Re: Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)

[Steffen Nurpmeso <steffen () sdaoden eu>]

  ...
 |On Wed, Nov 2, 2022 at 7:57 AM Tavis Ormandy <taviso () gmail com> wrote:
 |> I don't know rust, so serious question - if this same buggy punycode

The problem with punycode is punycode as such.
It should have been URL-encoded UTF-8 maybe with normal
decomposition from the start, and the DNS limits should have been
raised, all that now well over twenty years ago.

Poul-Hennig Kamp of FreeBSD, varnish etc wrote just this week on
another ML

 |> The other ting to keep in mind is the immense existing codebase of
 |> unix kernels et al, not to mention application code depending on
 |> those kernels.
 |
 |This is the mistake we IT-people keep doing again and again:
 |
 |Forwards compatibility is /far/ more important than backwards compatibil\
 |ity.

It would have been grown out by now.  And many problems would
never happened, including those incompatibilities that they wanted
to avoid.  My one cent.

Other than that.  Sigh.  C is the culprit!!

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)