News for hackers. Stuff that matters.

A comment on Was the iOS SSL Flaw Deliberate?. Parent comment

Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @12:45PM (#7313613)
Have you been reading the same technical coverage of this story that I have? Because what I'm reading is people saying that their static analysis regimes wouldn't have caught this, starting with Adam Langley. Veracode, which exists to sell a tool designed specifically to catch stuff like this, wrote the same thing.
[ Parent | on HN ]
Re:Was the iOS SSL Flaw Deliberate? by pessimizer on Thursday February 27, 2014 @12:54PM (#7313678)
I haven't. I'd like links, though. If I can see with my eyes that code will never be executed, I'd like to know what's wrong with the state of current static analysis.

edit: http://blog.veracode.com/2014/02/do-not-pass-qa-do-not-goto-...

Veracode does static analysis of the binary, and says that it would be thwarted because it wouldn't know that some functions were meant to be called. Static code analysis would tell you that it was impossible for some of the code to be run.

edit 2:(the second comment on the vericode blog)

caf | February 24, 2014 11:05 pm

In the Evil Unit Tests part you can use code coverage tools to at least verify that your unit tests exercise all code paths. It won’t catch every bug, but it would have caught this one.

[ Parent | on HN ]
Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @01:31PM (#7313951)
Unit test coverage isn't static analysis. It's practically the opposite of static analysis.
[ Parent | on HN ]
Re:Was the iOS SSL Flaw Deliberate? by pessimizer on Thursday February 27, 2014 @01:58PM (#7314143)
I'm not talking about unit test coverage:) I read the comment too quickly.

I'm talking about tools like http://oclint.org/ and http://clang-analyzer.llvm.org/

If they work anything like similar tools in other languages, they would have found this bug trivially.

[ Parent | on HN ]
Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @02:15PM (#7314256)
Yes, along with hundreds of other issues that would have had no security impact.
[ Parent | on HN ]