3 ms·
There is a lot of room for improvement in the current OpenSSL code base. Simple cleanups, for one. Code formatting. Removing duplicate code. Static analysis
by adekok 10y ago
There is a lot of room for improvement in the current OpenSSL code base. Simple cleanups, for one. Code formatting. Removing duplicate code. Static analysis. Unit tests.
The OpenSSL maintainers seem to be doing something other than all that. The historical defence for this was that they had minimal funding (which is no longer true), and that the funding they did have was for adding new features.
That's just not an acceptable excuse. And it never was an acceptable excuse.
Cleaning up code should be part of normal software development. Re-factoring code, adding unit tests, etc. Adding static analysis builds (clang is free, and Coverity is free for open source projects).
It's 2016. Why are some people still using software practices from 1992?
- e40 10y agoHas this been suggested to the OpenSSL devs? If so, what did they say? If not, adekok, perhaps you can do that. You are 100% correct here.
- adekok 10y agoThat's pretty much what the LibreSSL people have done. And no, they didn't get much response or buy-in.
- jeltz 10y agoThey are cleaning up the code, which I noticed when porting PostgreSQL to OpenSSL 1.1 and things were broken all over the place. I just think the code base is very bad to start with and the cleanup just start very recently.