From owner-freebsd-security@freebsd.org  Sun Dec 13 02:07:39 2020
Return-Path: <owner-freebsd-security@freebsd.org>
Delivered-To: freebsd-security@mailman.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.nyi.freebsd.org (Postfix) with ESMTP id E34584A9195
 for <freebsd-security@mailman.nyi.freebsd.org>;
 Sun, 13 Dec 2020 02:07:39 +0000 (UTC) (envelope-from kaduk@mit.edu)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 4CtnwV5x5Vz4lBM
 for <freebsd-security@freebsd.org>; Sun, 13 Dec 2020 02:07:38 +0000 (UTC)
 (envelope-from kaduk@mit.edu)
Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56)
 (User authenticated as kaduk@ATHENA.MIT.EDU)
 by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 0BD27RF4015128
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
 for <freebsd-security@freebsd.org>; Sat, 12 Dec 2020 21:07:32 -0500
Date: Sat, 12 Dec 2020 18:07:27 -0800
From: Benjamin Kaduk <kaduk@mit.edu>
To: freebsd-security@freebsd.org
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-20:33.openssl
Message-ID: <20201213020727.GP64351@kduck.mit.edu>
References: <20201209230300.03251CA1@freefall.freebsd.org>
 <20201211064628.GM31099@funkthat.com>
 <813a04a4-e07a-9608-40a5-cc8e339351eb@FreeBSD.org>
 <20201213005708.GU31099@funkthat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20201213005708.GU31099@funkthat.com>
X-Rspamd-Queue-Id: 4CtnwV5x5Vz4lBM
X-Spamd-Bar: ++
Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none;
 spf=pass (mx1.freebsd.org: domain of kaduk@mit.edu designates 18.9.28.11 as
 permitted sender) smtp.mailfrom=kaduk@mit.edu
X-Spamd-Result: default: False [2.53 / 15.00]; RCVD_TLS_LAST(0.00)[];
 RWL_MAILSPIKE_VERYGOOD(0.00)[18.9.28.11:from]; ARC_NA(0.00)[];
 FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[];
 R_SPF_ALLOW(-0.20)[+ip4:18.9.28.0/24];
 MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[];
 PREVIOUSLY_DELIVERED(0.00)[freebsd-security@freebsd.org];
 NEURAL_SPAM_MEDIUM(0.83)[0.831]; RCPT_COUNT_ONE(0.00)[1];
 DMARC_NA(0.00)[mit.edu]; NEURAL_SPAM_SHORT(1.00)[0.998];
 NEURAL_SPAM_LONG(1.00)[1.000]; FROM_EQ_ENVFROM(0.00)[];
 R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+];
 ASN(0.00)[asn:3, ipnet:18.9.0.0/16, country:US];
 RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[freebsd-security];
 RECEIVED_SPAMHAUS_PBL(0.00)[24.16.140.251:received]
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Dec 2020 02:07:39 -0000

On Sat, Dec 12, 2020 at 04:57:08PM -0800, John-Mark Gurney wrote:
>
> If FreeBSD is going to continue to use OpenSSL, better testing needs to
> be done to figure out such breakage earliers, and how to not have them
> go undetected for so long.

I don't think anyone would argue against increasing test coverage.
The most important question seems to be how to know what should be getting
tested but isn't.  Do you have any ideas for where to start looking?

Thanks,

Ben