4 ms·
To be fair, so could closed source code. The difference in this case is that a guy was running perf tests against postgres and noticed his ssh was slow, so he
by jethro_tell 3y ago
To be fair, so could closed source code.
The difference in this case is that a guy was running perf tests against postgres and noticed his ssh was slow, so he dove into that and found the backdoor a couple days after it was pushed.
If you had to submit 'my ssh daemon is slow' to a third party it would get put on the pile with the rest of them
- bee_rider 3y agoHmm, well they never find these kinds of attacks in closed source code. OTOH they never find these kinds of attacks in closed source code!
- wolverine876 3y agoClosed source is a little tougher: Often you need to get a job somewhere in their organization or supply chain.
- bashtoni 3y agoOr find a security vulnerability in their network, say a poorly secured FTP server as per SolarWinds.
- shrimp_emoji 3y agoAnd then you wouldn't have random people discovering it! It could even be covered up indefinitely.