3 ms·
Aye. Especially given how the patch was pretty much just as exploitable, and the patched patch looked just moderately so. Were this more than a press release, i
by Sanddancer 12y ago
Aye. Especially given how the patch was pretty much just as exploitable, and the patched patch looked just moderately so. Were this more than a press release, it would be discussing a plan of action as to any sort of auditing plan to make sure bugs like this in the future are discovered /before/ they start causing trouble.
OpenBSD has shown that small organizations can audit and maintain code with a focus on security and correctness. Why hasn't the FSF, with its greater level of resources, managed to do the same?
- jiggy2011 12y agoThe FSF does not maintain the software, it is a purely political organisation. The GNU project is responsible for bash.
- Sanddancer 12y agoThe FSF owns the copyrights, controls the licensing, etc. They are they corporation that owns the software under the GNU banner.
- jiggy2011 12y agoDoes copyright really mean much if all the software is GNU? Do they both share the same source of funding? How much is spent on political activities (that openbsd does not engage in)?
- ultramancool 12y ago> OpenBSD has shown that small organizations can audit and maintain code with a focus on security and correctness, why hasn't the FSF, with its greater level of resources, managed to do the same? It's simply a matter of different goals. The OpenBSD project has security as a primary goal. They often throw out features, flexibility or portability on the grounds of preserving security. GNU instead prioritizes those features, flexibility and portability, occasionally losing out on security. Security is hard and involves a lot of sacrifice with little evidence of success aside from "oh look, we haven't had any vulnerabilities for a while".