Re: Heartbleed

[Maciej Sobczak <see.my.homepage@gmail.com>]

W dniu piątek, 11 kwietnia 2014 04:39:18 UTC+2 użytkownik Charles H. Sampson napisał:

> According to Wikipedia, the Heartbleed bug in OpenSSL is caused by
> two errors: Lack of bounds checking and failure to verify that the
> heartbeat request was valid. Whom does one express one's indignation to?

The following page answers your question:

http://www.openssl.org/source/license.html

The part written in CAPITAL LETTERS is specifically focused on this.

> The insistence of many in our "profession" on using C and its decendents
> is the reason I qualify the word "profession" when writing about
> software developers.

Every general statement has some exceptions. Even though *in general* you are right, in this particular case things work a bit differently. OpenSSL is ntended as a common component that is used by everybody else. In order to achieve this you need to choose the technology that is a common denominator, both in terms of the ability to link with it and in terms of the availability of toolchains.
Now, you might argue that is is possible to write the library in Ada in such a way that it can be reused from other languages, it is not easy to do so, especially if you take into account the (un)availability of language runtime. The biggest issue, however, is the availability of compilers.

Saying that this stuff should have been written in Ada is pointless.

> Acting on a message without validating it is
> equally incomprenhensible to me.

That's right.

> For the latter, someone needs a severe rebuke on his next
> performance review, at the least.

I am not aware of performance reviews for people who voluntarily contribute on their free time. Not sure if that was the case for this particular piece of code, but anyway, read the license again. The fact that somebody wrote crappy piece of code is part of the whole problem - the other part is that we (yes, the whole world) choose to use it. Who is to blame?

> It so happens that for the last project I worked on, I was
> responsible for TCP/IP communication.

Put it in your CV, then.

-- 
Maciej Sobczak * http://www.msobczak.com * http://www.inspirel.com