5 ms·

>It is nicer to find bugs by reading the source code instead of logging into your account and finding all your data gone. And yet, having the source open did n

>It is nicer to find bugs by reading the source code instead of logging into your account and finding all your data gone. And yet, having the source open did nothing to prevent the Debian SSL-cert bug from happening. Perhaps it got patched faster because the source was open, but the bug was in there for quite some time before it got caught.

jrockway 17y ago
There is a difference in detectability of "all my files get erased" and "a number isn't random enough". The second one is easily missed by a lot of people. If Windows or OS X has a similar bug, my guess is that it will never be found.
- Nwallins 17y ago
  ... outside of black hat circles.
- tedunangst 17y ago
  There's also a subtle point that lots of people have looked at OpenSSL and trusted it, but not everyone knew that Debian-SSL was just a little different. Lots of people have looked at the Windows number generator (or its results) to see if it's wrong. Lots of people have looked at OpenSSL too. But the place they are likely to look is the official releases, not the distro forks. Being open source allows many small variations to exist. It's not enough to know you're using open source and that a million eyeballs have looked at it. Have the million eyeballs actually looked at the exact source you are running?