3 ms·

Have you read http://marc.info/?l=openssl-dev&m=114652287210110&w=2 http://marc.info/?l=openssl-dev&m=114652287210110&w=... ? Sure Debian made a mistake, and t

by jeroen 18y ago

Have you read http://marc.info/?l=openssl-dev&m=114652287210110&w=2 http://marc.info/?l=openssl-dev&m=114652287210110&w=... ? Sure Debian made a mistake, and they shouldn't make changes that they don't understand the effects of, but an OpenSSL developer _did_ say it wouldn't be a problem. Instead of passing the blame I would rather see the parties involved working on the underlying issues.

tptacek 18y ago
All due respect, but, did you read the rest of the mailing list, or, for that matter, my original comment? He didn't clear the change; he said it was fine for debugging, before other OpenSSL people corrected him. There's no "problem" to fix here. Really! The problem is that Debian made an elective style-guide patch to OpenSSL based solely on Valgrind output. The "fix" to the problem is to back the patch out and make sure everyone's system is update. The only underlying issue that needs to be fixed here is for Debian to never, ever independently modify OpenSSL (or any other crypto code) again. I think that's reasonable at this point. This is one of the worst crypto vulnerabilities I've ever seen, far worse than when OpenSSL and NSS broke RSA.