What about putting in effort into writing extensive test suites and fuzzing of OpenSSL? This would allow a gradual refactoring effort to clean up the nastiest bits.
What about putting in effort into writing extensive test suites
Easier said than done. Writing test-suites for a codebase which never had a test-suite is a million times harder than writing a test-suite for new, fresh code.
In fact it's probably easier to start over than re-factoring the code to be testable in the first place, but some people might argue that would be a wee bit drastic. So not saying it can't be done, just that it does take a very significant effort.
If anyone should still feel like doing something like this, I can very much recommend the following book for advice and morale boost:
Comments
What about putting in effort into writing extensive test suites and fuzzing of OpenSSL? This would allow a gradual refactoring effort to clean up the nastiest bits.
Easier said than done. Writing test-suites for a codebase which never had a test-suite is a million times harder than writing a test-suite for new, fresh code.
In fact it's probably easier to start over than re-factoring the code to be testable in the first place, but some people might argue that would be a wee bit drastic. So not saying it can't be done, just that it does take a very significant effort.
If anyone should still feel like doing something like this, I can very much recommend the following book for advice and morale boost:
http://www.amazon.com/gp/product/0131177052/ref=as_li_ss_tl?...
(Discalimer: Affiliate link)
That might help against factual bugs, but not against a horrible API, the misleading docs and harmful defaults.