3 ms·

Now would be the time to start looking up the backgrounds of the people who implemented heartbeat support. For instance, the same guy responsible for the Heartb

Now would be the time to start looking up the backgrounds of the people who implemented heartbeat support. For instance, the same guy responsible for the Heartbeat spec was the author of the OpenSSL implementation. While we do not want to make this into a witch hunt, now that the NSA is involved in Heartbleed, we should definitely rule out malice by checking for direct ties between contributors of known flawed/malicious code related to the implementation of Heartbeat.

dangero 13y ago
100% agree. Here's a related question: How many people do you think the NSA employs to work on open source software and blend into the community, establish credibility, etc. Is the answer zero people? Given what we know about the NSA now, zero seems unlikely.
malandrew 13y ago
We absolutely do not want this. We rely on the goodwill of a lot of really smart people to produce the open source security software we rely. Even if the person who introduced this bug did in fact conspire with the NSA, we would do far more damage by going on a witch hunt. The majority of people working on this software are well-intentioned and if contributing to open source means that they risk being subject to a witch hunt for their contributions they will be far less likely to partake. The only reasonable course of action is to apply oversight of the NSA. If people in open-source are moles, the only reasonable way to discover this is via oversight of the agency. If there are moles, there are records within the agency showing this to be the case. Getting ahold of those records is how you prove this and you get those records by getting congress to do their job and provide oversight.
- anonbanker 13y ago
  Sounds like an great plan. Perhaps you could provide an example from history where your idea works? I'm having difficulty finding one.

dangero 13y ago

100% agree. Here's a related question: How many people do you think the NSA employs to work on open source software and blend into the community, establish credibility, etc. Is the answer zero people? Given what we know about the NSA now, zero seems unlikely.

malandrew 13y ago

We absolutely do not want this. We rely on the goodwill of a lot of really smart people to produce the open source security software we rely. Even if the person who introduced this bug did in fact conspire with the NSA, we would do far more damage by going on a witch hunt. The majority of people working on this software are well-intentioned and if contributing to open source means that they risk being subject to a witch hunt for their contributions they will be far less likely to partake. The only reasonable course of action is to apply oversight of the NSA. If people in open-source are moles, the only reasonable way to discover this is via oversight of the agency. If there are moles, there are records within the agency showing this to be the case. Getting ahold of those records is how you prove this and you get those records by getting congress to do their job and provide oversight.

anonbanker 13y ago
Sounds like an great plan. Perhaps you could provide an example from history where your idea works? I'm having difficulty finding one.