Re: OpenSSL development (Heartbleed)

[Alan Browne <alan.browne@FreelunchVideotron.ca>]

On 2014.04.19, 11:06 , Nasser M. Abbasi wrote:
> On 4/19/2014 9:31 AM, Alan Browne wrote:
>>
>> Good article in the NYT:
>>
>> http://www.nytimes.com/2014/04/19/technology/heartbleed-highlights-a-contradiction-in-the-web.html?ref=business
>>
>>
>
> Ok, I read the article. The main point seems to
> blame lack of funding from corporation that use
> OpenSSL which is developed as open source by
> volunteers.
>
> Some student submitted a patch on eve of 2011
> with the bug. The patch was "vetted" by a more
> senior developer later on, And so now we have it.
>
> I do not see anywhere, how is regression testing is
> done in this picture. Is there is lab full of networks
> and computers used to run thousands of regression
> tests each time a new software update is made? What

Testing?

Bwahahahaahahahahahahahaahahahaaaaaaaaaa aaaa  aaaa   a a

> was the result of these regression tests at that time?
> Where is the report on that? The problem seems to
> be with lack of test coverage and weak testing
> methodology used. May be due to lack of resourcesm
> or for other reasons.

Resources - or rather how they are employed - is the primary issue.

>
> Yes, big companies need to donate more money to
> openSSL, but also testing should be improved.
>
> Other than the problem with using C, more internal
> testing is needed by open source developers. (Even more,
> since they use C, and not Ada :).

Language is not the issue.  The issue is a lack of defined requirements 
which leads to design, documentation, testing, etc.  For something as 
critical as SSL one would hope that more care would go into change 
management and testing.  But that's a laugh in open source - everyone 
wants to code - not document.

Someone receiving $2K a year (if that) is not going to spend much time 
editing and revising requirements... and students working on it see 
their code "working" and that is sufficient.  Time to move on to getting 
your paws up Susie's skirt or finding a job at McDonald's.

Apple went a different direction.  Not especially for security reasons 
but that they found OpenSSL bloated and no longer fitting their future 
needs.

http://appleinsider.com/articles/14/04/18/how-apple-dodged-the-heartbleed-bullet

But they still do everything in C variants and that is not going to change.

-- 
"Big data can reduce anything to a single number,
  but you shouldn’t be fooled by the appearance of exactitude."
      -Gary Marcus and Ernest Davis, NYT, 2014.04.07