Re: OpenSSL development (Heartbleed)

[Georg Bauhaus <rm-host.bauhaus@maps.futureapps.de>]

On 19/04/14 21:12, Alan Browne wrote:
>
> No.  Where OpenSSL is underfunded and has a population of maybe 4 programmers dedicated to it (the guy who created the bug not being one of the 4) released an important security breach upon the masses;
>
> Contrast with OpenSourced Linux which has a well (corporate) funded organization and has a lot more eyeballs on the code and hasn't (Linux itself) suffered any major or embarrassing problems.

A comparison of one bug in one library to bugs in the amount of
software that is "Enterprise Linux"  does not seem balanced
enough.
      Also, insofar as OpenSSL is well associated with
open source Linux, it is likely that fixing Heartbleed-like
bugs will be covered by {Redhat, ...} support. This adds to
an argument that there actually is funding for OpenSSL etc.,
or, conversely, that there is never enough funding for all the
software to be bug free.
  At least, that seems to be the argument of the articles:
that funding and enterprise support is supposed to achieve
so high a quality of software that it would have prevented
Heartbleed etc.


OTOH, and bringing this back to Ada, the CVE sites state quite
openly that most of the issues have to do with int, malloc,
computed pointers, and assumptions that are not reflected in all
of these (overflow, say).
  If it is possible to make programmers use an Ada style fundamental
type system instead, thus also better arrays and fewer pointers,
this change would naturally reflect more of the assumptions. The
conclusion can only be that this change makes the software so written
as good as the assumptions. According to McCormick's findings,
that's not nothing. The fundamentals do matter.