Hacker News Reader

Comment by adekok | Hacker News Reader

I maintain a project (http://freeradius.org) which a similar amount of code, and (arguably) similar complexity. While we've had issues, they aren't as numerous as OpenSSL. And, the issues in the latest major version are negligible.

Why? We have a requirement for code quality. The code can't just work, it has to make sense. The OpenSSL people don't seem to care about badly formatted and/or non-understandable code.

All commits MUST build cleanly without warnings on multiple operating systems, and under multiple compilers. We have test cases for a large chunk of the code base. We scan all releases through three different static analysis tools.

Security is important. We make it important because we care. I wish other projects would do the same.

View on HN

I would posit another reason you don't have as many issues; you don't have as many people trying to find them.

I think it is pretty foolhardy to assume that just because security issues haven't been found means they don't exist.

There's definitely some truth to this, FreeRADIUS is just not that valuable of a target since not many people have RADIUS exposed to the world, however if you look at other highly valuable targets like OpenSSH, which is probably in the top 10 if not the most valuable target in the world, you see far fewer significant exploits. It's definitely possible to have better quality than OpenSSL and a lot of OpenSSL's issues are due to legacy code and what amount to experiments being run in production software.

For the record, the fixes for that CVE contain new CVEs.

https://www.openssl.org/news/secadv/20160926.txt

<sigh>

No one can reasonably say that the practices of the OpenSSL programmers result in secure code. No one can reasonably say that lots of people examining it later for defects is a good idea.

We have lots of legacy code in C. The only sane way to maintain it is tests: unit tests, functional tests, and static code analysis.

> a lot of OpenSSL's issues are due to legacy code

i.e. the OpenSSL people don't care to actively maintain / clean up their software.

What a depressing statement to make.

1) Which product is more likely to be secure?

a) one which has tests, no build warnings, and is run through 3 different static analysis tools?

b) one which has none of those things?

2) Also, which of these products is more likely to be secure?

a) one which has a lot of third-party analysis?

b) one which has some third-party analysis?

3) Are these two questions the same?

My answer to (3) is "no".

While best combination of answers would be 1(a) and 2(a), OpenSSL is at 1(b) and 2(a). I'd bet they still have more security issues than FreeRADIUS, which is at 1(a) and 2(b).

That's all I meant.

I'm a huge fan of freeradius. I have tried multiple propiortary radius servers and I can honestly say freeradius is the most flexible most reliable radius server in the world. Thanks so much for your effort.

>Why? We have a requirement for code quality.

With all respect to your project, I bet wider adoption of OpenSSL and consequently more interest from "interested" parties plays a bigger part here.

So "many eyes find bugs" is better than using good engineering practices?

What an utterly ridiculous thing to say.

Reply on news.ycombinator.com