Hacker News
new
|
past
|
comments
|
ask
|
show
|
jobs
|
submit
login
solarengineer
on May 3, 2016
|
parent
|
context
|
favorite
| on:
OpenSSL Security Advisory
Does anyone know if there is an SSL specification somewhere? One could then start to write tests at various levels to ensure compliance with the specification. This test suite could then be considered a compatibility test suite as well.
lmm
on May 3, 2016
|
next
[–]
The spec generally only specifies the correct behaviour, not what the program should be doing with e.g. malformed ASN.1.
theandrewbailey
on May 3, 2016
|
prev
|
next
[–]
The SSL spec (if you can call it that) and everything it depends on is spread over about a dozen or so RFCs. Good luck.
IgorPartola
on May 3, 2016
|
prev
|
next
[–]
This has been discussed to death, and the conclusion is generally that testing for unknown security bugs is not possible (or at least not practical).
CiPHPerCoder
on May 3, 2016
|
prev
[–]
There are numerous RFCs, yes.
Guidelines
|
FAQ
|
Lists
|
API
|
Security
|
Legal
|
Apply to YC
|
Contact
Search:
