3 ms·

That's why you don't change upstream code without reason.

• ckastner 2y ago
  Not only did they have a reason, they discussed the reason and the proposed change with upstream.
  • gsich 2y ago
    https://lwn.net/Articles/282038/ https://lwn.net/Articles/282038/ comments here read differently.
• grayhatter 2y ago
  This is why you don't change any code without understanding. Is it broken? no? then don't fix it! I find it super hard to believe this wasn't the very first supply chain attack discovery. (If anyone knows of a verified early one, I'd love to be corrected!)
  • Karellen 2y ago
    If it were a supply chain attack, I find it hard to believe that a) it would have originated from Debian at all, and b) that the people making the patch would have posted to the openssl-dev mailing list to ask their opinion on the correctness of the patch before including/shipping it. https://lwn.net/Articles/282038/ https://lwn.net/Articles/282038/
• yjftsjthsd-h 2y ago
  > That's why you don't change upstream code without reason. They did have a reason; they were running analysis on the code, and one of their tools specifically called openssl out for using uninitialized memory, which is absolutely a red flag. But not to worry; rather than blindly patching it to fix the bug, they went out of their way to go ask upstream about it, appeared to get a favorable response to their patch, and then went ahead.