4 ms·

This is similar to the Apple SSL bug. Good on them for looking for similar errors in their own code. Thanks Redhat, for the audit, and for making the internet

by illumen 13y ago

This is similar to the Apple SSL bug. Good on them for looking for similar errors in their own code. Thanks Redhat, for the audit, and for making the internet safer! This is a win for Free software (and OSS), since the history of the bug can be traced, and outside developers can audit it. We still don't know how the bug got in there with the Apple bug - since the repository is not open.

stephenr 13y ago
So Apple has an admittedly serious bug that is in the wild on iOS for ~17 months, and desktops for ~ 4 1/2 months, and everyone shits on Apple for it. GNUTLS has a (using your words) "similar" bug in the wild for more than 13 YEARS, and its nothing but praise because "they audited the code"?
lawnchair_larry 13y ago
This is definitely a moment of shame, not praise. Good on RedHat for the audit, but a dark moment for GnuTLS. That was some dumb code in a very important place. Nobody reviewed that at all, clearly.