News for hackers. Stuff that matters.

A comment on "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable". Parent comment

Re:"OpenSSL has exploit mitigation countermeasures to make s... by jessaustin on Wednesday April 09, 2014 @08:07AM (#7558779)
There's a difference between "trusting his audit of the code" and "trusting his code". Any interested and motivated person can audit code. If nothing is found, that might not prove much. But if a vulnerability is found, the audit was worthwhile from some perspective.
[ Parent | on HN ]
Re:"OpenSSL has exploit mitigation countermeasures to make s... by amboar on Wednesday April 09, 2014 @08:27AM (#7558852)
Sure, so long as the bug is a genuine bug and not a misunderstanding. Debian's openssh valgrind warning springs to mind. Crypto implementations can be subtle and non obvious. Maybe it's crap design for that reason, but it seems like it's what we've got to work with currently.
[ Parent | on HN ]
Re:"OpenSSL has exploit mitigation countermeasures to make s... by sexmonad on Wednesday April 09, 2014 @02:43PM (#7561383)
That bug affected OpenSSL as well. Admittedly, it was caused by the Debian maintainer, but still, OpenSSL's poor design is partially to blame.
[ Parent | on HN ]