4 ms·
He's just pointing out that a big project will have bugs and he's right. That's not a matter of opinion. Not much fuzz testing has been done on OpenBSD since th
by 16s 16y ago
He's just pointing out that a big project will have bugs and he's right. That's not a matter of opinion. Not much fuzz testing has been done on OpenBSD since the early 2000s. When Theo did fuzz test back then, he found bugs. He claims to have found two just now while doing the audit in the crypto code. Code has bugs. Large projects have many bugs.
- ShabbyDoo 16y agoOr pointing out how hard it would be to get a "bug" inserted into such a codebase. He's not saying that either endeavor is easy. His only point was that, given a budget of $X and an embarrassment cost of (abstract) $Y for getting caught attempting to degrade the security of OpenBSD [my interpretation of "risky"], spending those $X on the identification of existing exploits would be the more rational course of action.
- tptacek 16y agoIn the early 2000's I was still speaking to Theo, and I don't believe that during that time period he ever did systemic fuzz testing on OpenBSD. SPIKE wasn't even released until 2002. Also: while we use fuzzers to probe for specific kinds of crypto flaws, the kind of fuzzing being done then (and for the most part today) does not identify crypto flaws. We are, let's be clear, talking about a project that appears to have managed to ship IPSEC code that didn't verify packet authenticators for something like a year.