4 ms·

Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed.

yjftsjthsd-h 5y ago
> Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed. It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.
- tptacek 5y ago
  The person you're responding to could simply provide every closed source TLS library as an example, because Heartbleed (a memory leak caused by implementing a TLS feature nobody was using) was exclusive to OpenSSL.
  - yjftsjthsd-h 5y ago
    That's absurd; we're comparing the rate of exploits, not whether the same exact exploit exists. By that logic, I can say that OpenSSL is perfect because it doesn't have (quick search) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-121 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
    - tptacek 5y ago
      It's not as absurd as it sounds, because a closed-source TLS library had less impetus to implement the extension that caused the vulnerability. But mostly I'm just making a point about the quality of the argument upthread.
zarzavat 5y ago
There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html

yjftsjthsd-h 5y ago

> Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed. It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.

tptacek 5y ago
The person you're responding to could simply provide every closed source TLS library as an example, because Heartbleed (a memory leak caused by implementing a TLS feature nobody was using) was exclusive to OpenSSL.
- yjftsjthsd-h 5y ago
  That's absurd; we're comparing the rate of exploits, not whether the same exact exploit exists. By that logic, I can say that OpenSSL is perfect because it doesn't have (quick search) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-121 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
  - tptacek 5y ago
    It's not as absurd as it sounds, because a closed-source TLS library had less impetus to implement the extension that caused the vulnerability. But mostly I'm just making a point about the quality of the argument upthread.

zarzavat 5y ago

There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html