3 ms·

Not always. Heartbleed was present in OpenSSL for two years before anyone noticed. Many eyes make all bugs shallow, but if there aren’t enough eyes with the sk

Not always. Heartbleed was present in OpenSSL for two years before anyone noticed. Many eyes make all bugs shallow, but if there aren’t enough eyes with the skills or the time then problems will remain deep, even for important software like this. Perhaps everyone thought everyone else had done the work?

ajross 8y ago
Heartbleed was a very subtle security bug, the discussion here is about privacy violations. You think that detecting if, I dunno, mutt is secretly uploading your contact list is going to escape detection for years?
- dmitriid 8y ago
  It will. IIRC HomeBrew’s integration of Goigle Analytics went unnoticed for almost a year, and only then they included an opt-out option (it’s still opt-in by default)
staticassertion 8y ago
OpenSSL can just as easily act as a point towards FOSS for privacy given that it was a vuln that was discovered externally (multiple times by distinct parties).
amelius 8y ago
Closed source code, even if it has no hidden purpose, may be hackable as well. Nothing is perfect. I think you are making an unfair comparison.
brownbat 8y ago
Heartbleed was found though. Thinking out loud here, what's the best counterfactual on HB? I can imagine a ClosedSSL that gets hammered in a blackhat presentation. I can imagine ClosedSSL getting fixed, eventually. It's just hard for me to imagine that happening faster because people like Neel couldn't read the code. Maybe the counterfactual is that ClosedSSL is also well funded and cares deeply about security, so it finds HB internally. But openness doesn't preclude funding. And closed source doesn't grant you an automatic security focus. So rich ClosedSSL vs poor OpenSSL isn't an apples to apples comparison. All things held equal, openness provides one extra possible avenue to find and catch bugs, and so such projects will tend to have more caught on average. What does HB teach us then? Just that some bugs are hard. Now, to be fair, if "openness" is just used as a substitute for internal security audits, a way to shrug and farm out that work and blame to passers-by, then that would be obviously terrible. That probably happens more than we'd like to admit, but I still don't think it's the typical reason people open their code.

ajross 8y ago

Heartbleed was a very subtle security bug, the discussion here is about privacy violations. You think that detecting if, I dunno, mutt is secretly uploading your contact list is going to escape detection for years?

dmitriid 8y ago
It will. IIRC HomeBrew’s integration of Goigle Analytics went unnoticed for almost a year, and only then they included an opt-out option (it’s still opt-in by default)

staticassertion 8y ago

OpenSSL can just as easily act as a point towards FOSS for privacy given that it was a vuln that was discovered externally (multiple times by distinct parties).

amelius 8y ago

Closed source code, even if it has no hidden purpose, may be hackable as well. Nothing is perfect. I think you are making an unfair comparison.

brownbat 8y ago

Heartbleed was found though. Thinking out loud here, what's the best counterfactual on HB? I can imagine a ClosedSSL that gets hammered in a blackhat presentation. I can imagine ClosedSSL getting fixed, eventually. It's just hard for me to imagine that happening faster because people like Neel couldn't read the code. Maybe the counterfactual is that ClosedSSL is also well funded and cares deeply about security, so it finds HB internally. But openness doesn't preclude funding. And closed source doesn't grant you an automatic security focus. So rich ClosedSSL vs poor OpenSSL isn't an apples to apples comparison. All things held equal, openness provides one extra possible avenue to find and catch bugs, and so such projects will tend to have more caught on average. What does HB teach us then? Just that some bugs are hard. Now, to be fair, if "openness" is just used as a substitute for internal security audits, a way to shrug and farm out that work and blame to passers-by, then that would be obviously terrible. That probably happens more than we'd like to admit, but I still don't think it's the typical reason people open their code.