Hacker News Reader

Hacker News

Comment by palata | Hacker News Reader

Parent Full thread

palata

Did I say they weren't? Not sure why I'm being downvoted here.

View on HN

Op did immediately above you i.e.: "nothing to do with malice or exploitability"

and when asked to explain you responded with: "Didn't they say it already?"

Which any reader can verify they have not at the time of 1:42pm EST Oct 23 2026.

There are two different things here: there’s code that is vulnerable because of unnecessary complexity, and there is imputing malice or an intent to hide exploitability through complexity. OpenSSL exhibits the former, not the latter.

> OpenSSL exhibits the former, not the latter.

The OpenBSD folks came to the exact opposite conclusion after auditing the code:

"In a nutshell, This was a very effective exploit mitigation technique countermeasure. It could not have been designed better to make an attack like heartbleed both hard to detect and have dire consequences. OpenBSD's memory allocator, Valgrind, and Coverity do not notice the memory issues."

https://www.openbsd.org/papers/bsdcan14-libressl/mgp00007.ht...

Just a single damning slide among many here: https://www.openbsd.org/papers/bsdcan14-libressl/

More here: https://www.libressl.org/papers.html

Further, known exploits like the one crafted for XZ take advantage of plausible deniability and trust in contributors at every opportunity. Meaning that even if you wanted to disclaim malice, you cannot do so effectively.

They don’t appear to, at least not in my reading. “It could not have been designed better” reads more like an indictment of quality than an accusation of malfeasance.

The chosen phrasing is literally one step short of accusing the author of intent. "It could not have been designed better to [avoid detection] and cause harm" leaves open the possibility of accident, in the way that saying "this guillotine could not have been designed better to chop heads" leaves open the possibility of one spontaneously assembling from raw materials.

I mean, that seems intentional to me.

Better your threat model depend on that assumption than mine.

In my experience the phrase "it couldn't have been designed better to [negative thing]" is typically used, in a sarcastic, and usually exaggerated way, to mean "they did such a bad job, that they couldn't have done [negative thing] better, even if they had been intentionally trying to do [negative thing] (which they weren't)."

These days OpenBSD aren’t testing code with Valgrind. IMO the move to limit syscalls to known libs like libc was not a very smart move. It totally breaks Valgrind and from what I’ve seen (I’m not a security expert) it isn’t difficult to circumvent https://isopenbsdsecu.re/mitigations/pinsyscall/.

Reply on news.ycombinator.com