Hacker News Reader

Comment by alrs | Hacker News Reader

Two obligatory links.

1. Debian dev on the openssl mailing list if he can remove the code causing errors in Valgrind: http://marc.info/?l=openssl-dev&m=114651085826293&w=2

2. Developer with a @openssl.org email address giving him the green light: http://marc.info/?l=openssl-dev&m=114652287210110&w=2

Source: http://lwn.net/Articles/282038/

View on HN

Also:

1. The commit introducing the bug: "Don't add uninitialised data to the random number generator. This stop valgrind from giving error messages in unrelated code." http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/r...

2. The commit fixing the bug: "ssleay_rand_add() really needs to call MD_Update() for buf." http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/c...

(I'd post the diffs but viewvc is throwing exceptions for them)

Nothing has ever quite degraded my opinion of the Debian project as much as the fact that everybody is quoting that in order to shift blame instead of them trying to debug their process for patching security-essential code.

The only thing that it means is that the security team does not fully understand the code it maintain, and apparently the same can be said about the openssl team. As a user myself, I don't understand that code, but I rely on people who should. Perhaps it means that the Debian security team should get more knowledgeable people onboard, but knowledge is also made of experience, and requires time to build up. Hopefully this will become a valuable experience for everyone, I know it has for me.

By the way, does anyone know of a certified SSL stack (a la compcert)?

Someone replied pointing out the correct solution (build with -DPURIFY) a few hours later [1], but I think the Debian developer in question was too young to understand what Purify is or why that's the correct approach.

[1] http://marc.info/?l=openssl-dev&m=114654760312453&w=2

Edit: also, the Debian developer didn't actually identify himself as such on the mailing list, or I have a feeling people would've scrutinized what he was suggesting a lot more closely.

Reply on news.ycombinator.com