3 ms·
While it's funny that Dual_EC_DRGB was so maligned, this bug was not found until the recent news, it's also disturbing that OpenSSL is so poorly tested that a b
by shalmanese 13y ago
While it's funny that Dual_EC_DRGB was so maligned, this bug was not found until the recent news, it's also disturbing that OpenSSL is so poorly tested that a bug of this magnitude was allowed to slip through for so long.
- wereHamster 13y ago> Why wasn't this bug caught in the FIPS 140-2 validation testing? > > [snip explanation...] Try to read the articles sometimes.
- sp332 13y agoFIPS 140-2 isn't the only testing done on OpenSSL. You'd think some unit tests would be in place at least.
- eropple 13y agoFrom my understanding, OpenSSL is well-tested, but not against the FIPS 140-2 validation (because it's not very meaningful), which is what would reveal this issue. Like most open-source stuff, things that matter get eyes on it.