4 ms·

I can't imagine what this guy must be feeling right now. I find it embarrassing enough when I am outed in my small team for producing a bug that makes it into p

by weavie 13y ago

I can't imagine what this guy must be feeling right now. I find it embarrassing enough when I am outed in my small team for producing a bug that makes it into production. To be known around the entire internet to have caused the largest security bug in recent times must be quite a slammer. I really hope it doesn't affect his career..

Karunamon 13y ago
The armchair crypto brigade aren't helping much, either, by passing around these completely unfounded accusations of malfeasance. I'm all for being aware of the possibility that shenanigans are involved, but until proof comes out, it is nothing but a possibility, and a remote one at that.
- kmkemp 13y ago
  "Never attribute to malice that which is adequately explained by stupidity." Obviously "stupidity" is way too strong here, but the principle still applies.
  - senorprogrammer 13y ago
    In this case I would replace "stupidity" with "assumption". It was code-reviewed so that level assumed correctness. It's in OpenSSL, which is written by experts, so the millions of us that use it every day assumed correctness. Our customers know little about the workings of the internet, so they assume correctness. This, incidentally, is the same sort of thinking that sometimes kills experts in dangerous situations: the assumption that someone smarter than us must by definition know more than us, so we can be lackadaisical. Witness Snow Fall (http://www.nytimes.com/projects/2012/snow-fall/?forceredirect=yes#/?part=tunnel-creek http://www.nytimes.com/projects/2012/snow-fall/?forceredirec...)
  - anonbanker 13y ago
    The rest of the quote is "...but don't rule out malice."
rext 13y ago
I'd be amazed if he doesn't break from the pressure and/or abuse.
thefreeman 13y ago
Let the programmer who has never written a bug cast the first stone.
protomyth 13y ago
I'm actually more worried that this will result in a civil lawsuit from one of the affected companies. In an ideal world[1], it would get thrown out immediately, but I'm a bit worried. That would have a heck of a chilling affect. 1) and a simple reading of the license
- danielweber 13y ago
  Is it 'rayiner who tells us to always have the disclaimer for liability in our licenses? Whoever it is, this is why. I think any company that is damaged by this should get all their money back, all $0 of it.
  - protomyth 13y ago
    My only worry is some nasty lawyer will figure out a way around the disclaimer. I am hoping not and that it has been well established, but the courts are often a bit insane.
_ak 13y ago
He works for T-Systems, which belongs to Deutsche Telekom. His job is pretty safe, I would say. People working for Deutsche Telekom work under conditions similar to German civil servants in terms of terminability.
mikeash 13y ago
I wouldn't be surprised if it was good for his career in the long run. Smart people will know that bugs like this can happen to anyone, and he'll have huge name recognition. As long as he's humble about it, "Yeah, I'm the guy who broke OpenSSL. Man, that sucked." I could see it being a big plus in interviews after a year or two.

by weavie 13y ago

Karunamon 13y ago

The armchair crypto brigade aren't helping much, either, by passing around these completely unfounded accusations of malfeasance. I'm all for being aware of the possibility that shenanigans are involved, but until proof comes out, it is nothing but a possibility, and a remote one at that.

kmkemp 13y ago
"Never attribute to malice that which is adequately explained by stupidity." Obviously "stupidity" is way too strong here, but the principle still applies.
- senorprogrammer 13y ago
  In this case I would replace "stupidity" with "assumption". It was code-reviewed so that level assumed correctness. It's in OpenSSL, which is written by experts, so the millions of us that use it every day assumed correctness. Our customers know little about the workings of the internet, so they assume correctness. This, incidentally, is the same sort of thinking that sometimes kills experts in dangerous situations: the assumption that someone smarter than us must by definition know more than us, so we can be lackadaisical. Witness Snow Fall (http://www.nytimes.com/projects/2012/snow-fall/?forceredirect=yes#/?part=tunnel-creek http://www.nytimes.com/projects/2012/snow-fall/?forceredirec...)
- anonbanker 13y ago
  The rest of the quote is "...but don't rule out malice."

rext 13y ago

I'd be amazed if he doesn't break from the pressure and/or abuse.

thefreeman 13y ago

Let the programmer who has never written a bug cast the first stone.

protomyth 13y ago

I'm actually more worried that this will result in a civil lawsuit from one of the affected companies. In an ideal world[1], it would get thrown out immediately, but I'm a bit worried. That would have a heck of a chilling affect. 1) and a simple reading of the license

danielweber 13y ago
Is it 'rayiner who tells us to always have the disclaimer for liability in our licenses? Whoever it is, this is why. I think any company that is damaged by this should get all their money back, all $0 of it.
- protomyth 13y ago
  My only worry is some nasty lawyer will figure out a way around the disclaimer. I am hoping not and that it has been well established, but the courts are often a bit insane.

_ak 13y ago

He works for T-Systems, which belongs to Deutsche Telekom. His job is pretty safe, I would say. People working for Deutsche Telekom work under conditions similar to German civil servants in terms of terminability.

mikeash 13y ago

I wouldn't be surprised if it was good for his career in the long run. Smart people will know that bugs like this can happen to anyone, and he'll have huge name recognition. As long as he's humble about it, "Yeah, I'm the guy who broke OpenSSL. Man, that sucked." I could see it being a big plus in interviews after a year or two.