20 ms·

Can someone tl;dr for me?

• cameronbrown 7y ago
  Heartbleed was a direct result of lack of resources. Billions of dollars have been shifted through OpenSSL but nobody thought to contribute back to this critical infra.
  • netsharc 7y ago
    NTP was being maintained by 1 guy in 2016: https://www.infoworld.com/article/3144546/time-is-running-out-for-ntp.html https://www.infoworld.com/article/3144546/time-is-running-ou... And then some committee came along and thought everything was crap and they'd do it better. Featuring ESR: https://lwn.net/Articles/713901/ https://lwn.net/Articles/713901/ An Internet without a reliable way of figuring out the true time would be... messy.
• Macha 7y ago
  http://veridicalsystems.com/blog/of-money-responsibility-and-pride/ http://veridicalsystems.com/blog/of-money-responsibility-and... Shortly after heartbleed it turned out openssl was funded by a couple of developers doing enhancements as contracting work and $9000/yr in donations despite being relied on by most of the internet.
• michaelt 7y ago
  OpenSSL is a very widely used SSL library. It's used by Apache and nginx, as well as many e-mail, chat and VPN servers. Estimates include 84% of popular websites, and 96% of GitHub client keys were generated with OpenSSL [1] Heartbleed [2] was a bug in OpenSSL disclosed in 2014, which had very severe security implications. Subsequently, people noticed OpenSSL typically receives about $2,000 in donations a year and has just one employee who works full time on the open source code. [3] [1] https://crocs.fi.muni.cz/public/papers/acsac2017 https://crocs.fi.muni.cz/public/papers/acsac2017 [2] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed [3] https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...