Apple's SSL/TLS bug

Post by jey » Sat, Feb 22, 2014, 7:32 PM UTC

hueving wrote: post #167

acdha wrote: post #117

Earlier quoted context omitted.

> Indeed the only secure OS nowadays is Linux Tell that to the people who generated keys on Debian. Programmers are simply not good enough at writing secure code. Full stop. If you say anything else, you're just flaunting your own unreliability as a source of security advice.

At least that was public and fixed. I think the point is that keys could be completely deterministic on closed source systems and there is no way to know. It's very easy to have deterministic "random" sources that pass statistical tests for randomness.

Post by Tloewald » Sat, Feb 22, 2014, 7:39 PM UTC

mistercow wrote: post #144

Tloewald wrote: post #41

Earlier quoted context omitted.

I hate omitting braces, but Javascript semicolon omission is a totally different argument. It's easy to show simple cases where omitting braces causes problems. It's actually quite difficult and artificial to find cases where (especially with "use strict") semicolons confer any benefit at all, and in some cases they make things worse (e.g. multi-line variable declarations). Also, "correct" use of semicolons in Javasc…

I used to believe as you do that semicolon issues were contrived and unlikely in JavaScript. But over the years I've been bitten by it enough times to know better. IIFEs are the most common source of semicolon problems: for(i = 0; i A less common sort of pattern that I still use pretty often as a DRY measure: init() [x, y, z].forEach(function(a){ if(a.length > 5) { process(a) } }) This is clean and readable, and with…

Post by bunderbunder » Sat, Feb 22, 2014, 7:41 PM UTC

orangecat wrote: post #138

bunderbunder wrote: post #107

Earlier quoted context omitted.

If you have a programmer on your team who is likely to modify if (condition) { doSomething(); } into if (condition) { doSomething(); } { doAnotherThing(); } instead of if (condition) { doSomething(); doAnotherThing(); } then that person needs some serious mentoring right away. 'Cuz. . . just wow. As far as the original example goes, if it's an error it's most likely a copy/paste error. Curly braces help there, too. W…

As far as the original example goes, if it's an error it's most likely a copy/paste error. Right, and this demonstrates the major problem with verbosity in languages and APIs and design patterns. When you have to repeat yourself many times, it's very easy to make a mistake in one of the near-copies, and you or a code reviewer can miss it because you'll tend to quickly skim over the boilerplate. For cases like this, u…

  if (   (err = SSLHashSHA1.update(&hashCtx, &serverRandom) != 0)
      || (err = SSLHashSHA1.update(&hashCtx, &signedParams) != 0)
      || (err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0))
  {
     goto fail;
  }

Post by hueving » Sat, Feb 22, 2014, 7:50 PM UTC

jey wrote: post #181

hueving wrote: post #167

Earlier quoted context omitted.

At least that was public and fixed. I think the point is that keys could be completely deterministic on closed source systems and there is no way to know. It's very easy to have deterministic "random" sources that pass statistical tests for randomness.

Not true. IIRC, the way the Debian bug was found was by some parties noticing a bunch of collisions of SSH public keys. (For example, Github lets you push/pull via SSH as git@github.com, and they determine your identity by the SSH key used.)

Post by raverbashing » Sat, Feb 22, 2014, 7:57 PM UTC

Tloewald wrote: post #184

raverbashing wrote: post #180

Earlier quoted context omitted.

"It's actually quite difficult and artificial to find cases where (especially with "use strict") semicolons confer any benefit at all," Hence these are the cases where more time and resources will be wasted because of it. "I certainly see far more bugs caused by an improperly inserted semicolon" What would be an example of this? Because I've seen exactly zero bugs of this type (not counting typos, of course)

var a = 17, b = 13; c = 5; (usually this will be across multiple lines) ...just overwrote c in a different scope. This kind of bug is common, idiomatic, baffling, and actually more likely among coders subscribing to javascript "best practices".