4 ms·

“The catastrophic Heartbleed bug of 2014, which compromised the security of hundreds of millions of sites, was caused by a problem in an open-source library cal

“The catastrophic Heartbleed bug of 2014, which compromised the security of hundreds of millions of sites, was caused by a problem in an open-source library called OpenSSL, which relied on a single full-time developer not making a mistake as they updated and changed that code, used by millions.” And the catastrophic Specter and Meltdown bugs show that private code doesn’t prevent this sort of thing either...

EGreg 7y ago
The best situation is many independent people vetting code and new versions before it is used somewhere. I wrote this 7 years ago: http://magarshak.com/blog/?p=114 http://magarshak.com/blog/?p=114
LomaxJunior 7y ago
Global Standards can be included in that list, here is one example called Signalling System 7. https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc... Caller ID uses a protocol used by dial up modems, which means the telecoms hardware supporting it, is in effect, a dialup modem which makes life easier for security services to remotely access systems once they have updated the firmware on telecoms hardware, for a persistent backdoor.
- rhizome 7y ago
  I would never rely on Caller ID, particularly for something like that. Modems have had callback for decades: call up, identify yourself, the connection is dropped and the system dials a stored number for that ID and the connection is set up for the session. https://en.wikipedia.org/wiki/Callback_(telecommunications)#Modem_security https://en.wikipedia.org/wiki/Callback_(telecommunications)#...
BrandonMarc 7y ago
Yes, the OpenSSL dustup led to this amusing article: The Internet Is Being Protected By Two Guys Named Steve [1] ... the more serious point being, at the time, massive pieces of the internet owed their security to two unpaid/underpaid developers on two different continents. [1] https://news.ycombinator.com/item?id=7657571 https://news.ycombinator.com/item?id=7657571
gitgud 7y ago
Yes, I thought that was a weird jab at the maintainer of OpenSSL...
- kevingadd 7y ago
  It was absolutely not the maintainer's "fault", which seems like it should have been clearly illustrated by them making the point that there was one developer? The whole point is that tons of companies relied on OpenSSL but none of them were stepping up to the plate and funding its maintenance to the point of there being multiple maintainers, so it all fell on that one maintainer's shoulders. Of course after the shit hit the fan those companies had a change of heart and... forked it. Learning the wrong lessons as usual I recall reading a couple articles in the past about how NTP was (is?) maintained by one full-time developer who barely broke even on doing it, despite the fact that massive chunks of internet infrastructure rely on it. There's money and personnel out there who could be contributing to infra like OpenSSL and NTP and very often it seems like nobody cares enough to fund it.

EGreg 7y ago

The best situation is many independent people vetting code and new versions before it is used somewhere. I wrote this 7 years ago: http://magarshak.com/blog/?p=114 http://magarshak.com/blog/?p=114

LomaxJunior 7y ago

Global Standards can be included in that list, here is one example called Signalling System 7. https://en.wikipedia.org/wiki/Signalling_System_No._7#Protocol_security_vulnerabilities https://en.wikipedia.org/wiki/Signalling_System_No._7#Protoc... Caller ID uses a protocol used by dial up modems, which means the telecoms hardware supporting it, is in effect, a dialup modem which makes life easier for security services to remotely access systems once they have updated the firmware on telecoms hardware, for a persistent backdoor.

rhizome 7y ago
I would never rely on Caller ID, particularly for something like that. Modems have had callback for decades: call up, identify yourself, the connection is dropped and the system dials a stored number for that ID and the connection is set up for the session. https://en.wikipedia.org/wiki/Callback_(telecommunications)#Modem_security https://en.wikipedia.org/wiki/Callback_(telecommunications)#...

BrandonMarc 7y ago

Yes, the OpenSSL dustup led to this amusing article: The Internet Is Being Protected By Two Guys Named Steve [1] ... the more serious point being, at the time, massive pieces of the internet owed their security to two unpaid/underpaid developers on two different continents. [1] https://news.ycombinator.com/item?id=7657571 https://news.ycombinator.com/item?id=7657571

gitgud 7y ago

Yes, I thought that was a weird jab at the maintainer of OpenSSL...

kevingadd 7y ago
It was absolutely not the maintainer's "fault", which seems like it should have been clearly illustrated by them making the point that there was one developer? The whole point is that tons of companies relied on OpenSSL but none of them were stepping up to the plate and funding its maintenance to the point of there being multiple maintainers, so it all fell on that one maintainer's shoulders. Of course after the shit hit the fan those companies had a change of heart and... forked it. Learning the wrong lessons as usual I recall reading a couple articles in the past about how NTP was (is?) maintained by one full-time developer who barely broke even on doing it, despite the fact that massive chunks of internet infrastructure rely on it. There's money and personnel out there who could be contributing to infra like OpenSSL and NTP and very often it seems like nobody cares enough to fund it.