4 ms·
apart from the fact that the current openssh issues are pretty much unrelated to crypto code, I'll still stick with not implementing my own crypto, just because
by Xylakant 11y ago
apart from the fact that the current openssh issues are pretty much unrelated to crypto code, I'll still stick with not implementing my own crypto, just because
a) I would not have thought of the issue of using a standard library call to load data.
b) nobody would have checked my code and fixed it
so in the end, I'd still be vulnerable while openssh is now fixed.
- passive 11y agoI think this is a very key point. OpenSSH gets targeted for vulnerability analysis by very talented people, on a regular basis. I would be surprised if there are more than a dozen organizations on the planet that can deploy those kind of resources against their homegrown code.
- someguydave 11y agohow many of those dozen organizations would actually release the results of their analysis?
- Xylakant 11y agoGiven the number of CVEs filed a nonzero number. In any case more organization than the number of orgs that would bother to check my code.