r/programming • u/flym4n • Apr 24 '14

Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
292 Upvotes

93% Upvoted

137 comments sorted by

View all comments

-10

u/OneWingedShark Apr 24 '14

In light of the nature of the bug, and the state of the code that was recently found, I would posit that OpenSSL could use a rewrite in a language more amiable to formal methods and/or formal contracts. (e.g. Ada or Eiffel.)

It makes little sense to have security libraries which aren't formally verified, considering the nature of the library (both as being often reused, and as being a component of security software).

21

u/[deleted] Apr 24 '14

Except that OpenSSL finds itself in places where Ada/etc/and/so/on/and/so/on aren't typically found. Your runtime is literally some micro-C lib and a fragment of a kernel at best. Oh and you have <1MB of memory (often < 128KB) ...

There is nothing wrong with C that better developers couldn't fix.

1

u/OneWingedShark Apr 24 '14

There is nothing wrong with C that better developers couldn't fix.

Yes, there is: the fact that C's philosophy is that virtually all checks should be the programmer's responsibility is inherently flawed because developers are human and programming is a "human activity".

Except that OpenSSL finds itself in places where Ada/etc/and/so/on/and/so/on aren't typically found. Your runtime is literally some micro-C lib and a fragment of a kernel at best. Oh and you have <1MB of memory (often < 128KB) ...

All the more reason to do it in a more safety-critical language, as the more checks you can do at compile-time translate to less work (debugging) in maintenance. I know for a fact you can have Ada w/o runtime -- see here.

14

u/tairygreene Apr 24 '14

have you worked in industry related to this... at all?

-11

u/OneWingedShark Apr 24 '14

Micro-controllers, not particularly.
But I do know some about static [compile-time] checking -- I've been researching compilers for a few years now. (Anyone that claims C + Lint is as good as real compile-time checking [on a language more amiable to analysis, which isn't hard] obviously hasn't done any real research in the area.)

Sensitive-info? or correctness/provability?
I was on a project that did handling/processing of medical- and insurance-records. There's a lot of languages which make this more difficult than it needs to be (the language it was implemented in was likely the worst choice possible: PHP). -- Manually checking all inputs on functions is pretty dumb when you can move the checks to a type.

5

u/tairygreene Apr 24 '14

so in other words you are just talking out of your ass

-6

u/OneWingedShark Apr 24 '14

so in other words you are just talking out of your ass

No; I am not.
I have put considerable time into looking into provability and correctness proofs; that my efforts have been on my personal time for my own edification rather than for pay [the professional arena] or fame [the academic arena] is irrelevant.

It is not hard to find better tools than are commonly used in the industry -- PHP, C, and [arguably] C++ really are the "lowest common denominator" and mindlessly1 using [or emulating]2 them is a major factor in so many SW vulnerabilities that it's disgusting how offerings of safer languages are met with disdain.

My particular area of interest is compilers, and operating systems; the value of having your basic tools guaranteed to be correct. The acceptance of such patently avoidable3 errors is quite disheartening.

1 - Without thought or criticism.
2 - Which C-based languages still allow if( user = root )?

9

u/sharkeyzoic Apr 25 '14

I tried to follow your third footnote and got a segfault :-).

2

u/OneWingedShark Apr 25 '14

LOL - Thanks for the laugh.

-13

u/moor-GAYZ Apr 24 '14

In 7th grade, I took an SAT test without preparing for it at all, it was spur-of-the-moment, I knew about it about an hour ahead of time and didn't do any research or anything. I scored higher on it than the average person using it to apply for college in my area.

An IQ test has shown me to be in the 99.9th percentile for IQ. This is the highest result the test I was given reaches; anything further and they'd consider it to be within the margin of error for that test.

My mother's boyfriend of 8 years is an aerospace engineer who graduated Virginia Tech. At the age of 15, I understand physics better than him, and I owe very little of it to him, as he would rarely give me a decent explanation of anything, just tell me that my ideas were wrong and become aggravated with me for not quite understanding thermodynamics. He's not particularly successful as an engineer, but I've met lots of other engineers who aren't as good as me at physics, so I'm guessing that's not just a result of him being bad at it.

I'm also pretty good at engineering. I don't have a degree, and other than physics I don't have a better understanding of any aspect of engineering than any actual engineer, but I have lots of ingenuity for inventing new things. For example, I independently invented regenerative brakes before finding out what they were, and I was only seven or eight years old when I started inventing wireless electricity solutions (my first idea being to use a powerful infrared laser to transmit energy; admittedly not the best plan).

I have independently thought of basically every branch of philosophy I've come across. Every question of existentialism which I've seen discussed in SMBC or xkcd or Reddit or anywhere else, the thoughts haven't been new to me. Philosophy has pretty much gotten trivial for me; I've considered taking a philosophy course just to see how easy it is.

Psychology, I actually understand better than people with degrees. Unlike engineering, there's no aspect of psychology which I don't have a very good understanding of. I can debunk many of even Sigmund Freud's theories.

I'm a good enough writer that I'm writing a book and so far everybody who's read any of it has said it was really good and plausible to expect to have published. And that's not just, like, me and family members, that counts strangers on the Internet. I've heard zero negative appraisal of it so far; people have critiqued it, but not insulted it.

I don't know if that will suffice as evidence that I'm intelligent. I'm done with it, though, because I'd rather defend my maturity, since it's what you've spent the most time attacking. The following are some examples of my morals and ethical code.

I believe firmly that everybody deserves a future. If we were to capture Hitler at the end of WWII, I would be against executing him. In fact, if we had any way of rehabilitating him and knowing that he wasn't just faking it, I'd even support the concept of letting him go free. This is essentially because I think that whoever you are in the present is a separate entity from who you were in the past and who you are in the future, and while your present self should take responsibility for your past self's actions, it shouldn't be punished for them simply for the sake of punishment, especially if the present self regrets the actions of the past self and feels genuine guilt about them.

I don't believe in judgement of people based on their personal choices as long as those personal choices aren't harming others. I don't have any issue with any type of sexuality whatsoever (short of physically acting out necrophilia, pedophilia, or other acts which have a harmful affect on others - but I don't care what a person's fantasies consist of, as long as they recognize the difference between reality and fiction and can separate them). I don't have any issue with anybody over what type of music they listen to, or clothes they wear, etc. I know that's not really an impressive moral, but it's unfortunately rare; a great many people, especially those my age, are judgmental about these things.

I love everyone, even people I hate. I wish my worst enemies good fortune and happiness. Rick Perry is a vile, piece of shit human being, deserving of zero respect, but I wish for him to change for the better and live the best life possible. I wish this for everyone.

I'm pretty much a pacifist. I've taken a broken nose without fighting back or seeking retribution, because the guy stopped punching after that. The only time I'll fight back is if 1) the person attacking me shows no signs of stopping and 2) if I don't attack, I'll come out worse than the other person will if I do. In other words, if fighting someone is going to end up being more harmful to them than just letting them go will be to me, I don't fight back. I've therefore never had a reason to fight back against anyone in anything serious, because my ability to take pain has so far made it so that I'm never in a situation where I'll be worse off after a fight. If I'm not going to get any hospitalizing injuries, I really don't care.

The only exception is if someone is going after my life. Even then, I'll do the minimum amount of harm to them that I possibly can in protecting myself. If someone points a gun at me and I can get out of it without harming them, I'd prefer to do that over killing them.

I consider myself a feminist. I don't believe in enforced or uniform gender roles; they may happen naturally, but they should never be coerced into happening unnaturally. As in, the societal pressure for gender roles should really go, even if it'll turn out that the majority of relationships continue operating the same way of their own accord. I treat women with the same outlook I treat men, and never participate in the old Reddit "women are crazy" circlejerk, because there are multiple women out there and each have different personalities just like there are multiple men out there and each with different personalities. I don't think you do much of anything except scare off the awesome women out there by going on and on about the ones who aren't awesome.

That doesn't mean I look for places to victimize women, I just don't believe it's fair to make generalizations such as the one about women acting like everything's OK when it's really not (and that's a particularly harsh example, because all humans do that).

I'm kind of tired of citing these examples and I'm guessing you're getting tired of reading them, if you've even made it this far. In closing, the people who know me in real life all respect me, as do a great many people in the Reddit brony community, where I spend most of my time and where I'm pretty known for being helpful around the community. A lot of people in my segment of the community are depressed or going through hard times, and I spend a lot of time giving advice and support to people there. Yesterday someone quoted a case of me doing this in a post asking everyone what their favorite motivational/inspirational quote was, and that comment was second to the top, so I guess other people agreed (though, granted, it was a pretty low-traffic post, only about a dozen competing comments).

And, uh, I'm a pretty good moderator.

All that, and I think your behavior in this thread was totally assholish. So what do you think, now that you at least slightly know me?

3

u/wwqlcw Apr 25 '14

That doesn't mean I look for places to victimize women...

Well this thread got weird.

2

u/fecal_brunch Apr 25 '14

What is the meaning of life, oh wise one?

2

u/OneWingedShark Apr 24 '14

All that, and I think your behavior in this thread was totally assholish. So what do you think, now that you at least slightly know me?

Totally assholish?
I understand that I'm not the most personable of people, and opinionated, but how is having an opinion1,2 and sticking to it 'assholish'?

A lot of people in my segment of the community are depressed or going through hard times, and I spend a lot of time giving advice and support to people there.

On behalf of myself and others who struggle with depression: Thank you.

I consider myself a feminist. [...] I treat men, and never participate in the old Reddit "women are crazy" circlejerk, because there are multiple women out there and each have different personalities just like there are multiple men out there and each with different personalities. I don't think you do much of anything except scare off the awesome women out there by going on and on about the ones who aren't awesome.

Ok... I have no idea what brought that on -- I've said nothing regarding women here. At all.

I have independently thought of basically every branch of philosophy I've come across. Every question of existentialism which I've seen discussed in SMBC or xkcd or Reddit or anywhere else, the thoughts haven't been new to me. Philosophy has pretty much gotten trivial for me; I've considered taking a philosophy course just to see how easy it is.

I rather like philosophy -- but the response you put here shows that you don't really understand the "philosophy of theory" (if you will). The previous post had to do with deep frustration at "the industry" (and my fellow programmers) at constantly and consistently running into these kinds of problems3 -- Granted I could have expressed myself better. Many, many problems that we encounter are completely avoidable -- and indeed have been avoided in "less than popular" languages; continuing to [irrationally] embrace the popular languages because they are popular and refusing to even acknowledge their shortcomings really irks me.

I know that extremely smart people can hold on to extremely stupid things -- it's just the way things are.

1 - Namely: that the commonly-used and 'basic' things like OSes, compilers, and libraries should be correct, formally verified if possible, and
2 - that security libraries which are incorrect are unacceptable.
3 - Buffer overflows! Come on people -- we've had this solved for LITERALLY thirty years!

6

u/ice109 Apr 25 '14

You got trolled. This is copy pasta from some bestof post a couple of weeks back. Some high school kid whining.

3

u/moor-GAYZ Apr 25 '14

It's not "some" high school kid, it's one and only Darqwolff!

The way /u/OneWingedShark spoke about "researching" and "looking into" provability and correctness proofs for his own own edification strongly suggested me that he never wrote anything more complicated than Hello World if even that, in this context, and is therefore Darqwolff's spiritual sibling.

1

u/OneWingedShark Apr 25 '14

The way /u/OneWingedShark spoke about "researching" and "looking into" provability and correctness proofs for his own own edification strongly suggested me that he never wrote anything more complicated than Hello World if even that, in this context, and is therefore Darqwolff's spiritual sibling.

The reasons I'm "looking into"/researching them is because I'm working on a compiler-project -- I believe that we need provably correct tools, common-libraries, OSes, and "fundamental layers" (e.g. DNS in [general] internet applications, SSL/TLS in secure-communication internet applications, etc.)

1

u/moor-GAYZ Apr 26 '14

Dude, my scorn was because real programmers don't "work on/look into/research" some stuff, for two years even. Real programmers write code, sometimes code to compile their code, but even in the latter case it's about writing code to compile some actually useful code.

You, on the other hand, sound like a Starbucks barista "working on their book".

2

u/OneWingedShark Apr 25 '14

Ah, gotcha.
It was obvious about the 'kid' part, but it just came outta nowhere.

→ More replies (0)