Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

article.gmane.org

Post reply on HN
Print view View original

91–100 of 245 posts

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#91

Post by spacemanmatt »

this_user wrote: post #48
bhouston wrote: post #26

Earlier quoted context omitted.

> no need for tinfoil hat theories Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet security. OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA. For example of NSA efforts in related areas (which I figured you would already know): http://www.cnbc.com/id/101301261 htt…

There is a difference between infiltrating companies and deliberately introducing a bug that compromises a large chunk of the Internet. I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails.

I would assume the NSA always assumed (note past tense) that their secrets stay pretty secret, and their wide-open backdoors will not get knockers.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#92

Post by spacemanmatt »

simias wrote: post #23
bhouston wrote: post #21

Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes? The convoluted code of OpenSSL alone (from yesterday's Hackernews post) seems like a great way to add all sorts of "bugs" inadvertent or not. Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet se…

Or maybe it's just a bug. There's really no need for tinfoil hat theories unless you have any evidence for a possible conspiracy. That being said I agree that OpenSSL could do with a good code cleaning, but that's a massive undertaking, especially for such a popular library. You have to be backwards compatible. Maybe a big name in software could go and write a modern crypto library without all the cruft of OpenSSL bu…

In this post-Snowden era I believe Occam's razor yields a different result about NSA interference.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#93

Post by josteink »

I may be biased in that I have not written much C-code in years (decades?), but whenever I find a codebase covered in IFDEFs, I start assuming that every single new IFDEF introduces a new condition into the system which has not been properly nor recently tested, and that the software is horribly broken.

For me, fixing software, is just as often removing IFDEFs together with unmaintained and broken code. It's IMO much better to be honest about "this isn't supported", than pretend you support something you don't.

And this seems to be another one of those stories, coupled with a (bad?) case of NIH.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#94

Post by stiff »

motters wrote: post #88
stiff wrote: post #54

It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github…

My attitude towards complaints about open source projects is that if you think the errors are rudimentary then just submit some patches. If there is not enough test coverage then add one. This applies especially if you believe that the project is critically important. I think what might be happening here is expert syndrome. People may be told that if they're not experts then they shouldn't be reviewing or changing th…

Even if you work on a commercial project, where there is a reasonably stable core team, people just committing stuff, even if it's in itself pretty good stuff, won't result in good overall code quality. You need to have a systematic process, including a detailed coding standard, requirements about test and documentation coverage for submitted code, precise guidelines for contributing, rules of code review, and you need people who understand the whole project, review pretty much all of the code changes, have an overall development schedule in mind including refactorings and technical improvements, and all the time putting work into maintaining overall integrity of the project:

http://c2.com/cgi/wiki?ConceptualIntegrity

This is pretty much a must for any project where there is more than one person working, and the more people contributing or the more mission-critical the project the more of this kind of high-level coordination is required. Some open source projects with strong leadership do get to this kind of integrity, but most don't. It's easier when there is a relatively small team of very dedicated individuals, but some large projects have succeeded to some extent in building a real development culture in an open source setting, like Linux.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#96

Post by dimsumdumdum »

As soon as "open source" looks like a sloppy blow job everyone as in "idiot brogrammers", hey man, "I dont even work here", walks away and goes its SO hard...so HARD.

Fuck you, you are a bunch of juvenlie misfits of the HIGHEST order who should not only never maintain security software, but get a real estate certification.

Fuck off and die you 20 year old loser idiots

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#97

Post by spacemanmatt »

MrBuddyCasino wrote: post #27
simias wrote: post #5

Earlier quoted context omitted.

Could have done without the final line though, but I guess it's his equivalent of a signature...

To quote Ted Dziuba: "Anyone who ever told you that swear words have no place in technical discussion is right. They're right, and sadly, they're part of the problem because they miss the point. The sterile word placement that's supposed to support an argument makes any true motivation indistinguishable from all the hired bullshit. [...] However, when someone starts swearing in technical discussion, showing emotion,…

I absolutely depend on some swearing to draw a clear line between the factual presentation and everything else. I think this is why beer:30 and stepping away from the office with coworkers is important.

People matter. The way software makes them feel matters. Code smell and related concerns are best conveyed in profoundly human ways. Fuck it. Say it like you mean it.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#98

Post by naveen99 »

laggyluke wrote: post #28
btown wrote: post #3

This should be a case study about why people developing system-critical software shouldn't write their own memory allocators.

They say you shouldn't write your own crypto either :)

Ignore people who say that. Crypto doesn't need to be complicated.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#100

Post by spacemanmatt »

higherpurpose wrote: post #86
bhouston wrote: post #21

Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes? The convoluted code of OpenSSL alone (from yesterday's Hackernews post) seems like a great way to add all sorts of "bugs" inadvertent or not. Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet se…

Even the name "Heartbeat" sounds like something NSA would name it.

What would it sound like if it were named to indicate signs of life?
Post reply on HN