Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why was "goto fail;" added without any other change to that part of the code?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Why was "goto fail;" added without any other change to that part of the code?

#71

Post by tptacek »

miopa wrote: post #68
patio11 wrote: post #66

Earlier quoted context omitted.

Remember how Diaspora was supposed to be the private peer-to-peer encrypted Facebook but peers private keys could be read or overwritten by anyone on the Internet? Doesn't your argument suggest "Well we can't rule out the NSA having a man on the inside trying to undermine their encryption"? Heck, why not go all the way: the NSA funded Diaspora to bring Facebook to the negotiating table? Down this path lies madness. S…

Yes, we can't rule that. But we could clearly see that the Diaspora codebase screamed incompetence. Apple, on the other hand, has some very high quality products and decades of experience. Yes, it is quite possible that this is a simple bug. The other option is also quite possible :)

It is equally possible that Apple is a giant conspiracy dedicated to concealing the grey aliens who actually control human civilization and are harvesting our brainwaves, which actually function as the raw compute for a giant intergalactic payments call center application, via Flappy Bird. Think about it.

Re: Why was "goto fail;" added without any other change to that part of the code?

#72

Post by pessimizer »

matthewmacleod wrote: post #32
pessimizer wrote: post #30

Earlier quoted context omitted.

>it's hard to imagine a situation where such an action would be worthwhile, given the resources at the disposal of any such actor. This needs more defense. I find it hard to imagine a situation where such a minimal and deniable action with such a massive effect wouldn't be worthwhile.

This needs more defense. I find it hard to imagine a situation where such a minimal and deniable action with such a massive effect wouldn't be worthwhile. Because the goal of any such agency is not "let's render a minority of computing devices insecure for a short period under certain circumstances." That entire argument hinges on the idea that taking this action would have achieved some kind of desirable goal, when…

Thanks.

I think that your defense hinges on this being the only thing that they are doing. As one of many things, with no risk and little expended effort, why not?

>There are myriad easier ways to conduct individual surveillance if that was the goal

What's easier than getting a call from somebody placed at a tech company indicating that one of the most security critical pieces of code didn't have test coverage and wasn't statically analyzed before going into the build has a spot where an errant line could be inserted, in a way that could be argued later was accidental.

The total marginal cost to that hypothetical situation would have been to say 'ok.'

>these same agents already apparently have legal carte blanche to intercept traffic in other ways.

intercepting traffic != decoding traffic

Re: Why was "goto fail;" added without any other change to that part of the code?

#73

Post by pbsd »

miopa wrote: post #60
tptacek wrote: post #41

Earlier quoted context omitted.

No, it doesn't need a defense. There is no evidence to back up the idea that the bug was malicious. People that have worked on large C codebases have seen crazier things than this. Routinely . I understand that Rails developers believe that all the TLS stacks must have dense rspec test coverage and zero-warnings static analysis passes in their builds, but that isn't the reality for any TLS stack. These aren't Rails a…

1. It is certain that NSA has some very smart people playing with the sources of the Apple crypto-modules. 2. If you're a NSA boss, and some of your experts told you that you can break SSL in Apple products with adding one line that could be almost certainly attributed to inconspicuous human error, would you try to make a deal with Apple? 3. If you're an Apple boss, and NSA offers you cache (or other benefits, like c…

People seem to forget that NSA is not the only player in town. When you plant weaknesses into things, you need to make sure that you're not actually helping your adversaries. You need to carefully weigh the chance/cost of discovery by an adversary against what you get out of the weakness. The perfect case is when you're guaranteed to own the weakness, ala Dual_EC_DRBG.

Consider that the NSA has already been known to burn stolen certificates for malware code signing. It's therefore not a stretch to assume they can easily MITM TLS without needing the help from bugs.

If they planted this bug, they would have been effectively democratizing TLS MITM to virtually everyone. This would help their adversaries more than it would help them, so I'm not convinced. It's easier for me to buy that the Chrome Pinkie Pie bugs were planted, due to the hardness of their discovery, than this could ever be.

Re: Why was "goto fail;" added without any other change to that part of the code?

#74

Post by pessimizer »

tptacek wrote: post #69
pessimizer wrote: post #63

Earlier quoted context omitted.

>it's hard to imagine a situation where such an action would be worthwhile, given the resources at the disposal of any such actor. This needs a defense. >There is no evidence to back up the idea that the bug was malicious. This is completely unrelated to what I said needs a defense. It's like you weren't even responding to me. edit: I don't know Rails.

As if read from a script, the discussion now flees to abstraction and hypothetical. I'm not interested.

I don't know what you're talking about, or what you're responding to that I've said, so your lack of interest is not hurting my feelings.

Re: Why was "goto fail;" added without any other change to that part of the code?

#76

Post by DanHulton »

bakhy wrote: post #53
chrismcb wrote: post #49

Earlier quoted context omitted.

This isn't goto's fault. A return, or a "finished = true;" or a ton of other code could have had the same result. Using a goto means it is easier to find it than some other similar mistakes.

All three of those patterns are something which would lead me to consider is there a more functional-style option available to rewrite the method in question. I'll take a gigantic nested if over a split-end method (multiple exit points) any day of the week ;) But of course, such things cannot be avoided completely, nor will avoiding them magically eliminate all bugs in the universe..

Hm, and I'm of the opposite opinion. I like methods that fail early. Gigantic if-chains are hella-hard to parse.

I should go consult Code Complete again, actually...

Re: Why was "goto fail;" added without any other change to that part of the code?

#77

Post by chc »

miopa wrote: post #60
tptacek wrote: post #41

Earlier quoted context omitted.

No, it doesn't need a defense. There is no evidence to back up the idea that the bug was malicious. People that have worked on large C codebases have seen crazier things than this. Routinely . I understand that Rails developers believe that all the TLS stacks must have dense rspec test coverage and zero-warnings static analysis passes in their builds, but that isn't the reality for any TLS stack. These aren't Rails a…

1. It is certain that NSA has some very smart people playing with the sources of the Apple crypto-modules. 2. If you're a NSA boss, and some of your experts told you that you can break SSL in Apple products with adding one line that could be almost certainly attributed to inconspicuous human error, would you try to make a deal with Apple? 3. If you're an Apple boss, and NSA offers you cache (or other benefits, like c…

> If you're an Apple boss, and NSA offers you cache (or other benefits, like competitor intelligence) for adding plausibly deniable bug in your code, would you turn it down?

With other companies, I might find this plausible, but I do not believe Apple is very hard-up for cash or direction on which way the market is going. It seems to me that they have more to lose from a high-profile security breach (say, if this vulnerability had been used in a mass theft) than they do to gain from anything the NSA could offer them.

Re: Why was "goto fail;" added without any other change to that part of the code?

#78

Post by cjbprime »

shawabawa3 wrote: post #55
lyngvi wrote: post #16

Earlier quoted context omitted.

++ on mismerge. The change likely won't impact the output binary - compiler should issue a warning, which devs might ignore; then the optimizer would remove it as unreachable. Perhaps the developer deliberately allowed that mismerge to give himself an aura of incompetence/sloppiness, enhancing his plausible deniability when it is discovered that one of his other changes led to an insidious vulnerability. But more lik…

> The change likely won't impact the output binary - compiler should issue a warning, which devs might ignore; then the optimizer would remove it as unreachable. It's not unreachable - it always executes if the if condition is false.

The unconditional "goto out" makes the code beneath that condition but before the "out:" label unreachable code.

Re: Why was "goto fail;" added without any other change to that part of the code?

#79

Post by luke-stanley »

tptacek wrote: post #71
miopa wrote: post #68

Earlier quoted context omitted.

Yes, we can't rule that. But we could clearly see that the Diaspora codebase screamed incompetence. Apple, on the other hand, has some very high quality products and decades of experience. Yes, it is quite possible that this is a simple bug. The other option is also quite possible :)

It is equally possible that Apple is a giant conspiracy dedicated to concealing the grey aliens who actually control human civilization and are harvesting our brainwaves, which actually function as the raw compute for a giant intergalactic payments call center application, via Flappy Bird. Think about it.

That's not equally possible, due to Occam's razor: http://en.wikipedia.org/wiki/Occam's_razor Plus, the security services have a proven ability and intent. Be serious now.

Re: Why was "goto fail;" added without any other change to that part of the code?

#80

Post by luke-stanley »

matthewmacleod wrote: post #24

Stop this nonsense. There are plainly dozens of reasons that this could have happened accidentally. Literally every single developer has made similar stupid mistake, and literally every organisation has released stupidly broken code. Yes, there should have been code review, static analysis, and testing in place to prevent that. That'll probably start happening, and you can bet that there will be serious discussions i…

That's what they expect you to think ;)
Post reply on HN