5 ms·
Can't wait for tptacek's take. He's always a huge ESR fan and has some wonderful comments about him on twitter.
by SEJeff 10y ago
Can't wait for tptacek's take. He's always a huge ESR fan and has some wonderful comments about him on twitter.
- tptacek 10y agoThis code is pretty bad, but I don't have anything more interesting to say about it than that.
- AstroJetson 10y agoI didn't think it was that bad when you discount that yacc/lex is the front end for it. If you brute force parsing it the code is simplifier since the verbs are the first characters in a line with a colon (:) after them. The use of a real lexer and parser makes life harder.
- tptacek 10y agoTo me, it's a ragdoll stuffed with strcats, sprintfs, and strcpys, with random integer casts and from what I can tell not a single defense against integer overflows. It doesn't matter, because nobody is going to use this code, but as a reminder: this is the person ostensibly "hardening" ntpd.
- SEJeff 10y agoCompared to the great openntpd from Henning Brauer of OpenBSD, which actually does secure ntpd.