3 ms·
This is why you don't change any code without understanding. Is it broken? no? then don't fix it! I find it super hard to believe this wasn't the very first su
by grayhatter 2y ago
This is why you don't change any code without understanding.
Is it broken? no? then don't fix it! I find it super hard to believe this wasn't the very first supply chain attack discovery. (If anyone knows of a verified early one, I'd love to be corrected!)
- Karellen 2y agoIf it were a supply chain attack, I find it hard to believe that a) it would have originated from Debian at all, and b) that the people making the patch would have posted to the openssl-dev mailing list to ask their opinion on the correctness of the patch before including/shipping it. https://lwn.net/Articles/282038/ https://lwn.net/Articles/282038/