Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why was "goto fail;" added without any other change to that part of the code?

news.ycombinator.com

Post reply on HN
Print view View original

81–86 of 86 posts

Re: Why was "goto fail;" added without any other change to that part of the code?

#81

Post by wglb »

matthewmacleod wrote: post #56
brudgers wrote: post #54

Earlier quoted context omitted.

How should a malicious actor have better crafted an exploit of equivalent scope and potency? Considering the possibility that any system managed from a compromised device could be compromised to any degree, how does the use of static code analysis and testing in the future uncompromise those systems? Short of finding a unicorn and seeing who can ride it, there's no guarantee that a system isn't pwnd or connected to o…

Considering the possibility that any system managed from a compromised device could be compromised to any degree, how does the use of static code analysis and testing in the future uncompromise those system It doesn't. But since you were relying on a closed-source system in the first place, you are already screwed - if that's the level of security you require.

Have you ever looked through the code in OpenSSL?

Re: Why was "goto fail;" added without any other change to that part of the code?

#82

Post by gcb0 »

wreegab wrote: post #35
gcb0 wrote: post #17

I'm 100% convinced it's malicious... But otherwise, it could be explained by the coder adding another check If(err==my_dev_string) goto fail; Then before committing, sending the diff to a colleague who emails back "you forgot a debug there, besides that ship it" He removes only one line of two and ships. And of course i always try to attribute those things to incompetent other than malice, but since in this case ther…

> but since in this case there was probably money and bribes involved The cognitive process above is really sad: "I speculate this is what happened as a natural outcome of my other speculation"

my two speculations are really opposite (and most believable one to defend the coders innocence, if that was the case). i presented both and pointed out the one i have a gut feeling towards.

Re: Why was "goto fail;" added without any other change to that part of the code?

#83

Post by glurgh »

tptacek wrote: post #41
pessimizer wrote: post #30

Earlier quoted context omitted.

>it's hard to imagine a situation where such an action would be worthwhile, given the resources at the disposal of any such actor. This needs more defense. I find it hard to imagine a situation where such a minimal and deniable action with such a massive effect wouldn't be worthwhile.

No, it doesn't need a defense. There is no evidence to back up the idea that the bug was malicious. People that have worked on large C codebases have seen crazier things than this. Routinely . I understand that Rails developers believe that all the TLS stacks must have dense rspec test coverage and zero-warnings static analysis passes in their builds, but that isn't the reality for any TLS stack. These aren't Rails a…

The oddest thing about it is that people who ought to know better are not straight up calling it the tinfoilhattery that it is. Schneier saying things like 'if I were doing this deliberately, that's how I'd do it'. That's how you'd do it and then you'd release the source? Why not patch the binary? Hell, why not patch the compiler, Ken Thompson-style, if you're such a devious insider? It's grade-A Chewbacca defense.

Re: Why was "goto fail;" added without any other change to that part of the code?

#85

Post by marvy »

brudgers wrote: post #54
matthewmacleod wrote: post #24

Stop this nonsense. There are plainly dozens of reasons that this could have happened accidentally. Literally every single developer has made similar stupid mistake, and literally every organisation has released stupidly broken code. Yes, there should have been code review, static analysis, and testing in place to prevent that. That'll probably start happening, and you can bet that there will be serious discussions i…

How should a malicious actor have better crafted an exploit of equivalent scope and potency? Considering the possibility that any system managed from a compromised device could be compromised to any degree, how does the use of static code analysis and testing in the future uncompromise those systems? Short of finding a unicorn and seeing who can ride it, there's no guarantee that a system isn't pwnd or connected to o…

Whenever someone brings up the "trusting trust" thingy, I feel compelled to point out the antidote: http://www.dwheeler.com/trusting-trust/

Re: Why was "goto fail;" added without any other change to that part of the code?

#86

Post by lyngvi »

shawabawa3 wrote: post #55
lyngvi wrote: post #16

Earlier quoted context omitted.

++ on mismerge. The change likely won't impact the output binary - compiler should issue a warning, which devs might ignore; then the optimizer would remove it as unreachable. Perhaps the developer deliberately allowed that mismerge to give himself an aura of incompetence/sloppiness, enhancing his plausible deniability when it is discovered that one of his other changes led to an insidious vulnerability. But more lik…

> The change likely won't impact the output binary - compiler should issue a warning, which devs might ignore; then the optimizer would remove it as unreachable. It's not unreachable - it always executes if the if condition is false.

D'oh. That's what I get for not paying attention and looking at the indentation instead of for braces. Still, my bet's on mismerge first - though it'd be worth reviewing that committer's other changes.
Post reply on HN