3 ms·
I would like to know how many security related patches they are keeping for themselves? And I think not only Akamai did this. I hope that this situation will pr
by sobkas 13y ago
I would like to know how many security related patches they are keeping for themselves? And I think not only Akamai did this. I hope that this situation will prove that security needs a bit more patch reviews and a bit less of secret sauce.
- sweettea 13y agoI suspect their patches are oriented toward paranoia. Their particular patch (keeping what they believed to be all critical values in a special region of memory used only for critical things) had no obvious necessity -- it didn't obviously provide more security -- but was just paranoia. Paranoia isn't always necessary, or even desirable; hence, the remainder of the patches have no obvious external utility, so they presumably haven't released them. <p> They may also have performance improvements, conceivably, and those have a more obvious rationale for keeping secret.
- kevinr 13y agoAs Andy tweeted, we built that particular patch to keep unencrypted secrets off disk -- it actually was intended to provide tangible security benefit, it wasn't just paranoia: https://twitter.com/csoandy/status/455307255895060480 https://twitter.com/csoandy/status/455307255895060480
- Serow225 13y agoIf you folks have used this technique for years as I believe it has been stated, any particular reason why it wasn't contributed back to OpenSSL earlier?