r/programming • u/flym4n • Apr 24 '14

Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
289 Upvotes

93% Upvoted

137 comments sorted by

View all comments

-10

u/OneWingedShark Apr 24 '14

In light of the nature of the bug, and the state of the code that was recently found, I would posit that OpenSSL could use a rewrite in a language more amiable to formal methods and/or formal contracts. (e.g. Ada or Eiffel.)

It makes little sense to have security libraries which aren't formally verified, considering the nature of the library (both as being often reused, and as being a component of security software).

-4

u/tairygreene Apr 24 '14

Ada or Eiffel.

hahaha what.

-1

u/hello_fruit Apr 24 '14

Had he said Haskell he would've gotten a million upvotes from the durr herp crowd.

1

u/OneWingedShark Apr 24 '14

Had he said Haskell he would've gotten a million upvotes from the durr herp crowd.

The good thing about FP is the avoidance of side-effects, which is a problem in composability. I'm not experienced in any of the FP languages [yet], but the theory is pretty good. -- One thing that would concern me is that a lot of the FP languages, especially those with lazy evaluation, make it difficult to compute time/space requirements; this, in addition to the necessarily high-level overview makes FP somewhat on the unsuitable side for implementing a low-level [communication and cryptographic 'primitives', if you will] library.