Hacker News new | ask | show | jobs
by pencilo 4501 days ago
SSLVerifySignedServerKeyExchange in http://opensource.apple.com/source/Security/Security-55471/l...

If you want to see my favorite SSL bug ever.

2 comments

Oh god, that's horrifying. Get ready to check certificate validity, then report success before actually checking validity!
Wow. Maybe the inconsistent indentation and brackets-optional formatting helped the bug both arrive and persist?

Perhaps a preferable practice for security-conscious code would be to only set a success value after all checks have passed, rather than trust intervening logic to reset a default-success value, to an error-value, before return.