OpenSSL security advisory for September 26

The proper response to yet another bug in OpenSSL (or any other popular software) is to a) find further bugs b) submit patches for them c) find a higher-quality replacement or d) develop a higher-quality replacement. Bad-mouthing isn't constructive.

One illustration I like is a UK user-worked level crossing (ie a privately owned road crosses the railway, typically at a farm) where they had a near miss after the user telephoned for authority to cross, received it, and then before they could use the authority saw a train pass right in front of them.

Who fucked up? Not the crossing user. Not the train driver. Not even the signaller who gave authority (although they did other things wrong not causal to the near miss itself).

The immediate cause was that the signalling system showed the crossing in logically the wrong place. The train which arrived was shown as having already passed that crossing. So who fucked up? Well, a human transcribing paper documents into an electronic system for a re-signalling project typo'd an identifier. OK. But obviously a system vulnerable to such drastic consequences from a typo is itself unsound. Who fucked up there? Almost everybody. The programmers had checks for a number of mistakes made in transcription or when adding new data, but not this particular sort of typo. The managers tasked with comparing the paper documents to the imported electronic ones noticed the typo as a difference but didn't understand its significance as an error and assumed it was correcting the paper plan. The signallers never asked why their new system showed the crossing in a different place. After the initial error almost all other humans assumed that any consequence they saw must have a good explanation and didn't inquire what that was. Only the accident's investigators took the measure of simply going to the crossing and examining the territory to see how it compared to the map.

So yeah, it will always be possible for somebody to fuck up. BUT ultimately this incident was a level crossing fault. Though different in nature to many other types of level crossing incident, it shares with them the fact that it wouldn't happen if all traffic was grade-separated. No new railway should have level crossings at all, it's just not worth the risk. So my point is that likewise, too many of these OpenSSL or libressl bugs involve risky low-level constructs that needn't even have been used in an SSL library in the first place. "Don't fuck up" is necessary but we can make things safer by reducing the number of chances to fuck up.