2 ms·
Now wandering further off-topic I realise! I think everyone who had ever looked at the code for OpenSSL (including myself) knew it was an unsafe time bomb wait
by CJefferson 12y ago
Now wandering further off-topic I realise!
I think everyone who had ever looked at the code for OpenSSL (including myself) knew it was an unsafe time bomb waiting to go off, it's just no-one could be bothered to replace it, or do the basic complete re-engineer the BSD folks are now doing.
- gcr 12y agoIt's easy to point fingers, but I think any library which handles strong crypto over network sockets is going to be pretty hairy. I bet that if I showed you a random 100 lines from the "LibreSSL" code and a random 100 lines from the "OpenSSL" code, stripping out all identifiers, that you wouldn't be able to tell which library is which by judging quality alone. That sounds like a fun experiment, actually. Someone should go and make that.
- gerardvanvooren 12y ago> I bet that if I showed you a random 100 lines from the "LibreSSL" code and a random 100 lines from the "OpenSSL" code, stripping out all identifiers, that you wouldn't be able to tell which library is which by judging quality alone. That's quite easy. In 100 lines of OpenSSL you have 6 nested #ifdefs and the code is unreadable formatted.