Em 10-04-2014 15:22, Theo de Raadt escreveu: >>> Compile libssl with -DDOPENSSL_NO_BUF_FREELIST >>> >>> >> Yes but that's because OpenSSL is broken. > If OpenSSL had not been broken in this respect, Segglemann's bug > would not have survived any sort of testing or peer review. > >> So no, fixing OpenSSL to work without its freelist would not necessarily >> have exposed heartbleed. > John, there is bullshit coming out of your mouth. > Oh my. Let us do a ssl library. Oh, it would be nice if we managed our own memory, you know, cause every library should manage their own memory. Why trust the operating system? After all it is not like it has being doing this forever. If more people use OpenBSD to develop and test things, I assure you that the world would be safer.
-- Giancarlo Razzolini GPG: 4096R/77B981BC
