Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSL Security Advisory

openssl.org

Post reply on HN
Print view View original

141–142 of 142 posts

Re: OpenSSL Security Advisory

#141

Post by dozzie »

jandrese wrote: post #128
dozzie wrote: post #99

Earlier quoted context omitted.

And how long is LibreSSL on the market? A year? It's hard to call it proof . It's easy to point intervals longer than whole LibreSSL lifetime with no security bugs in OpenSSL.

LibreSSL is a cleanup of the OpenSSL base. They started with OpenSSL and worked from there. They have mostly deleted code, not added it, so they shouldn't be adding many new vulerabilities. On top of this, it is being written by the OpenBSD/OpenSSH people, who have a good history with writing secure software.

Still, a sole year is hardly an evidence of quality.

Re: OpenSSL Security Advisory

#142

Post by tracker1 »

breakingcups wrote: post #140
tracker1 wrote: post #139

Earlier quoted context omitted.

Personally, I say if a statement continues on a different line, then you should use braces //okay if (condition) return foo; //not okay if (condition) return foo; //not okay if (condition) do_foo(); else do_bar(); In the second case, the else can be considered a continuation. In the first example, there's little chance of confusion or the introduction of an error, in the second and third, that is not necessarily the…

What about: if((somevar != checkvar((byte)othervar)) & (i != 3)) somefunc(); someotherfunc(); A bit exaggerating, I agree, but not far off from some real-world examples and quite confusing.

Nice, in that case, I might advocate for either somefunc or a function in front of it taking somevar, othervar and i as parameters with early return statements before falling through to the work.. returning a boolean for if they passed through...

I've seen far, far, far worse...

Post reply on HN