Miss Dada  🏳️‍⚧️

idk it seems bad to me that openssl implements both fundamental cryptographic algorithms, *and* a bunch of protocol/policy stuff. seems like they should be separate things. idk

today I learned it delegates part of the verification process to the caller, after doing its own built-in checks, but this interface is done in a way that means the caller can simply override and ignore the built-in checks

like I was being flippant when I said I'd simply make it easy to implement correctly but this is the sort of interface that something like this should not have

as in, you pass a function pointer to openssl, and it calls it with an int saying if its own checks passed or not. your function can simply, ignore this int, if it wants to

That's just C in a nutshell though

I would simply not pass this int to an untrusted function

ah yeah hmm this server's certificates are all busted. what do you reckon, random piece of code I've not reviewed and have just been linked to