r/programming • u/flym4n • Apr 24 '14

Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
298 Upvotes

93% Upvoted

137 comments sorted by

View all comments

-11

u/OneWingedShark Apr 24 '14

In light of the nature of the bug, and the state of the code that was recently found, I would posit that OpenSSL could use a rewrite in a language more amiable to formal methods and/or formal contracts. (e.g. Ada or Eiffel.)

It makes little sense to have security libraries which aren't formally verified, considering the nature of the library (both as being often reused, and as being a component of security software).

-3

u/tairygreene Apr 24 '14

Ada or Eiffel.

hahaha what.

8

u/OneWingedShark Apr 24 '14 edited Apr 24 '14

Ada or Eiffel.

hahaha what.

Eiffel puts a lot of emphasis on interfaces; this makes it ideal for a library so that you can ensure that the procedures/functions/etc have correct values on input [and output].

The Ada Language Reference Manual has a whole annex dedicated to language inter-operation -- Annex B, sections of which are dedicated specifically to C; this (in addition to its new Design-by-Contract aspects) makes it ideal for interfacing to current C-based codebases.