OpenSSL 1.0.0 released [LWN.net]

OpenSSL 1.0.0 released

Posted Mar 30, 2010 7:13 UTC (Tue) by dlang (guest, #313)
In reply to: OpenSSL 1.0.0 released by rsidd
Parent article: OpenSSL 1.0.0 released

The guy found a real bug in the source. His fix was wrong, but it was a real bug he was trying to fix.

OpenSSL 1.0.0 released

Posted Mar 30, 2010 8:10 UTC (Tue) by hppnq (guest, #14462) [Link] (2 responses)

Hmm. This guy spent eight hours on producing three scripts with messed up hashbangs to perform the most basic of all SSL operations, and another full day on looking for main() in openssl(1).

So, I just skimmed over the rant, but I would be very surprised if this guy actually found a bug in OpenSSL. What is it?

OpenSSL 1.0.0 released

Posted Mar 30, 2010 13:46 UTC (Tue) by jond (subscriber, #37669) [Link] (1 responses)

The OP was replying to a comment about the Debian SSL debacle. s/he was
referring to the Debian patch as attempting to fix a real bug in openssl,
not the rant.

OpenSSL 1.0.0 released

Posted Mar 30, 2010 14:13 UTC (Tue) by hppnq (guest, #14462) [Link]

Ah yes, thanks for pointing that out, I misread the "guy" references. ;-)

OpenSSL 1.0.0 released

Posted Mar 30, 2010 13:49 UTC (Tue) by jbardin (guest, #54917) [Link] (2 responses)

A real bug only as reported by valgrind. OpenSSH was purposely using a chunk of unallocated memory as part of its source of entropy.

OpenSSL 1.0.0 released

Posted Mar 30, 2010 14:36 UTC (Tue) by mpr22 (subscriber, #60784) [Link]

To my mind, if it didn't have a suitably forceful comment attached to it, it was a bug even if it was deliberate. ("Yes, we really do mean to use uninitialized memory as an entropy source. Yes, we know code validation tools will whine about it.")

OpenSSL 1.0.0 released

Posted Mar 30, 2010 16:53 UTC (Tue) by vonbrand (guest, #4458) [Link]

"Uninitialized memory" != "random contents". This was not a valid entropy source.