4 ms·
Theo de Raadt, one month ago (not the only and first mail in this (derailed) thread though): >A review of libsqlite source code will demonstrate that it is wri
by cremno 12y ago
Theo de Raadt, one month ago (not the only and first mail in this (derailed) thread though):
>A review of libsqlite source code will demonstrate that it is written
>using many old practices of coping with "older systems". Many of the
>same techniques that caused unneccessary risk in OpenSSL.
https://marc.info/?l=openbsd-misc&m=142566734914439&w=2 https://marc.info/?l=openbsd-misc&m=142566734914439&w=2
- jeremycw 12y agoIs there a list of 'best practices' that OpenBSD follows for C code or anything that points out what these 'old practices' are?
- cremno 12y agoI don't think so. There are some other mails (like https://marc.info/?l=openbsd-misc&m=142563704303304&w=2 https://marc.info/?l=openbsd-misc&m=142563704303304&w=2), but I also think now I should've used a different quote.
- ben_bai 12y agoNot really. There is this list [0] of security considerations for ports, which is a good starting point. Everybody writing in the same style [1] doesn't hurt either. [0] http://www.openbsd.org/faq/ports/guide.html#PortsSecurity http://www.openbsd.org/faq/ports/guide.html#PortsSecurity [1] http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man9/style.9?query=style&sec=9 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man9/...
- rogerbinns 12y agoNote that the SQLite authors intentionally did that. It runs on many many systems including ones with trivial amounts of RAM. They have ancient compilers. I've waged a many year campaign to get them to at least use size_t and similar "modern" constructs, but no dice. They also only use techniques that are at least 20 years old, to avoid patent issues.
- FrankBooth 12y agoOf course they did. So did the OpenSSL developers. It wasn't an accident. It's simply a design decision that has a set of costs associated with it.