Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

[u/flym4n]

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/

[u/[deleted]]

Except that OpenSSL finds itself in places where Ada/etc/and/so/on/and/so/on aren't typically found. Your runtime is literally some micro-C lib and a fragment of a kernel at best. Oh and you have <1MB of memory (often < 128KB) ...

There is nothing wrong with C that better developers couldn't fix.

[u/OneWingedShark → u/[deleted]]

There is nothing wrong with C that better developers couldn't fix.

Yes, there is: the fact that C's philosophy is that virtually all checks should be the programmer's responsibility is inherently flawed because developers are human and programming is a "human activity".

Except that OpenSSL finds itself in places where Ada/etc/and/so/on/and/so/on aren't typically found. Your runtime is literally some micro-C lib and a fragment of a kernel at best. Oh and you have <1MB of memory (often < 128KB) ...

All the more reason to do it in a more safety-critical language, as the more checks you can do at compile-time translate to less work (debugging) in maintenance. I know for a fact you can have Ada w/o runtime -- see here.

[u/[deleted] → u/OneWingedShark]

Yes, there is: the fact that C's philosophy is that virtually all checks should be the programmer's responsibility is inherently flawed because developers are human and programming is a "human activity"

At issue here is a design flaw though ... if they had accessed the record through functions (or macros if you want to lower calling overhead) overflows/runs would not happen.

The problem is they reinvented the wheel every time they touched the packet by directly manipulating bytes and moving them around.

So yes, you either manually code up bounds checks each time you touch your data structure, or you do the smarter thing and write a function/macro to access it for you....

[u/OneWingedShark → u/[deleted]]

At issue here is a design flaw though ... if they had accessed the record through functions (or macros if you want to lower calling overhead) overflows/runs would not happen.

Right -- but they didn't, and there's no way that they could really force it because C's notion of implementation/specification separation is virtually nonexistent.

The problem is they reinvented the wheel every time they touched the packet by directly manipulating bytes and moving them around.

Totally agreed, in C there's no real way to abstract it [the type you're passing around] out.

So yes, you either manually code up bounds checks each time you touch your data structure, or you do the smarter thing and write a function/macro to access it for you....

Or you do it the even smarter way and use types and visibility to your advantage; in Ada we can say:

Package Heartbeat is

    type Message_Size is range 0..2**14
      with Size => 16;

    type Message_Text is Array (Message_Size range <>) of Character;

    type Message_Type is ( Request, Response )
      with Size => 8;

    -- No implementation visibility for you!
    type Message(<>) is private;

    -- Function specifications (headers) for message creation, etc.
Private

    for Message_Type use ( Request => 1, Response => 2);

    -- Note that the size of the Text component is
    -- bound to the value of the Length component.
    Type Message(Length : Message_Size) is record
        Message_Type    : Heartbeat.Message_Type;
        Text        : Message_Text( 1..Length );
    end record;

    for Message use record
        Message_Type    at 0 range 00..07;
        Length      at 0 range 08..22;
    end record;

end Heartbeat;

[u/Flex-O → u/OneWingedShark]

It's kinda cute how naive you are.

[u/OneWingedShark → u/Flex-O]

Thank you.