4 ms·
Maybe this would be one good thing coming out of Heartbleed: It's easier to design (and more importantly, get people to implement) mitigations for actual disast
by mpyne 12y ago
Maybe this would be one good thing coming out of Heartbleed: It's easier to design (and more importantly, get people to implement) mitigations for actual disasters that have occurred and can be tested against, than do to the same for theoretical problem areas.
If we can get more libraries and implementations to be better engineered with the lessons learned from Heartbleed then that at least reduces the problem surface a bit.
- tomp 12y agoThe idea of this project was to (hopefully) include such a type-system in a future mainstream language (that was designed with refined types in mind, not an existing language with refined types added as an afterthought). I'm sure that libraries would follow if the tools became available. Another problem, of course, is that SMT solvers are only a nascent field; Z3 is fast and supports many theories, but is not free (for commercial use), and other solvers (I tried Alt-Ergo and CVC4) are considerably slower and have much less features.
- dfc 12y agoA lot of good things came out of Heartbleed. First and foremost, public disclosure and subsequent remediation of a serious vulnerability. Heartbleed gave us the LibreSSL project and the Linux Infrastructure Whatchamacallit funding of work on OpenSSL.