Why did the OpenSSL punycode vulnerability happen?
words.filippo.io
Why did the OpenSSL punycode vulnerability happen?
1–10 of 104 posts
Re: Why did the OpenSSL punycode vulnerability happen?
#2No post body was provided.
Re: Why did the OpenSSL punycode vulnerability happen?
#3Quoted post unavailable.
Some systems steer people into the pit of failure, others steer people towards the pit of success.
Re: Why did the OpenSSL punycode vulnerability happen?
#4Quoted post unavailable.
The answer to your question is in most if not all arguments against the widespread use of C/C++ in something as high level as OpenSSL. C and C++ ask a lot of developers, mostly in terms of ensuring memory safety. It’s possible to write crappy code in Rust, sure, but the language design has taken the decades of experience of knowing where C falls short and provides a more safe natural path. The long-running rebuttal to this is “it’s as easy as using function x instead of function y!” with the name of function x being some inscrutable derivative of the name of function y. If it’s so easy, why do C codebases keep having the same issues? I’d seriously question the software development experience of someone that doesn’t see the value in reducing developer cognitive load.
Re: Why did the OpenSSL punycode vulnerability happen?
#5Quoted post unavailable.
"Eschew flamebait. Avoid generic tangents."
Re: Why did the OpenSSL punycode vulnerability happen?
#6Ongoing related thread:
The latest OpenSSL vulns were added fairly recently - https://news.ycombinator.com/item?id=33437158 - Nov 2022 (56 comments)
Re: Why did the OpenSSL punycode vulnerability happen?
#7It feels like issues like those are more common in parsers, this specific kind of software.
But why?
Why is parsing so hard? or is it just in low lvl languages? or maybe languages with poor string primitives?
I've written parsers in high level languages and it didnt felt dangerous or insanely hard
Re: Why did the OpenSSL punycode vulnerability happen?
#8It feels like issues like those are more common in parsers, this specific kind of software. But why? Why is parsing so hard? or is it just in low lvl languages? or maybe languages with poor string primitives? I've written parsers in high level languages and it didnt felt dangerous or insanely hard
Probably low level + safe + performant == hard
Re: Why did the OpenSSL punycode vulnerability happen?
#9It feels like issues like those are more common in parsers, this specific kind of software. But why? Why is parsing so hard? or is it just in low lvl languages? or maybe languages with poor string primitives? I've written parsers in high level languages and it didnt felt dangerous or insanely hard
Probably low level + safe + performant == hard
But why? where does the complexity come from
Re: Why did the OpenSSL punycode vulnerability happen?
#10Earlier quoted context omitted.
Probably low level + safe + performant == hard
But why? where does the complexity come from
There are naturally lots of edge cases when you parse a format, because you have to constrain the combination of all the different fields.
Some formats are simple and the fields don't interact with each other at all, some are complex and the format changes depending on other values.
Parsing is hard because you have to handle all the possible inputs someone could throw at you, and depending on the format that can leave hundreds of very rare edge case no reasonable human would normally think of.
This is also why fuzzing is so effective on parser, fuzzers are great at throwing many different combinations at the wall until they find a new interesting edge case, and jumping off from there to see if they can mutate it into more.