Slashdot Mirror

It depends, I guess they could if they could find enough monkeys who can type.

heartbleed

...

WHY DIDN'T A TEST CATCH IT?

A couple of months before this posting, I would have thought OpenSSL has done positive things for the community. Now I know that this is unreliable software that must be replaced as soon as viable. I've since learned better. Maybe OpenSSL didn't always suck. But, at the time of this writing in May of 2014, it sucketh.

A couple of days ago (at the time of this writing), OpenSSL Vahalla Rampage: "Sometimes bad tests can be more harmful than no tests at all" documents yet another bad test in the OpenSSL code. The OpenSSL code is riddled with problems, including tests that don't work as intended. So, there is a simple answer to the question: why a test didn't catch heartbleed. The answer is that reliable testing was not being performed. Multiple tests that were created, didn't work, and so couldn't be relied upon anyway.

Thank goodness there is a competent team on this planet who knows how to do things right, and is now taking care of the problem. (The makers of OpenSSH are ripping OpenSSL to shreds, and creating LibReSSL, the library that is a re-implementation of SSL code.)

For tons more examples of how cripplingly bad OpenSSL has become, see other articles on the OpenSSL Vahalla Rampage site. The site will probably mean nothing to people who don't know programming (or don't have enough experience to have been introduced to techniques like manually freeing up memory that was dynamically allocated earlier). I don't quite comprehend some of the intricacies, but some I do, and those that I do, are ROFL-making material. Like this amusing observation (which will amuse anyone who has used to C preprocessor), and many others.

Perhaps one of the best examples is the code that uses a goto statement, to jump to this label:

if (0)
                {
err:

That gem was found from Flingpoo! : OpenSSL is written by monkeys, yet another ridiculing site documenting the current tragedy of OpenSSL. That site has some other wretched examples, like the #ifdef...if...#endif...else mis-construct.

The GPS code I've seen was horrible and I worked for one of the major GPS players for several years. Originally written in FORTRAN and later automatically converted to C. Utter crap basically. The mathematics behind GPS is really interesting and quite involved. The implementations are crap.

Saved me from writing the same thing. The GPS code I've seen, written by engineers and not programmers, was an incredibly hacked-together, barely-functional set of kludges to implement a lot of very elegant mathematics.

For another example of a well written large project, try gcc.

Another example that's at least as elegant as gcc is OpenSSL.

I was doing similar research a few days ago.

Some of these are already mentioned...

• Lessfs - v1 is stable, v2 is pre-alpha/alpha. http://www.lessfs.com/
• Blackhole - http://www.vanheusden.com/java/BlackHole/ - requires Java, which seems like a bad idea to me for a block level device, but I haven't tested it yet.
• SDFS from OpenDedup - http://code.google.com/p/opendedup/ - http://www.opendedup.org/ - looks very promising, but may have stalled
• Dedupfs for Ext3 - http://pages.cs.wisc.edu/~kosmatka/dedupfs/
• ZFS. You know about that.
• DragonFly/Hammer - http://www.dragonflybsd.org/hammer/ includes dedup. Competitor to ZFS and Btrfs, also using Btree. Includes block level dedup, but I'm not sure if it's fixed block or not. Suspect it is fixed.
• Btrfs - there's a patch. Not sure if it's in mainlined yet. But without fsck btfs is not trustworthy enough. That's coming soon, but has been for a while. In case you read this as being negative about btrfs, it's not; it's an awesome file system, combining modern ideas and an excellent implementation, but it's still at testing stage for critical data.

Other stuff:

• Dext2 - an idea. No code. http://code.google.com/p/binarywarriors/
• BackupPC, the next version may have block level dedup, it's been suggested/requested. Numerous people pointed out the hard linking scheme it uses. I'm backing up VM images, which is what started me on this block-level dedup search, and when you have a small change in a 60BG file, it's a new file. (Yes, I have thought of schemes to split them.)
• Bacula have been experimenting with block level dedup, fixed and sliding. May be in future versions.
• Bup - https://github.com/apenwarr/bup has many of the ideas. It's not a file system, but could be reconstructed, I think. Based on Git store. I recommend reading http://apenwarr.ca/log/ which has more, and is entertaining. I think this is an excellent approach. Read back in his blog for details on bup ideas.
• SquashFS - for static data.
• Epitome - http://www.peereboom.us/epitome/man/ - for static data too, I think. Not fully investigated.
• I know I saw at least one Google Summer of Code submission about dedup. Haven't followed it up yet, and couldn't find the tab in my browser.
• Interesting conversation - http://news.ycombinator.com/item?id=2932335

By fixed block I mean that the file system does not search out shared data when the blocks are not on block boundaries. So if you add one byte to the beginning of a 10 GB file, and that has the unfortunate consequence of rippling up through all the blocks that make the file, then there will be no block level sharing with the original file. Of course that's a pathological case, but you get the idea.

Original poster, perhaps you could keep us informed of your findings? There's at least me who is also interested.

You might like to take a look at Epitome, which supports CAS, DEDUP, SIS and remote backup.

Or you could run Adsuck

Adblocking detectors don't work on it UNLESS the site uses ads generated on one of their own domains or subdomains (which is rare.. the majority of ads are 3rd party). It's brilliant stuff and is faster than Adblock.

Since I just misread it on freshmeat, I thought I'd share the scrotum WM, written to scratch an itch as they say...

http://www.peereboom.us/scrotwm/html/scrotwm.html

Way to bollox up the title of your project...