Date: Thu, 24 Apr 2014 05:10:12 -0700 From: "Ronald F. Guilmette" <rfg@tristatelogic.com> To: "freebsd-security@freebsd.org" <freebsd-security@freebsd.org> Subject: Re: OpenSSL static analysis, was: De Raadt + FBSD + OpenSSH + hole? Message-ID: <23889.1398341412@server1.tristatelogic.com> In-Reply-To: <546CE3A8-FC87-472F-8A63-0497D0D28789@cederstrand.dk>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <546CE3A8-FC87-472F-8A63-0497D0D28789@cederstrand.dk>, Erik Cederstrand <erik+lists@cederstrand.dk> wrote: >I don't disagree with you, but rewriting 1000 if-else cases in single-threaded >userland programs just so the analyzer understands them is 1) tedious and 2) >bound to accidentally introduce at least 50 new bugs I feel compelled to point out that one could make the exact same two assertions about writing code _generally_, i.e. writing software AT ALL is (1) tedious and (2) bound to accidentally introduce at least 50 new bugs. I feel further compelled to point out that at least the first of those two assertions also applies, in my experience, to writing QUALITY code. That doesn't mean it shouldn't be done. And anyway, who said anything about userland? I personally would contend that if the folks writing kernel code are failing to eliminate compile time warnings, then that is also a travesty, and perhaps even moreso than in the case of userland code. Certainly, if a developer misses a bug because he failed to pay any attention to the flashing yellow lights, then that is likely to have far more serious ramifications if the code in question is within the kernel. >...since most real-life examples >are considerably more complicated than the minimal example I posted. If in fact, as you assert, ``most'' real-life examples of contexts and situations where it is tedious and/or difficult to eliminate non-useful compile-time warnings are ``complicated'' then I would guess that it would be easy for you to find just _one_ such ``real life'' difficult example and post it here. Please do. In my personal estimation no such alleged ``complicated'' real life examples actually exist. But I am more than willing to be proven wrong. Regards, rfg
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?23889.1398341412>