4 ms·

There are different degrees of failure. Expecting someone to work for free for you(you as in all the big and small companies making a ton of money) while not in

There are different degrees of failure. Expecting someone to work for free for you(you as in all the big and small companies making a ton of money) while not inspecting the code for bugs is one of them. Blaming the resource constrained developers accomplishes nothing.

kbenson 12y ago
I think that just points to failure on both parts. Users of OpenSSL failed to correctly vet the codebase, and OpenSSL developers (according to numerous reports I've seen) failed to build a secure and clean (in this case, I think those are related) codebase. This happens occasionally, a product is the leader in it's market because it was the only game in town, but eventually it's replaced as something beats it in one or more of the categories of features, speed, reliability, or freedom. See ssh.com vs OpenSSH. The truth of the matter is, many people have concerns about the security of OpenSSL (and IMHO, rightly so), and no matter how bad we feel for the developers, this is not a case where we should trust in our loyalty. This is our personal security, the security of the businesses we work for, and the customers that use them. I can't in good faith use anything but what I consider the best choice, given whatever constraints I already face.
leccine 12y ago
I never asked any OpenSSL guys to work for free for me. Btw. I am contributing to FOSS projects before you are accusing me that I never done anything to the community. I totally understand the responsibilities of open source developers. Having software that supposed to provide security is a huge responsibility and in those projects following best practices (not re-implementing malloc badly, etc.) is insanely important. Just because it is free it does not mean that you can throw out everything we know about software engineering, and it does not justify broken software. There is a tendency in the software community that if it is free it can be crap and nobody can complain about it. This is bad attitude. If you can't write great software just please don't do it and try to hide behind the open source flag.
- lttlrck 12y ago
  Where did he accuse you?
  - leccine 12y ago
    "before you are accusing" English is hard man, I know.

kbenson 12y ago

I think that just points to failure on both parts. Users of OpenSSL failed to correctly vet the codebase, and OpenSSL developers (according to numerous reports I've seen) failed to build a secure and clean (in this case, I think those are related) codebase. This happens occasionally, a product is the leader in it's market because it was the only game in town, but eventually it's replaced as something beats it in one or more of the categories of features, speed, reliability, or freedom. See ssh.com vs OpenSSH. The truth of the matter is, many people have concerns about the security of OpenSSL (and IMHO, rightly so), and no matter how bad we feel for the developers, this is not a case where we should trust in our loyalty. This is our personal security, the security of the businesses we work for, and the customers that use them. I can't in good faith use anything but what I consider the best choice, given whatever constraints I already face.

leccine 12y ago

I never asked any OpenSSL guys to work for free for me. Btw. I am contributing to FOSS projects before you are accusing me that I never done anything to the community. I totally understand the responsibilities of open source developers. Having software that supposed to provide security is a huge responsibility and in those projects following best practices (not re-implementing malloc badly, etc.) is insanely important. Just because it is free it does not mean that you can throw out everything we know about software engineering, and it does not justify broken software. There is a tendency in the software community that if it is free it can be crap and nobody can complain about it. This is bad attitude. If you can't write great software just please don't do it and try to hide behind the open source flag.

lttlrck 12y ago
Where did he accuse you?
- leccine 12y ago
  "before you are accusing" English is hard man, I know.