One terrible, frightening line of OpenSSL code each day. 365 days a year until the madness ends. Maintained by @matthew_d_green.

Joined September 2012
OpenSSL Fact retweeted
In crypto: VERSIONING > NEGOTIATION. Nobody in the history of cryptography has ever gotten negotiation right. – at Austin, Chicago
4
23
40
OpenSSL thinks 15 is a prime number: blog.hboeck.de/archives/841-… /cc @OpenSSLFact
2
18
18
OpenSSL Fact retweeted
Fun OpenSSL fact: ssleay became OpenSSL because RSA - that RSA - aqui-hired Eric Young, the EAY in ssleay
1
12
16
#if 1 if (pseudorand == 2) { /* generate patterns that are more likely to trigger BN library bugs */ ... #whaaaaa
15
6
OpenSSL Fact retweeted
Replying to @OpenSSLFact
@OpenSSLFact "It recently occurred to me that 0^0^0^0^0^0^0 == 0" #opensslhumour des/des_locl.h
5
2
bn_rand(...){ /* make a random number and set the top and bottom bits */ time(&tim); RAND_add(&tim,sizeof(tim),0.0); #miningyourpsandqs
5
2
if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
1
3
/*The aim of right-shifting md_size is so that the compiler doesn't figure out that it can remove div_spoiler...which I hope is beyond it.*/
4
12
9
/* EEK! Experimental code starts */
6
5
MT @Code_Analysis The kind of things you find when you let a robot look at OpenSSL: viva64.com/en/b/0183/
1
9
8
Replying to @solardiz
.@solardiz @Code_Analysis "Consider inspecting the '*ptr++' pattern. Probably meant: '(*ptr)++'." << In OpenSSL's case, probably not :(
1
3
2
OpenSSL vs. best practices (RSA decryption edition Part 2, cont'd from Part 1 bit.ly/SWu3Sx) oi50.tinypic.com/29qbjhw.jpg
2
3
5
/* Construct the per-ENGINE context. We create it blindly and then use a lock to check for a race... pastebin.com/raw.php?i=n9vQ5…
1
4
3
/* ...so all future session negotiations will fail due to conflicts.*/ pastebin.com/raw.php?i=5FT4H…
OpenSSL vs. best practices (RSA decryption edition) oi50.tinypic.com/10xv6fc.jpg
7
20
9