3 ms·

Are the openssl developers using the "best tools to detect memory corruption issues in C"? In my experience, most open source projects don't devote the money o

• nickpsecurity 11y ago
  Actually, I think they're using the best tools to create memory corruption issues in C. There could in fact be a slow-moving fuzzer in their build system that transforms safe C constructs into unsafe ones before release. It's random and hits one thing at a time. Probably borrowed from mutation component of a genetic algorithm toolkit. I won't speculate if lack of focus or quality could indicate rest of OpenSSL code was produced by genetic algorithms.
• pjmlp 11y ago
  I know C since 1993 and C++ since 1994. Used C++ extensively during those years up to 2006. C only when required to do so for university assignments or customers. On one of my employers, I was one of the few developers that bordered using VC++ debugging libraries for memory allocation and Insure++. It is not a matter of tooling being available, many don't use them even when they can.