New Bug Found in Widely Used OpenSSL Encryption | Hacker News Reader

New Bug Found in Widely Used OpenSSL Encryption

bits.blogs.nytimes.com

49 pointsplg13 comments

But, in reality, OpenSSL had only one full-time developer and three “core” volunteer programmers in Europe, and operated on a budget of $2,000 in annual donations. This, despite the fact that OpenSSL is used to encrypt the majority of the world’s web servers and widely used by technology companies such as Amazon and Cisco.

There's an interesting statement from our times.

in the sense that it is utterly wrong, I suppose so...

in reality, openssl appears to be a $1mm+/year for-profit fips consulting business [1] that appears to not care much about security, letting serious security issues sit in their bug tracker for years on end

[1] http://www.youtube.com/watch?v=GnBbhXBDmwU#t=559

they only get paid for implementing fips-related security features, which is an important job. they would love to spend more time on core security and have already tooled up to.

they went into the consulting biz to pay for the maintenance of openssl, but it hasn't panned out well until recently.

it's petty to take something done with great dedication and provided for free, with freedom, and demonize them. where are YOUR commits?

I'm pretty sure the implication is that the big corporates don't care a hoot about open source, the ethics or the model - they'll just take it, the cheaper the better.

The principle and supposed ethic is to share and have some reciprocity - the reality is somewhat different. And we all suffer. Tragedy of the commons, I guess...

I'd like to see a campaign and a web page to encourage big companies to donate to open source projects, and to display their donations publicly.

> where are YOUR commits?

The 'it's open source, fix it yourself' concept breaks down significantly when you're dealing with other people's complex projects.

OpenSSL in particular is a convoluted and horrific codebase, due to a significant number of reasonably awful and insecure decisions, making submitting your own patches a nightmare. Consider yesterday's MITM flaw, where a patch to OpenSSL 1.0.1 provided the opportunity to exploit a bug that OpenSSL has had for over 15 years.

There's also the issue of many open-source projects won't accept patches from outside people, or for features they don't care to implement/support. In the case of OpenSSL, that might actually be a good policy, but it still makes the 'why don't you fix it yourself' argument a weak one.

Dr. Dobb's did a write-up on just this aspect [1], which seems under-discussed for all the discussions of Heartbleed.

[1] http://www.drdobbs.com/open-source/the-conflict-at-the-heart...

This means the security researchers are actually studying and trying to fix OpenSSL.

I think it's good news.

There are many applications/areas where finding and fixing bugs is 'good news'. Cryptography isn't one of them. Stakeholders really expect this stuff to work before relying on it, and I can't imagine anyone is happy about a 10-year old vulnerability.

I'm certainly interested in hearing further analysis on this.

crypto has never been perfect, and it will never be perfect. stakeholders should pay for their own code audits.

the number of people in the world who give a fuck if your stakeholders like free crypto software is exactly you plus the number of stakeholders. ;)

It's good news that researchers are finding them instead of black hats. The only bad part is that OpenSSL has many more implementation flaws than a serious crypto project should.

> It's good news that researchers are finding them instead of black hats.

Of course, black hats could have already known about these exploits for years..

The good news is so far, these haven't been crypto bugs, just protocol bugs.

Reply on news.ycombinator.com