4 ms·

I can point you to their test rack: http://www.openbsd.org/images/rack2009.jpg http://www.openbsd.org/images/rack2009.jpg They run every version of OpenBSD in

• makomk 13y ago
  That wouldn't have caught Heartbleed, wouldn't have caught a vulnerability like the one in Apple's TLS implementation, wouldn't have caught... Basically, testing that your software works in normal operation isn't enough to ensure it's secure, you need to explicitly test its behaviour under attack.
  • wlesieutre 13y ago
    In that case, you can't use OpenSSL either because its testing clearly doesn't ensure it's secure. So, good luck with that?
  • bsder 13y ago
    Actually, OpenBSD did have things in place that would have caught Heartbleed. OpenSSL went out of their way to create a situation that defeated them. Look, the whole OpenSSL debacle is the fact that OpenSSL has ONE programmer working on it reliably. LibreSSL now has 5x-10x the manpower that was working on OpenSSL--and that's STILL probably low by an order of magnitude. Google should pledge 5 people to work on LibreSSL by itself. They clearly have them since one of their internal audits uncovered Heartbleed. The thing is nobody in the companies actually cared until the NSA started spying on them.