3 ms·
Eh, OpenSSL was invoking blatantly undefined behaviour. The diff applied by Debian? GCC and Clang are perfectly entitled to behave the same.
by orra 5y ago
Eh, OpenSSL was invoking blatantly undefined behaviour. The diff applied by Debian? GCC and Clang are perfectly entitled to behave the same.
- WastingMyTime89 5y agoBut neither GCC nor Clang did and the diff applied by Debian actually triggered the bug without fixing anything. The fact that OpenSSL also happened to be a terrible piece of software doesn't exonerate Debian.
- orra 5y agoI have to disagree: OpenSSL shares the blunt of the blame. (Whilst saying that, it doesn’t help that both projects are under resourced.) The Debian maintainer contacted upstream about the underlying issue, but received no response. Nor did the patch break any tests. We've also seen since then just how broken OpenSSL was generally, with Heartbleed. And why did OpenSSL have its own RNG that invoked undefined behaviour, when it could just read from /dev/random? Moreover, in hindsight, we have a much better understanding of undefined behaviour than we used to. Undefined behaviour is not “occasionally the optimiser might bite you” but “sometimes you'll get (un)lucky in that it’ll appear to work. Don’t do it”.