4 ms·

Heartbleed Bug's 'Voluntary' Origins

20 points by T-A 13y ago

logn 13y ago
>Last decade, Steve Marquess, a former U.S. Defense Department consultant living in Maryland, started the OpenSSL Software Foundation to secure donations and consulting contracts for the group. That's kind of like a former Christian preacher living in Alabama raising money for Planned Parenthood.
- acqq 13y ago
  Amusingly, NSA Headquarters address is Fort Meade, Maryland.
- dTal 13y ago
  >That's kind of like a former Christian preacher living in Alabama raising money for Planned Parenthood. Courageous and admirable, you mean?
simonster 13y ago
The article seems to suggest that there is something unreasonable about Stephen Henson's "Before you email me..." page on his website, which is here: http://www.drh-consultancy.demon.co.uk/contact.html http://www.drh-consultancy.demon.co.uk/contact.html It turns out that the way that he "compares his responsibilities to those of Bill Gates when he managed Microsoft" is by stating: The occasional person sends this query to both mailing lists (in almost all cases only one mailing list is appropriate) and when they do not get an immediate response email the entire core and development team. Presumably this is the same kind of person that emails Bill Gates whenever they have a Windows problem. Emailing open source developers who you do not know at their personal email addresses is rarely appropriate when a public mailing list for the project exists. The tone is a little prickly but what Henson says seems reasonable to me.
lifeisstillgood 13y ago
I struggle to work out the tone here : it varies from "My god we are all dependant on half a dozen volunteers" to "why doesn't someone pay these guys?" to "what a bunch of fools - we cannot all use the same code"
- stcredzero 13y ago
  All using the same code would've been smart -- if everyone who depended on that code had been actively aware and contributing to their own rational self interest. Like so many others, I just took it for granted and assumed the OpenSSL guys knew what they were doing. Putting all your eggs in one basket isn't necessarily foolish, if it's some kind of armored, padded, exquisitely engineered basket. It is, if it's a rickety volunteer-made basket.
  - michaelt 13y ago
    Like so many others, I just took it for granted and assumed the OpenSSL guys knew what they were doing. While the mantra "don't work on your own security code, you'll get it wrong, use a library instead" is generally good advice for programmers, I imagine it makes it harder for the libraries to recruit contributors.
PhantomGremlin 13y ago
I hate articles like this. They're so one sided. Here's a money quote: "Errors in complex code are inevitable". Even the headline sets the same tone and calls the flaw a "fluke". Oops, this programming stuff is hard, be thankful that it "works" at all. Bullshit. There's something that was left unsaid in the article, specifically "best practices". Why wasn't the length validated at all? There's nothing new or "complex" about simple defensive programming. How can anyone (even a part timer) working on software that's so security critical be so clueless? Forget about more obscure stuff like the full disclosure mailing list, just reading CERT alerts should make this abundantly clear to anyone in security. Hell, the xkcd cartoon [1] makes it abundantly clear. If you can't take that cartoon to heart, you have no business writing Internet facing software. I think Marco Peereboom got it right oh so many years ago when he said that OpenSSL was written by monkeys. [2] However, the article does get something right. It's insane that something so critical to internet commerce is essentially a hobby project by a few people mostly in their spare time. That's not simply crazy, that's totally fucking insane. That's the biggest takeaway of this entire fiasco. [1] http://xkcd.com/327/ http://xkcd.com/327/ [2] https://news.ycombinator.com/item?id=7556407 https://news.ycombinator.com/item?id=7556407
- stcredzero 13y ago
  Bullshit. There's something that was left unsaid in the article, specifically "best practices". If the NTSB used the "best practices" mantra like the software industry did, then there would be no stick shakers, ground proximity warnings, and collision avoidance systems. Thousands more would be dead without such automation. It's amazing that the software industry so often responds to such problems by saying we programmers should do one more thing, and do it consistently without fail. (Then no concrete steps are taken.) Aren't programs better suited to such tasks? We should be using languages or libraries that are memory-safe and give us automatic means of avoiding timing attacks. When we in the software industry fix widespread safety issues, our answer shouldn't be, "we should've done X, those people are to blame for not doing X, let's all just do it from here on out." If we were fire marshals, there would be no mandatory fire alarms, emergency exits, and occupancy regulations. Instead we'd "tsk tsk" and talk about how those poor victims were "doing it wrong." If governments were exploiting this bug, they were doing the opposite of what they should've been doing: fixing it once and for all. I've read several users comment that an Ada implementation of TLS would avoid the same class of errors entirely.

20 points by T-A 13y ago

logn 13y ago

>Last decade, Steve Marquess, a former U.S. Defense Department consultant living in Maryland, started the OpenSSL Software Foundation to secure donations and consulting contracts for the group. That's kind of like a former Christian preacher living in Alabama raising money for Planned Parenthood.

acqq 13y ago
Amusingly, NSA Headquarters address is Fort Meade, Maryland.
dTal 13y ago
>That's kind of like a former Christian preacher living in Alabama raising money for Planned Parenthood. Courageous and admirable, you mean?

simonster 13y ago

The article seems to suggest that there is something unreasonable about Stephen Henson's "Before you email me..." page on his website, which is here: http://www.drh-consultancy.demon.co.uk/contact.html http://www.drh-consultancy.demon.co.uk/contact.html It turns out that the way that he "compares his responsibilities to those of Bill Gates when he managed Microsoft" is by stating: The occasional person sends this query to both mailing lists (in almost all cases only one mailing list is appropriate) and when they do not get an immediate response email the entire core and development team. Presumably this is the same kind of person that emails Bill Gates whenever they have a Windows problem. Emailing open source developers who you do not know at their personal email addresses is rarely appropriate when a public mailing list for the project exists. The tone is a little prickly but what Henson says seems reasonable to me.

lifeisstillgood 13y ago

I struggle to work out the tone here : it varies from "My god we are all dependant on half a dozen volunteers" to "why doesn't someone pay these guys?" to "what a bunch of fools - we cannot all use the same code"

stcredzero 13y ago
All using the same code would've been smart -- if everyone who depended on that code had been actively aware and contributing to their own rational self interest. Like so many others, I just took it for granted and assumed the OpenSSL guys knew what they were doing. Putting all your eggs in one basket isn't necessarily foolish, if it's some kind of armored, padded, exquisitely engineered basket. It is, if it's a rickety volunteer-made basket.
- michaelt 13y ago
  Like so many others, I just took it for granted and assumed the OpenSSL guys knew what they were doing. While the mantra "don't work on your own security code, you'll get it wrong, use a library instead" is generally good advice for programmers, I imagine it makes it harder for the libraries to recruit contributors.

PhantomGremlin 13y ago

I hate articles like this. They're so one sided. Here's a money quote: "Errors in complex code are inevitable". Even the headline sets the same tone and calls the flaw a "fluke". Oops, this programming stuff is hard, be thankful that it "works" at all. Bullshit. There's something that was left unsaid in the article, specifically "best practices". Why wasn't the length validated at all? There's nothing new or "complex" about simple defensive programming. How can anyone (even a part timer) working on software that's so security critical be so clueless? Forget about more obscure stuff like the full disclosure mailing list, just reading CERT alerts should make this abundantly clear to anyone in security. Hell, the xkcd cartoon [1] makes it abundantly clear. If you can't take that cartoon to heart, you have no business writing Internet facing software. I think Marco Peereboom got it right oh so many years ago when he said that OpenSSL was written by monkeys. [2] However, the article does get something right. It's insane that something so critical to internet commerce is essentially a hobby project by a few people mostly in their spare time. That's not simply crazy, that's totally fucking insane. That's the biggest takeaway of this entire fiasco. [1] http://xkcd.com/327/ http://xkcd.com/327/ [2] https://news.ycombinator.com/item?id=7556407 https://news.ycombinator.com/item?id=7556407

stcredzero 13y ago
Bullshit. There's something that was left unsaid in the article, specifically "best practices". If the NTSB used the "best practices" mantra like the software industry did, then there would be no stick shakers, ground proximity warnings, and collision avoidance systems. Thousands more would be dead without such automation. It's amazing that the software industry so often responds to such problems by saying we programmers should do one more thing, and do it consistently without fail. (Then no concrete steps are taken.) Aren't programs better suited to such tasks? We should be using languages or libraries that are memory-safe and give us automatic means of avoiding timing attacks. When we in the software industry fix widespread safety issues, our answer shouldn't be, "we should've done X, those people are to blame for not doing X, let's all just do it from here on out." If we were fire marshals, there would be no mandatory fire alarms, emergency exits, and occupancy regulations. Instead we'd "tsk tsk" and talk about how those poor victims were "doing it wrong." If governments were exploiting this bug, they were doing the opposite of what they should've been doing: fixing it once and for all. I've read several users comment that an Ada implementation of TLS would avoid the same class of errors entirely.