4 ms·
That's a fine attitude for normal code, but crypto is a whole different ball game. Linux security was significantly reduced at one point because somebody change
by SoftwareMaven 12y ago
That's a fine attitude for normal code, but crypto is a whole different ball game. Linux security was significantly reduced at one point because somebody changed int i to int i=0, something most developers would thing is a positive. Side channel attacks are extremely easy to create and extremely hard to find. And, unfortunately, the "many eyes" thing doesn't work here because it requires experienced, knowledgable eyes, and there aren't enough of those, and they are usually busy getting paid, researching how to break software or building their own stuff.
- quasque 12y ago> Linux security was significantly reduced at one point because somebody changed int i to int i=0 Could you please elaborate on this one?
- nikbackm 12y agoSeems to me they relied on the uninitialized memory of a stack variable as a partial source of randomness for key generation. Initializing the variable with 0 removed that part.
- quasque 12y agoYour explanation makes sense. Though I'm still curious as to when this happened and what the impact was.
- SoftwareMaven 12y agoIt's been a while. I should have restricted it to Debian: http://jblevins.org/log/ssh-vulnkey http://jblevins.org/log/ssh-vulnkey