4 ms·

Bloomberg really puts its bias on display: > The Heartbleed flaw, introduced in early 2012 in a minor adjustment to the OpenSSL protocol, highlights one of the

Bloomberg really puts its bias on display: > The Heartbleed flaw, introduced in early 2012 in a minor adjustment to the OpenSSL protocol, highlights one of the failings of open source software development. And its discovery and resolution highlights one of the advantages of open-source software development.

pyronite 13y ago
> And its discovery and resolution highlights one of the advantages of open-source software development. I wouldn't say that its discovery (two years later) says anything good about open source development.
- deleted 13y ago
  [deleted]
  - tptacek 13y ago
    The same amount of time: it was apparently found with a fuzzer.
    - baddox 13y ago
      What about the relative ease and speed with which the bug was fixed? Fuzz testing could certainly find the bug in closed source software, but patching it is a different story, especially if the person or group that controls the source code is slow, uncooperative, or extinct.
      - tptacek 13y ago
        It was definitely easier to fix because it was open.
      - hackinthebochs 13y ago
        However, the software being open source aided those who may have rushed out to take advantage of still-vulnerable systems. It's a mixed bag both ways, lets not put blinders on for ideological reasons.
        nitrogen 13y ago
        Ideology is the most important reason to choose open source and free software -- the ability to inspect and learn from the code is paramount, regardless of whether the software is superior or inferior to some other closed product.
    - rurban 13y ago
      I'm not so sure about the fuzzer. We have several good symbolic fuzzers around by ourselves, like fuzzgrind, but not so many open symbolic bug finders, like BAP, MAYHEM, EXE, forensic, cmbc. It could also be that they just added symbolic annotations like with Frama-C (as done with portalssl) and found bugs thereby. openssl nor gnutls is not in the shape to add something like this by themselves. It's much easier to come up with workable exploits in decent time with symbolic input and the stp or z3 solver than with simple fuzzing.
    - hf 13y ago
      I didn't know about fuzzers before this whole imbroglio -- not denoted as such, at least. If you know `crashme` you already know one fuzzer, which "intended to test the robustness of Unix and Unix-like operating systems by executing random machine instructions." See https://en.wikipedia.org/wiki/Fuzz_testing https://en.wikipedia.org/wiki/Fuzz_testing As a good app-sec'er you seem to need to be deeply steeped in fuzzer lore. Matasano: "We'll have you write a fuzzer. Everyone here writes fuzzers." http://www.matasano.com/careers/ http://www.matasano.com/careers/ (I'm obviously not replying to tptacek, just highlighting a bit. ... And basking in the good glow, yes.)
- TallGuyShort 13y ago
  And I also wouldn't say that the existence of a bug was caused by the license that was used. It's not like me keeping all the code to myself would make me a better programmer.
  - deleted 13y ago
    [deleted]
    - drcube 13y ago
      >> Well, if you were keeping all the code to yourself you presumably wouldn't be accepting poorly reviewed patches from random people. How does this follow? You can just as easily hire "random people" to make mistakes as you can accept mistakes from people you don't pay. The problem is poorly reviewed code either way. Not the license.
      - deleted 13y ago
        [deleted]
- lafayette 13y ago
  I might be completely wrong but I don't see much difference between open source and closed source in this case. If I were biased I might say that it might have taken substantially longer to discover such a bug in closed source software but that seems to be as much sensible as saying that open source has less security bugs because more people look at the same code. In the end software is written by people and people make mistakes. I'm pretty sure there are a lot of software be it open or closed source that had absolutely terrible security bugs. Judging open source as a whole by looking at a single project sounds a little bit like overgeneralization. Also, they are obviously in need of help though, I hear a lot of complaints from people about the OpenSSL code.
taylorbuley 13y ago
This is a Washington-based reporter, meaning he's most likely more policy-oriented than technology-oriented (got his start chasing stories on the Hill, not in Silicon Valley). It doesn't excuse a misunderstanding of his subject matter, but an accusation of bias is likely an over-analysis.
jodrellblank 13y ago
One of the claimed advantages of open source is to produce higher quality, more secure software. "As a result, the open source model builds higher-quality, more secure, more easily integrated software. And it does it at a vastly accelerated pace, often at a lower cost." - http://www.redhat.com/about/whoisredhat/opensource.html http://www.redhat.com/about/whoisredhat/opensource.html for example. As an ideology, comparing this OpenSSL happening to the stated goals of strong proponents open source, it is a complete failure of that ideology. That it was then fixable is an advantage, but that's a separate thing. It doesn't offset the way a really common error in a change to a really common and important library sat unnoticed for two years ... until a private company paid security researcher found it. You could argue that the bug was found and fixed and the software is now more secure :: the system works, this is how it works. But this is not how open source proponents present it as working. NB. This doesn't mean closed source is better. People don't push closed source as an ideology in the same way at all. But do compare open source to the claims made by open source advocates, as well as comparing it to the ease of fixing and finding bugs in closed source software.
- the_af 13y ago
  This might seem like a nitpick, but I think you're confusing two distinct camps here: let's call them "Open Source" and "Free Software". Open Source advocates -- such as Eric S. Raymond -- believe that it is superior on technical grounds, the "many eyes make all bugs shallow" theory. They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software. In my opinion this is not always true, as Heartbleed shows (but then again who knows how many undisclosed vulnerabilities are there in existing proprietary software! At least now we know about Heartbleed!) Free Software advocates -- such as Richard Stallman and the FSF -- believe it's a matter of ideology. This has little to do with technical quality. They say "sure, if the software is better that's a plus, but freedom is a matter of principle to us". I'm not a zealot but I tend to side with the Free Software camp, and I don't see how the OpenSSL fiasco undermines their ideology. PS: I also take issue with the "paid security researcher" remark. Absolutely nothing in either Free or Open Source excludes paid personnel or private companies from the equation. Hobbyist programmers are not the only ones accepted. I don't understand why you see this as extraordinary.
SilasX 13y ago
In fairness, the "public good" nature of an Open Source security library does create an incentive problem that's well known in the literature, and is probably related in some way to the failure here. You might have seen the story about how it gets $2000 in donations a year, which is supposed to be enough to marshal the expertise to prevent this kind of thing. https://news.ycombinator.com/item?id=7575210 https://news.ycombinator.com/item?id=7575210

pyronite 13y ago

> And its discovery and resolution highlights one of the advantages of open-source software development. I wouldn't say that its discovery (two years later) says anything good about open source development.

deleted 13y ago
[deleted]
- tptacek 13y ago
  The same amount of time: it was apparently found with a fuzzer.
  - baddox 13y ago
    What about the relative ease and speed with which the bug was fixed? Fuzz testing could certainly find the bug in closed source software, but patching it is a different story, especially if the person or group that controls the source code is slow, uncooperative, or extinct.
    - tptacek 13y ago
      It was definitely easier to fix because it was open.
    - hackinthebochs 13y ago
      However, the software being open source aided those who may have rushed out to take advantage of still-vulnerable systems. It's a mixed bag both ways, lets not put blinders on for ideological reasons.
      - nitrogen 13y ago
        Ideology is the most important reason to choose open source and free software -- the ability to inspect and learn from the code is paramount, regardless of whether the software is superior or inferior to some other closed product.
  - rurban 13y ago
    I'm not so sure about the fuzzer. We have several good symbolic fuzzers around by ourselves, like fuzzgrind, but not so many open symbolic bug finders, like BAP, MAYHEM, EXE, forensic, cmbc. It could also be that they just added symbolic annotations like with Frama-C (as done with portalssl) and found bugs thereby. openssl nor gnutls is not in the shape to add something like this by themselves. It's much easier to come up with workable exploits in decent time with symbolic input and the stp or z3 solver than with simple fuzzing.
  - hf 13y ago
    I didn't know about fuzzers before this whole imbroglio -- not denoted as such, at least. If you know `crashme` you already know one fuzzer, which "intended to test the robustness of Unix and Unix-like operating systems by executing random machine instructions." See https://en.wikipedia.org/wiki/Fuzz_testing https://en.wikipedia.org/wiki/Fuzz_testing As a good app-sec'er you seem to need to be deeply steeped in fuzzer lore. Matasano: "We'll have you write a fuzzer. Everyone here writes fuzzers." http://www.matasano.com/careers/ http://www.matasano.com/careers/ (I'm obviously not replying to tptacek, just highlighting a bit. ... And basking in the good glow, yes.)
TallGuyShort 13y ago
And I also wouldn't say that the existence of a bug was caused by the license that was used. It's not like me keeping all the code to myself would make me a better programmer.
- deleted 13y ago
  [deleted]
  - drcube 13y ago
    >> Well, if you were keeping all the code to yourself you presumably wouldn't be accepting poorly reviewed patches from random people. How does this follow? You can just as easily hire "random people" to make mistakes as you can accept mistakes from people you don't pay. The problem is poorly reviewed code either way. Not the license.
    - deleted 13y ago
      [deleted]
lafayette 13y ago
I might be completely wrong but I don't see much difference between open source and closed source in this case. If I were biased I might say that it might have taken substantially longer to discover such a bug in closed source software but that seems to be as much sensible as saying that open source has less security bugs because more people look at the same code. In the end software is written by people and people make mistakes. I'm pretty sure there are a lot of software be it open or closed source that had absolutely terrible security bugs. Judging open source as a whole by looking at a single project sounds a little bit like overgeneralization. Also, they are obviously in need of help though, I hear a lot of complaints from people about the OpenSSL code.

taylorbuley 13y ago

This is a Washington-based reporter, meaning he's most likely more policy-oriented than technology-oriented (got his start chasing stories on the Hill, not in Silicon Valley). It doesn't excuse a misunderstanding of his subject matter, but an accusation of bias is likely an over-analysis.

jodrellblank 13y ago

One of the claimed advantages of open source is to produce higher quality, more secure software. "As a result, the open source model builds higher-quality, more secure, more easily integrated software. And it does it at a vastly accelerated pace, often at a lower cost." - http://www.redhat.com/about/whoisredhat/opensource.html http://www.redhat.com/about/whoisredhat/opensource.html for example. As an ideology, comparing this OpenSSL happening to the stated goals of strong proponents open source, it is a complete failure of that ideology. That it was then fixable is an advantage, but that's a separate thing. It doesn't offset the way a really common error in a change to a really common and important library sat unnoticed for two years ... until a private company paid security researcher found it. You could argue that the bug was found and fixed and the software is now more secure :: the system works, this is how it works. But this is not how open source proponents present it as working. NB. This doesn't mean closed source is better. People don't push closed source as an ideology in the same way at all. But do compare open source to the claims made by open source advocates, as well as comparing it to the ease of fixing and finding bugs in closed source software.

the_af 13y ago
This might seem like a nitpick, but I think you're confusing two distinct camps here: let's call them "Open Source" and "Free Software". Open Source advocates -- such as Eric S. Raymond -- believe that it is superior on technical grounds, the "many eyes make all bugs shallow" theory. They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software. In my opinion this is not always true, as Heartbleed shows (but then again who knows how many undisclosed vulnerabilities are there in existing proprietary software! At least now we know about Heartbleed!) Free Software advocates -- such as Richard Stallman and the FSF -- believe it's a matter of ideology. This has little to do with technical quality. They say "sure, if the software is better that's a plus, but freedom is a matter of principle to us". I'm not a zealot but I tend to side with the Free Software camp, and I don't see how the OpenSSL fiasco undermines their ideology. PS: I also take issue with the "paid security researcher" remark. Absolutely nothing in either Free or Open Source excludes paid personnel or private companies from the equation. Hobbyist programmers are not the only ones accepted. I don't understand why you see this as extraordinary.

SilasX 13y ago

In fairness, the "public good" nature of an Open Source security library does create an incentive problem that's well known in the literature, and is probably related in some way to the failure here. You might have seen the story about how it gets $2000 in donations a year, which is supposed to be enough to marshal the expertise to prevent this kind of thing. https://news.ycombinator.com/item?id=7575210 https://news.ycombinator.com/item?id=7575210