The pandemic of incomplete OpenSSL error handling

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Recently a person reported a bug in APT saying that TLS is failing on FIPS systems with MD5 errors, and suggested we call ERR_clear_error() around TLS operations. Like any serious software engineer would do, I said No. Just because one component failed to handle its errors does not mean I can go around and discard all errors in another place - the program should have failed earlier (or discarded…

Read on blog.jak-linux.org ↗