bracewel
Joined 12 years ago
Karma
464
Submissions
66
Member since
Dec 5
Recent submissions
Comment · 1 year ago
This is mainly actually for testing constant-time code, rather than doing proper memory tracking (see https://www.imperialviolet.org/2010/04/01/ctgrind.html for a slightly out-of-date description of this technique).
Comment · 1 year ago
Author of the linked CL here: we added this mostly so that we could abuse the memory initialization tracking to test the constant-time-ness of crypto code (similar to what BoringSSL does, proposed by agl around fifteen years ago: https://www.imperialviolet.org/2010/04/01/ctgrind.html), which is an annoyingly hard property to test.
We're hoping that there are also a bunch of other interesting side-effects of enabling the usage of Valgrind for Go, in particular seeing how we can use it to track how the runtime handles memory (hopefully correctly!)
edit: also strong disclaimer that this support is still somewhat experimental. I am not 100% confident we are properly instrumenting everything, and it's likely there are still some errant warnings that don't fully make sense.
Comment · 4 years ago
There is a fifth, incredibly common, (arguably) non-malicious possibility.
You don't control the entirety of your web stack, and your hosting provider, or DNS provider, or someone else, has decided to be 'helpful' (either blindly, or due to some misconfiguration somewhere along the line) and issue a certificate on your behalf, as they are able to intercept CA validation traffic at the DNS, TLS, or HTTP layer.
Comment · 7 years ago
ah yes, I remember personally lying to congress and pushing false narratives in the media. oh wait, no, that wasn't me was it...
Comment · 8 years ago
Note that CABF bylaws require a simple majority of browsers to vote positively for a ballot for it to pass, regardless of how CAs vote.
Comment · 10 years ago
> CA/SSL specification does not change weekly...
The draft ACME specification does though.