2 ms·
kudos to the akamai team for reporting the --nossl3 option issue in CVE-2014-3568. really makes you wonder what else is lurking in openssl when options don't a
by justcommenting 12y ago
kudos to the akamai team for reporting the --nossl3 option issue in CVE-2014-3568.
really makes you wonder what else is lurking in openssl when options don't actually do what they say they do. as phk put it, openssl is the crown jewel https://www.youtube.com/watch?v=fwcl17Q0bpk https://www.youtube.com/watch?v=fwcl17Q0bpk
- peterwwillis 12y agoThere is no testing of whether a disabled feature actually gets disabled. The only openssl test cases that exist are explicitly to test that a feature works, not that it doesn't work. The 'test' directory of openssl is just a big pile of giant C programs and shell scripts which make up the test cases, and a lot of the features and options are piled together, and there's no documentation. There isn't even an indication of which test case fails when one does fail. I don't see how anyone could get an idea from this of whether a feature works as expected or not, or how many regressions you might have between releases or after new features. As is typical of openssl, it's a big mess.
- justcommenting 12y agoagreed--as phk put it in his operation orchestra talk (link in previous post) regarding openssl: 1)API is a nightmare, 2)documentation is deficient and misleading, and 3) defaults are deceptive kudos again to the akamai team for reporting the bug.