Hacker News Reader

Exactly. Their explanation for requesting the permission looks reasonable, and the source code confirms that they aren't using it for anything else. Wikimedia did nothing wrong here, and OP is getting worked up over nothing. If he wants better assurances, he should use a better phone.

OpenSSL was open sourced. That worked out real well.

It's not being open sourced that leads to secure, well-behaved software.

It's being well-behaved, secure software. Which, among other properties, means following the principles of least privilege and least capability. See the OpenBSD project for more on that philosophy.

This isn't C we're talking about. You don't magically expose random memory with Java code.

Tool choice may improve security. See again OpenBSD, which has specifically rewritten parts of the C library to avoid classes of bugs.

That said, Java has a markedly less-than-perfect record.

As someone else mentioned, open source is not a golden bullet. But, it being open source led tot he discovery of the bug and the fix, right?

And, in related news, Pwncloud:

https://blog.hboeck.de/archives/880-Pwncloud-bad-crypto-in-t...