3 ms·
Well, you answer the question yourself: Do you think that using SSL where your client accepts every certificate (the link points to a function that returns a s
by darklajid 14y ago
Well, you answer the question yourself:
Do you think that using SSL where your client accepts every certificate (the link points to a function that returns a success code unconditionally, the 'real' stuff is disabled by preprocessor directives) is bad?
Whatever the severity (for me this is certainly high), the tone in that bug report is inexcusable.
Edit: Well, it seems that code existed like this since its creation, 2003-09-29: http://hg.pidgin.im/pidgin/main/rev/895a5ff9ebd4 http://hg.pidgin.im/pidgin/main/rev/895a5ff9ebd4
Edit 2: The bug report has now a proper response, quite relaxed. So it seems this is totally expected - for whatever reasons. I'm still curious why the code is littered with #if 0 fragments for years (dead code belongs in the vcs history for me), but the initial expectation of a total lack of certificate verification is wrong.
- cjoh 14y agoSo it's taken 9 years for anyone to notice that SSL is broken in the most widely used(?) open source IM client?
- zwp 14y agoI think it's fair to say that it's still not really clear. Twitter(!) has the news as it broke/continues to break: https://twitter.com/0xabad1dea/status/243095210819715072 https://twitter.com/0xabad1dea/status/243095210819715072
- lloeki 14y agoAllow me to fix that, because it's not just Pidgin: > .. the most widely used(?) open source IM client library, libpurple?
- zaroth 14y agoEven more strange, seeing as there appears to be working validation code which is #ifdef 0, even back in 2003? At the very least, would have been a great place in the code to comment on where (since obviously not there) the cert is supposed to get validated!