Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's SSL/TLS bug

imperialviolet.org

Post reply on HN
Print view View original

51–60 of 295 posts

Re: Apple's SSL/TLS bug

#51

Post by spiralpolitik »

danieljh wrote: post #18

Emerging tools such as gofmt and clang-format are able to automatically re-format your code based on the language rules rather than the human behind the monitor. Using those tools this specific category of issues should at least be visible in the formating diff. Interesting. Never thought about it that way before.

Trying to get teams to agree on the code style is the hard part when using such tools. `gofmt` somewhat avoids that by defining one true way and only giving minor customization options.

Re: Apple's SSL/TLS bug

#52

Post by pjmlp »

Pacabel wrote: post #24
danieljh wrote: post #18

Emerging tools such as gofmt and clang-format are able to automatically re-format your code based on the language rules rather than the human behind the monitor. Using those tools this specific category of issues should at least be visible in the formating diff. Interesting. Never thought about it that way before.

Those kinds of tools aren't new or emerging. The "indent" utility for C has been around for decades. I first remember using it on 4.3BSD, but it may have been around before that.

Worse, lint was part of the original C toolchain, but very few people cared to use it, because they couldn't be bored to tune the tool to their projects.

This is the type of error that any static analysis tool would easily pick.

Re: Apple's SSL/TLS bug

#53

Post by adsr »

cantfindmypass wrote: post #31

I just made this - it'll tell you if you're vulnerable. https://gotofail.com/ Not very well tested, please let me know if it works for you. If you're on OS X Mavericks or on iOS 7 and haven't patched you should get big scary red text. Edit: posted here https://news.ycombinator.com/item?id=7282164

The article contains a similar test: https://www.imperialviolet.org:1266

Re: Apple's SSL/TLS bug

#54

Post by rdl »

Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Firefox of course is still fine since it uses the NSS stuff, but plenty of OS services use the OS crypto. (I'm violating NDA by commenting on pre-release Apple stuff, of course.)

Windows or ubuntu bootcamp until they fix this, I think.

Re: Apple's SSL/TLS bug

#55

Post by cantfindmypass »

plg wrote: post #49
cantfindmypass wrote: post #31

I just made this - it'll tell you if you're vulnerable. https://gotofail.com/ Not very well tested, please let me know if it works for you. If you're on OS X Mavericks or on iOS 7 and haven't patched you should get big scary red text. Edit: posted here https://news.ycombinator.com/item?id=7282164

"If you're on OS X Mavericks or on iOS 7 and haven't patched" how do I patch on OS X Mavericks? Software update shows nothing to update

There is no patch for Mavericks out yet. :-(

Re: Apple's SSL/TLS bug

#56

Post by arielweisberg »

How is this code not covered by a unit test?

I'll admit I don't think of myself as great at unit testing, but the first thing I do when writing one for a new tool or class is use a code coverage tool to look for uncovered lines and once I have written a few basic behavioral tests I write tests to exercise and validate the output of the uncovered lines.

This ensures that the tests I write to cover the public API don't miss catching internal behaviors that require more subtlety to uncover.

Re: Apple's SSL/TLS bug

#57

Post by llimllib »

arielweisberg wrote: post #56

How is this code not covered by a unit test? I'll admit I don't think of myself as great at unit testing, but the first thing I do when writing one for a new tool or class is use a code coverage tool to look for uncovered lines and once I have written a few basic behavioral tests I write tests to exercise and validate the output of the uncovered lines. This ensures that the tests I write to cover the public API don't…

> How is this code not covered by a unit test?

...or an integration test. or a functional test.

When you write an SSL lib, I suspect that at some point you ought to test that it checks f%^&ing certificates :/

Re: Apple's SSL/TLS bug

#58

Post by nikbackm »

eliasmacpherson wrote: post #42
nikbackm wrote: post #28

This could not have happened with C++ exceptions and RAII instead of manual error checking and goto for cleanup ;)

It could actually. Exceptions and RAII are not resilient against typos and programmer error. If the exception handler caught the wrong type, for example catching by value instead of reference, instead of having a catch(...) it would have the same problem as the above. It's harder to spot this sort of error than a double goto and incorrect parentheses - because you have to check the code that throws and the code that…

I don't see the possibility for catching the wrong type (or not catching it) if you get one character wrong. Unless of course you have two valid type names that just differ in one character, but that is a general pitfall and not exception specific.

If you always throw by value (and not by pointer) then it does not matter if you catch by value or by reference, the catch block will be activated either way. The only issue is possible slicing if you throw a derived instance and catch a base class type. You might lose error information that way, but the program will not crash due to an uncaught exception.

Re: Apple's SSL/TLS bug

#59

Post by rdl »

cantfindmypass wrote: post #31

I just made this - it'll tell you if you're vulnerable. https://gotofail.com/ Not very well tested, please let me know if it works for you. If you're on OS X Mavericks or on iOS 7 and haven't patched you should get big scary red text. Edit: posted here https://news.ycombinator.com/item?id=7282164

Your checker doesn't work well with curl, btw -- you end up seeing both the not vulnerable AND the vulnerable (alt text) messages.

Re: Apple's SSL/TLS bug

#60

Post by cantfindmypass »

adsr wrote: post #53
cantfindmypass wrote: post #31

I just made this - it'll tell you if you're vulnerable. https://gotofail.com/ Not very well tested, please let me know if it works for you. If you're on OS X Mavericks or on iOS 7 and haven't patched you should get big scary red text. Edit: posted here https://news.ycombinator.com/item?id=7282164

The article contains a similar test: https://www.imperialviolet.org:1266

I wanted to make something that gives something a little more useful than an error page if you're safe.
Post reply on HN