Re: OpenSSL development (Heartbleed)

[Simon Clubley <clubley@remove_me.eisner.decus.org-Earth.UFP>]

On 2014-04-22, Dmitry A. Kazakov <mailbox@dmitry-kazakov.de> wrote:
> On Tue, 22 Apr 2014 17:20:13 +0200, G.B. wrote:
>> 
>> Evidence, indeed!
>>   Now given ISO/IEC 27000, a family of standards revolving
>> around security, and Heartbleed, what can anyone do to make
>> standards effecive?
>
> Properly designed standards, maybe? Let me ask a stupid question. What has
> a transport level protocol to do with the application level's servers (and
> clients)? If it really were a strictly transport level, no implementation
> could leak data out of higher levels. Right?
>

No, properly _implemented_ standards are what is required.

Heartbleed came about because a boundary check was missing which allowed
a invalid request to be processed instead of being rejected and, because
of the _implementation_, was allowed access to memory that had nothing to
do with the request.

This was a failure in the implementation of the standard, not a failure
of the standard itself.

Simon.

-- 
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Microsoft: Bringing you 1980s technology to a 21st century world