Hacker News Reader

Comment by jgrahamc | Hacker News Reader

Interesting part is that the bug was introduced in the latest versions and has been fixed by the person who inserted it :-)

Bug added: https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae...

Bug removed: https://github.com/openssl/openssl/commit/2aacec8f4a5ba1b365...

Although that's just the committer: https://twitter.com/agl__/status/619129579580469248

View on HN

Looking at the changes that introduced the bug, it's obvious that the nature of the problems being solved is too complex for the changes to be only "visually" reviewed. There must be enough external tests to "uncover" the potential issues. And the tests of course can have the bugs too, not covering what needed to be covered. That's why for so sensitive code the testers should be the best programmers with additional preference to search for the combinations that don't work as intended.

You're confused. This thread is about OpenSSL. OpenSSL doesn't have tests.

Even if doesn't have tests at the moment that doesn't mean that it should always remain that way.

Yep, that the bug was recently introduced was implied from the notice they put out.

For interest, the line that was fixed from the first commit is:

https://github.com/openssl/openssl/commit/da084a5ec6cebd67ae...

    /* Remember how many untrusted certs we have */
    j = num;

Flawless.

Reply on news.ycombinator.com