Check SSL lib for vulnerability

[andrewz]

Verify SSL lib rejects self-signed and 3rd party certificates:

​http://threatpost.com/en_us/blogs/ssl-vulnerabilities-found-critical-non-browser-software-packages-102512

[anevilyak]

This would be an app-level vulnerability, not the lib itself.

[diver]

Is this still relevant then?

[waddlesplash]

That story is gone, but I would say no. PulkoMandy added support to notify the user on invalid certs in HaikuWebKit's trunk, so this can be closed.

[diver]

Ok, thanks!

[pulkomandy]

​http://web.archive.org/web/20121127051829/http://threatpost.com/en_us/blogs/ssl-vulnerabilities-found-critical-non-browser-software-packages-102512

This is a well-known problem with OpenSSL, if nothing special is done it will accept any certificate without checking. BSecureSocket enables certificate checking, and cals a callback when the certificate can't be validated. The default implementation of the callback is to continue anyway. Applications which need a secure connection must override the callback and act as appropriate.