4 ms·

>benefits from far more usage and thus attention than alternative libraries For me this theory was disproved by Heartbleed.

• moomin 6y ago
  Indeed, OpenSSL was the premier SSL library for years and no-one noticed Heartbleed. Turns out not all bugs are shallow.
  • wglb 6y ago
    Yes, which is a misleading mantra. If nobody is looking, then it doesn’t matter
    • moomin 6y ago
      Turns out attackers were looking, though...
• tptacek 6y ago
  Since Heartbleed. Nobody disputes that the library was dilapidated when Heartbleed hit. Heartbleed was the wakeup call.
  • akuchling 6y ago
    I don't think user 'nopcode' was disputing that OpenSSL has improved since Heartbleed; I think they're suspicious of the logic that "far more usage" implies "more security-relevant attention".
    • tptacek 6y ago
      It's necessary but insufficient.