5 ms·

There are many applications/areas where finding and fixing bugs is 'good news'. Cryptography isn't one of them. Stakeholders really expect this stuff to work

There are many applications/areas where finding and fixing bugs is 'good news'. Cryptography isn't one of them. Stakeholders really expect this stuff to work before relying on it, and I can't imagine anyone is happy about a 10-year old vulnerability. I'm certainly interested in hearing further analysis on this.

justizin 12y ago
crypto has never been perfect, and it will never be perfect. stakeholders should pay for their own code audits. the number of people in the world who give a fuck if your stakeholders like free crypto software is exactly you plus the number of stakeholders. ;)
meowface 12y ago
It's good news that researchers are finding them instead of black hats. The only bad part is that OpenSSL has many more implementation flaws than a serious crypto project should.
- mikeyouse 12y ago
  > It's good news that researchers are finding them instead of black hats. Of course, black hats could have already known about these exploits for years..
toast0 12y ago
The good news is so far, these haven't been crypto bugs, just protocol bugs.