from the Security Cryptography Whatever podcast, talking about openssl API design choices: https://youtu.be/jhdLja5mWbU
YouTube
Obviously you have to do a string compare to do AES GCM in OpenSSL 3
Jann Horn
@jann@infosec.exchange
human borrow checker (but logic bugs are best bugs).
works at Google Project Zero.
The density of logic bugs (compared to memory corruption bugs) goes down as the privilege differential between attacker context and target context goes up.
November 18, 2022
A few years ago I designed a way to detect bit-flips in Firefox crash reports and last year we deployed an actual memory tester that runs on user machines after the browser crashes. Today I was looking at the data that comes out of these tests and now I'm 100% positive that the heuristic is sound and a lot of the crashes we see are from users with bad memory or similarly flaky hardware. Here's a few numbers to give you an idea of how large the problem is. 
1/5
