3 ms·
It's mainly due to OpenSSL doing exceptionally poor manual memory management. Lot's of the LibreSSL changes have involved removing that.
by dtech 12y ago
It's mainly due to OpenSSL doing exceptionally poor manual memory management. Lot's of the LibreSSL changes have involved removing that.
- BoppreH 12y agoFlash Player, Adobe Reader, JVM, etc etc etc. I don't think it's a localized problem. And we only have so many people with the skills of the LibreSSL team to go around.
- dtech 12y agoSo you're suggesting that the solution to manual memory managment bugs in the JVM is to use a memory managed language? The memory management will have to be done manually at some point.
- rurban 12y agoOpenSSL has not even a testsuite or build tool helpers to help finding those simple bugs, usually found with normal build and test methods, such a valgrind or AddressSanitizer. Insanity prevails.
- stephen_g 12y agoPart of the problem was that they were (are?) using their own memory allocator, which was not only had been the source of many security vulnerabilities, but also broke Valgrind! That was one of the first things the LibreSSL team ripped out.