"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
1–10 of 245 posts
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#2Great analysis. Theo is always up front on this sort of stuff which is commendable.
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#3This should be a case study about why people developing system-critical software shouldn't write their own memory allocators.
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#4So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#5Great analysis. Theo is always up front on this sort of stuff which is commendable.
Could have done without the final line though, but I guess it's his equivalent of a signature...
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#6So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?
GnuTLS exists. And NSS in mozilla. Probably others too.
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#7I echo what someone said earlier on another OpenSSL thread: security applications should not be handling their own memory at a low level like this. It's just too easy to mess up, and it often leads to the worst vulnerabilities.
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#8So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?
GnuTLS exists. And NSS in mozilla. Probably others too.
cURL makes a nice comparison: http://curl.haxx.se/docs/ssl-compared.html
GnuTLS had its own problems recently (see: http://www.gnutls.org/security.html), and regarding NSS... I couldn't find a proper public "security" page for it (eg, release notes for 3.16 point to CVE-2014-1492; but the link to the bugzilla issue is not public), so I don't know.
Obviously a good security record doesn't imply things like a good code base, good practices, etc; (although it could).
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#9This should be a case study about why people developing system-critical software shouldn't write their own memory allocators.
At a first approximation, no one should write their own memory allocator. Just as no one should write their own garbage collector, and no one should write their own filesystem.
All these subsystems have one thing in common: they are incredibly complex and very hard to get right, but seem easy on the outside.
Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
#10Great analysis. Theo is always up front on this sort of stuff which is commendable.
For the benefit of those who don't know who he is: