Hacker News Reader

Comment by opendais | Hacker News Reader

It is but we should have a dose of humility in mocking them since many, many people [including everyone on this site that is a dev] make stupid mistakes from time to time. Such is the nature of the profession. None of us commit perfect code the first time, every time.

View on HN

Exactly.

I'll just leave this here. http://article.gmane.org/gmane.os.openbsd.misc/211963

Wha-what? That's pretty crazy. At the very least, if OpenSSL goes through this trouble, why doesn't it just implement its own malloc and friends that are both fast and secure? In fact, shouldn't it include something like scurb_and_free() so that sensitive bits would actually be erased when not needed. That seems like a much better solution than the approach described in this link.

It gets worse, see http://www.tedunangst.com/flak/post/analysis-of-openssl-free...

Essentially the code mistakenly relies on the freelist being LIFO and not being scrubbed.

Whoever said that OpenSSL was written by monkeys continues to be proven right.

That's a fairly rude thing to say. Would you say that to their faces? This is a pretty large site, and a lot of people stop by here, possibly including some of the "monkeys" .

By all means, call the code what you want, but separate that from the people.

something tells me a similar snafu made by a CS student would get "fairly rude" comments in reply by any competent instructor or advisor.

you say that and yet I have had to teach people coming from several fairly top institutions that "no your lecturer was wrong, it is inappropriate to directly memcpy() from the network into a struct"

Well Ted Nugent (not to mention Ann Coulter) got away with calling Obama a "monkey," and he's the highly respected darling of the GOP, whose endorsement is sought after and appreciated by not only Republican senators and congressmen, but Mitt Romney himself.

(I'm not endorsing anyone's behavior here, just pointing out how low the right hand side of modern American politics has degenerated, to provide some perspective.)

The really odd bit is that all the buffer management operations in OpenSSL memset to 0, even when it appears not entirely necessary.

However, the freelist code somehow fails to follow this convention.

Many projects that care about performance and memory fragmentation use per-purpose free lists, and not malloc/free.

The performance is significantly better, and there is a much smaller danger of running out of space due to fragmentation issues.

Yes and no. The major mistake is not a missing "S". The major mistake is not performing a test which would show that the change was made (or in this case that it wasn't made).

Test our changes before we commit? What blasphemy is this?

Good advice for for the author of that rage-filled patch as well.

Well, he has good reason to be enraged. The bug is a horrendous one and on his operating system was due to the developers deliberately the operating system provided security protections. Meanwhile his slightly buggy one liner failed in such a way that it did nothing, before being fixed 3 hours later.

Absolutely.

What matters is not to always be right, but how you correct errors.

"What matters is not to always be right, but how you correct errors."

In my opinion, heartbleed is a counterexample to your point. It's a case where making the mistake at all caused a lot of damage, no matter how quickly they patched it.

Well, it can be argued that this instance of mistake happened BECAUSE they didn't fix their review process the last time a silly bug managed to get in.

So there's enough blame and rage to go around. Any leader with a spine has to first contemplate "how did I fuck up?"

What if your error was running someone over with your car?

At the very least the organization should look at itself very carefully, find out how this this happened.

Reply on news.ycombinator.com