3 ms·
> How is this code not covered by a unit test? ...or an integration test. or a functional test. When you write an SSL lib, I suspect that at some point you ou
by llimllib 13y ago
> How is this code not covered by a unit test?
...or an integration test. or a functional test.
When you write an SSL lib, I suspect that at some point you ought to test that it checks f%^&ing certificates :/
- sneak 13y agoNegligence or malice. My theory is that Apple is spread too thin. Kayak.com reproducibly crashed MobileSafari the day iOS7 shipped, and brand new iPad minis regularly kernel panic and reboot. It wasn't always like this.
- andrewflnr 13y agoHmm, not just my Nexus 7, then. Fortunately that's not very frequent.
- gsnedders 13y agoThe standard of testing for all SSL/TLS libraries is atrocious, it's not even like SecureTransport is notably worse than most others… :'( Someone badly needs to sit down and write — preferably a black-box, so it can be used for all — testsuite for SSL/TLS.
- marcan42 13y agoAn integration test wouldn't catch this one. You need a specific malicious SSL server (presents a valid certificate, uses ephemeral mode, does not present a valid signature proving that it owns the private key). The code does validate certificates, otherwise this would've been caught ages ago by anyone trying an invalid cert. Unit tests would've caught this, though.