3 ms·
Didn’t the heart bleed exploit originate from an open source library? I don’t think open source is the panacea you think it is, exploits will exist as long as
by andreilys 5y ago
Didn’t the heart bleed exploit originate from an open source library?
I don’t think open source is the panacea you think it is, exploits will exist as long as they’re profitable and state actors have incentives to stock pile zero days. My guess is it’ll make it even easier to identify zero days if everything was open source.
- titzer 5y agoThey've been making this same argument for as long as I can remember, and it keeps being false. Open source means vulnerabilities get found and patched much quicker and people bring large-scale software bug-finding techniques to bear on the problem. For really robust software, we need better languages, better verification, and more and more testing and tools. All of which work best on source code.
- Bayart 5y agoThe immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3]. In that case open source was at least able to react appropriately, even if it didn't act preemptively. [1]: https://www.libressl.org https://www.libressl.org [2]: https://boringssl.googlesource.com/boringssl/ https://boringssl.googlesource.com/boringssl/ [3]: https://www.youtube.com/watch?v=GnBbhXBDmwU https://www.youtube.com/watch?v=GnBbhXBDmwU