看板FB_security
標 題Re: OpenSSL static analysis, was: De Raadt + FBSD + OpenSSH + hole?
發信站NCTU CS FreeBSD Server (Thu Apr 24 13:10:12 2014)
轉信站ptt!csnews.cs.nctu!news.cednctu!FreeBSD.cs.nctu!.POSTED!freebsd.org!ow
In message <
[email protected]>,
Erik Cederstrand <
[email protected]> wrote:
>I don't disagree with you, but rewriting 1000 if-else cases in single-threaded
>userland programs just so the analyzer understands them is 1) tedious and 2)
>bound to accidentally introduce at least 50 new bugs
I feel compelled to point out that one could make the exact same two
assertions about writing code _generally_, i.e. writing software AT ALL
is (1) tedious and (2) bound to accidentally introduce at least 50 new bugs.
I feel further compelled to point out that at least the first of those
two assertions also applies, in my experience, to writing QUALITY code.
That doesn't mean it shouldn't be done.
And anyway, who said anything about userland?
I personally would contend that if the folks writing kernel code are
failing to eliminate compile time warnings, then that is also a travesty,
and perhaps even moreso than in the case of userland code.
Certainly, if a developer misses a bug because he failed to pay any
attention to the flashing yellow lights, then that is likely to have
far more serious ramifications if the code in question is within the
kernel.
>...since most real-life examples
>are considerably more complicated than the minimal example I posted.
If in fact, as you assert, ``most'' real-life examples of contexts and
situations where it is tedious and/or difficult to eliminate non-useful
compile-time warnings are ``complicated'' then I would guess that it
would be easy for you to find just _one_ such ``real life'' difficult
example and post it here.
Please do.
In my personal estimation no such alleged ``complicated'' real life examples
actually exist.
But I am more than willing to be proven wrong.
Regards,
rfg
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "
[email protected]"