timschmidt
Joined 12 years ago
Joined 12 years ago
The OpenBSD folks came to the exact opposite conclusion after auditing the code:
"In a nutshell, This was a very effective exploit mitigation technique countermeasure. It could not have been designed better to make an attack like heartbleed both hard to detect and have dire consequences. OpenBSD's memory allocator, Valgrind, and Coverity do not notice the memory issues."
https://www.openbsd.org/papers/bsdcan14-libressl/mgp00007.ht...
Just a single damning slide among many here: https://www.openbsd.org/papers/bsdcan14-libressl/
More here: https://www.libressl.org/papers.html
Further, known exploits like the one crafted for XZ take advantage of plausible deniability and trust in contributors at every opportunity. Meaning that even if you wanted to disclaim malice, you cannot do so effectively.
and when asked to explain you responded with: "Didn't they say it already?"
Which any reader can verify they have not at the time of 1:42pm EST Oct 23 2026.
And yet, due to the shape Apple chose, it did not.
"You're feeling it wrong" from the same folks as "you're holding it wrong". Yeesh.
Lowest cost of production is what that formfactor provides.
Palm's devices, by contrast, felt like a polished river stone in the pocket. I know which I prefer.