5 ms·

It is but we should have a dose of humility in mocking them since many, many people [including everyone on this site that is a dev] make stupid mistakes from ti

It is but we should have a dose of humility in mocking them since many, many people [including everyone on this site that is a dev] make stupid mistakes from time to time. Such is the nature of the profession. None of us commit perfect code the first time, every time.

0x0 13y ago
Exactly. I'll just leave this here. http://article.gmane.org/gmane.os.openbsd.misc/211963 http://article.gmane.org/gmane.os.openbsd.misc/211963
- IgorPartola 13y ago
  Wha-what? That's pretty crazy. At the very least, if OpenSSL goes through this trouble, why doesn't it just implement its own malloc and friends that are both fast and secure? In fact, shouldn't it include something like scurb_and_free() so that sensitive bits would actually be erased when not needed. That seems like a much better solution than the approach described in this link.
  - dgl 13y ago
    It gets worse, see http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free... Essentially the code mistakenly relies on the freelist being LIFO and not being scrubbed.
    - TwoBit 13y ago
      Whoever said that OpenSSL was written by monkeys continues to be proven right.
      - deleted 13y ago
        [deleted]
      - davidw 13y ago
        That's a fairly rude thing to say. Would you say that to their faces? This is a pretty large site, and a lot of people stop by here, possibly including some of the "monkeys" . By all means, call the code what you want, but separate that from the people.
        pyvpx 13y ago
        something tells me a similar snafu made by a CS student would get "fairly rude" comments in reply by any competent instructor or advisor.
        bowyakka 13y ago
        you say that and yet I have had to teach people coming from several fairly top institutions that "no your lecturer was wrong, it is inappropriate to directly memcpy() from the network into a struct"
        SimHacker 13y ago
        Well Ted Nugent (not to mention Ann Coulter) got away with calling Obama a "monkey," and he's the highly respected darling of the GOP, whose endorsement is sought after and appreciated by not only Republican senators and congressmen, but Mitt Romney himself. (I'm not endorsing anyone's behavior here, just pointing out how low the right hand side of modern American politics has degenerated, to provide some perspective.)
  - lucian1900 13y ago
    The really odd bit is that all the buffer management operations in OpenSSL memset to 0, even when it appears not entirely necessary. However, the freelist code somehow fails to follow this convention.
- Peaker 13y ago
  Many projects that care about performance and memory fragmentation use per-purpose free lists, and not malloc/free. The performance is significantly better, and there is a much smaller danger of running out of space due to fragmentation issues.
pdabbadabba 13y ago
Good advice for for the author of that rage-filled patch as well.
- CHY872 13y ago
  Well, he has good reason to be enraged. The bug is a horrendous one and on his operating system was due to the developers deliberately the operating system provided security protections. Meanwhile his slightly buggy one liner failed in such a way that it did nothing, before being fixed 3 hours later.
kzrdude 13y ago
Absolutely. What matters is not to always be right, but how you correct errors.
- jeffdavis 13y ago
  "What matters is not to always be right, but how you correct errors." In my opinion, heartbleed is a counterexample to your point. It's a case where making the mistake at all caused a lot of damage, no matter how quickly they patched it.
  - nileshtrivedi 13y ago
    Well, it can be argued that this instance of mistake happened BECAUSE they didn't fix their review process the last time a silly bug managed to get in.
    - midas007 13y ago
      So there's enough blame and rage to go around. Any leader with a spine has to first contemplate "how did I fuck up?"
- pessimizer 13y ago
  What if your error was running someone over with your car?
annnnd 13y ago
Yes and no. The major mistake is not a missing "S". The major mistake is not performing a test which would show that the change was made (or in this case that it wasn't made).
- peterwwillis 13y ago
  Test our changes before we commit? What blasphemy is this?
Angostura 13y ago
At the very least the organization should look at itself very carefully, find out how this this happened.

0x0 13y ago

Exactly. I'll just leave this here. http://article.gmane.org/gmane.os.openbsd.misc/211963 http://article.gmane.org/gmane.os.openbsd.misc/211963

IgorPartola 13y ago
Wha-what? That's pretty crazy. At the very least, if OpenSSL goes through this trouble, why doesn't it just implement its own malloc and friends that are both fast and secure? In fact, shouldn't it include something like scurb_and_free() so that sensitive bits would actually be erased when not needed. That seems like a much better solution than the approach described in this link.
- dgl 13y ago
  It gets worse, see http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free... Essentially the code mistakenly relies on the freelist being LIFO and not being scrubbed.
  - TwoBit 13y ago
    Whoever said that OpenSSL was written by monkeys continues to be proven right.
    - deleted 13y ago
      [deleted]
    - davidw 13y ago
      That's a fairly rude thing to say. Would you say that to their faces? This is a pretty large site, and a lot of people stop by here, possibly including some of the "monkeys" . By all means, call the code what you want, but separate that from the people.
      - pyvpx 13y ago
        something tells me a similar snafu made by a CS student would get "fairly rude" comments in reply by any competent instructor or advisor.
        bowyakka 13y ago
        you say that and yet I have had to teach people coming from several fairly top institutions that "no your lecturer was wrong, it is inappropriate to directly memcpy() from the network into a struct"
      - SimHacker 13y ago
        Well Ted Nugent (not to mention Ann Coulter) got away with calling Obama a "monkey," and he's the highly respected darling of the GOP, whose endorsement is sought after and appreciated by not only Republican senators and congressmen, but Mitt Romney himself. (I'm not endorsing anyone's behavior here, just pointing out how low the right hand side of modern American politics has degenerated, to provide some perspective.)
- lucian1900 13y ago
  The really odd bit is that all the buffer management operations in OpenSSL memset to 0, even when it appears not entirely necessary. However, the freelist code somehow fails to follow this convention.
Peaker 13y ago
Many projects that care about performance and memory fragmentation use per-purpose free lists, and not malloc/free. The performance is significantly better, and there is a much smaller danger of running out of space due to fragmentation issues.

pdabbadabba 13y ago

Good advice for for the author of that rage-filled patch as well.

CHY872 13y ago
Well, he has good reason to be enraged. The bug is a horrendous one and on his operating system was due to the developers deliberately the operating system provided security protections. Meanwhile his slightly buggy one liner failed in such a way that it did nothing, before being fixed 3 hours later.

kzrdude 13y ago

Absolutely. What matters is not to always be right, but how you correct errors.

jeffdavis 13y ago
"What matters is not to always be right, but how you correct errors." In my opinion, heartbleed is a counterexample to your point. It's a case where making the mistake at all caused a lot of damage, no matter how quickly they patched it.
- nileshtrivedi 13y ago
  Well, it can be argued that this instance of mistake happened BECAUSE they didn't fix their review process the last time a silly bug managed to get in.
  - midas007 13y ago
    So there's enough blame and rage to go around. Any leader with a spine has to first contemplate "how did I fuck up?"
pessimizer 13y ago
What if your error was running someone over with your car?

annnnd 13y ago

Yes and no. The major mistake is not a missing "S". The major mistake is not performing a test which would show that the change was made (or in this case that it wasn't made).

peterwwillis 13y ago
Test our changes before we commit? What blasphemy is this?

Angostura 13y ago

At the very least the organization should look at itself very carefully, find out how this this happened.