]