4 ms·
> If you cannot trust Debian - whom can you trust? When did Debian become a model of trustworthiness regarding software security? We are talking about one of
by WastingMyTime89 5y ago
> If you cannot trust Debian - whom can you trust?
When did Debian become a model of trustworthiness regarding software security?
We are talking about one of the distributions applying the most patches to its repository for reasons which are often dubious and with little general oversight.
Debian is famous for being run by volunteers but it has always been kind of dodgy. We are talking about the distribution which made it's version of openssl vulnerable by breaking its random generator in order to silence a Valgrind warning.
- orra 5y agoEh, OpenSSL was invoking blatantly undefined behaviour. The diff applied by Debian? GCC and Clang are perfectly entitled to behave the same.
- WastingMyTime89 5y agoBut neither GCC nor Clang did and the diff applied by Debian actually triggered the bug without fixing anything. The fact that OpenSSL also happened to be a terrible piece of software doesn't exonerate Debian.
- orra 5y agoI have to disagree: OpenSSL shares the blunt of the blame. (Whilst saying that, it doesn’t help that both projects are under resourced.) The Debian maintainer contacted upstream about the underlying issue, but received no response. Nor did the patch break any tests. We've also seen since then just how broken OpenSSL was generally, with Heartbleed. And why did OpenSSL have its own RNG that invoked undefined behaviour, when it could just read from /dev/random? Moreover, in hindsight, we have a much better understanding of undefined behaviour than we used to. Undefined behaviour is not “occasionally the optimiser might bite you” but “sometimes you'll get (un)lucky in that it’ll appear to work. Don’t do it”.
- deleted 5y ago[deleted]