[OT] OpenBSD, was: Re: OpenSSL development (Heartbleed)

[Simon Clubley <clubley@remove_me.eisner.decus.org-Earth.UFP>]

On 2014-04-19, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
> On 2014.04.19, 16:20 , Georg Bauhaus wrote:
>> OTOH, and bringing this back to Ada, the CVE sites state quite
>> openly that most of the issues have to do with int, malloc,
>> computed pointers, and assumptions that are not reflected in all
>> of these (overflow, say).
>
> QUOTE
> Theo de Raadt, founder and leader of the OpenBSD and OpenSSH projects, 
> has criticized the OpenSSL developers for writing their own memory 
> management routines and thereby circumventing OpenBSD C standard library 
> exploit countermeasures, saying "OpenSSL is not developed by a 
> responsible team."
> ENDQUOTE
>
> Ironic that one Open team leader is criticizing another <g>
>

Not if you know what Theo is like. :-)

> But, he may be right.
>
> Would he subject his teams to a more rigorous process?  To Ada?
>

Yes to the first; unknown on the second.

OpenBSD has a reputation as a reasonably secure (by Unix standards)
operating system precisely due to the auditing the OpenBSD team
carries out.

Note that this is a reputation based assessment; I don't have much
direct experience with OpenBSD.

Some reading you may find of interest:

	http://www.openbsd.org/security.html

Simon.

-- 
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Microsoft: Bringing you 1980s technology to a 21st century world