Buffer overruns, license violations, and bad code: FreeBSD 13’s close call (Ars Technica)

[Security] Posted Mar 26, 2021 19:57 UTC (Fri) by corbet

For those wanting more details on the saga of the WireGuard implementation that was almost released in FreeBSD 13 (a story that LWN covered recently), this Ars Technica story digs in deep. "Despite not having any kernel developers on-staff, Ars was able to verify at least some of Donenfeld's claims directly, quickly, and without external assistance. For instance, finding a validation function which simply returned true—and printf statements buried deep in cryptographic loops—required nothing more complicated than grep."

Comments (64 posted)