1. 17

An oldie but goodie from 2009: Someone tries to use openssl to do basic things, and ends up an alcoholic.

This matches my experience back in 2000, which tells me that it’s just a time capsule of bad code, and nobody’s ever cared enough to try to clean it up.

As someone on Twitter pointed out, the broken SSL cert on the site adds a bit of ironic humor.

  1.  

  2. 7

    self-signed certs are “broken”?

    1. 3

      I can’t imagine why a fundamental piece of the Internet’s infrastructure is so poorly written. Even passing the source code through a code formatter would make it 10x easier to read and support. Is everyone that afraid of touching crypto code that they won’t even fix the most minor “problem”? Is the test coverage not good enough to permit code cleanup? If I had any ‘C’ proficiency at all I would give it a go, but would the changes of an “outsider” be accepted?

      1. 2

        While a majority of the article was a good read, I do not agree that the first #ifdef swallows an instruction

        #ifdef foo
        if(this) {
          then_that()
        } else
        #endif
           something_else()
        

        will always work correctly AFAICS.

        If foo is defined, the entire else part would be something else. It does not swallow any instruction.

        While that is piss-poor style, it is still correct.