2 ms·
That sounds like the same approach that everyone used with openSSL. The fact that code is open source is not a sane reason not to test it.
by lotsofmangos 12y ago
That sounds like the same approach that everyone used with openSSL. The fact that code is open source is not a sane reason not to test it.
- DCKing 12y agoI sympathize with the general sentiment, but it misses the point. Linux + ext kernel modules + e2fsprogs is tested daily by developers of many Linux distributions. There's really no problem with verifying that some module works. Furthermore, Google tests this system implicitly by haveing ChromeOS use ext4 as its root file system. So everyone is right to be confident it works correctly. However, testing whether or not something works is totally different from testing whether it is secure. Many people testing whether OpenSSL works correctly (which happens every single day) would not have shown Heartbleed at all.