3 ms·
It is not clear how the bug was discovered. If it was because someone was reading the source code, it still took a long time for someone to read that part of th
by jordigh 12y ago
It is not clear how the bug was discovered. If it was because someone was reading the source code, it still took a long time for someone to read that part of the source code, so I don't think someone was backlogged with code reviews by two years.
I think it is far more likely that someone first realised they were getting extra data and then went to read the source code to see why this was happening. I think it's safe to speculate that most bugs are discovered by inspecting the behaviour of the software, not by reading the source code.
Of course, once the bug is found, having the source code makes it much easier to patch it, but it's amazing what people can do to patch bugs even without source code.
- icebraining 12y agoI think it's perfectly clear. In the end of January, Google releases a design draft detailing how they are switching Chrome from NSS to OpenSSL[1]. Two months later, some Google employees announce they have found a major bug. I don't have any inside knowledge, but I think the causality chain is obvious - they did a security review of the code as part of the switch and found it. [1] https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53pQgNR-DppMYwt9XvE6s/edit?pli=1#heading=h.mi4wjwv8kmze https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53...