Re: OpenSSL development (Heartbleed)

["Nasser M. Abbasi" <nma@12000.org>]

On 4/19/2014 9:31 AM, Alan Browne wrote:
>
> Good article in the NYT:
>
> http://www.nytimes.com/2014/04/19/technology/heartbleed-highlights-a-contradiction-in-the-web.html?ref=business
>

Ok, I read the article. The main point seems to
blame lack of funding from corporation that use
OpenSSL which is developed as open source by
volunteers.

Some student submitted a patch on eve of 2011
with the bug. The patch was "vetted" by a more
senior developer later on, And so now we have it.

I do not see anywhere, how is regression testing is
done in this picture. Is there is lab full of networks
and computers used to run thousands of regression
tests each time a new software update is made? What
was the result of these regression tests at that time?
Where is the report on that? The problem seems to
be with lack of test coverage and weak testing
methodology used. May be due to lack of resourcesm
or for other reasons.

Yes, big companies need to donate more money to
openSSL, but also testing should be improved.

Other than the problem with using C, more internal
testing is needed by open source developers. (Even more,
since they use C, and not Ada :).

--Nasser