Hacker News Reader

I'm really dismayed that the Core Infrastructure Initiative, which was created in the aftermath of Heartbleed to fund OpenSSL and other critical software, has chosen to prioritize NTP, and not GnuPG[1]. Most of the companies that rely on OpenSSL are probably using a distro that uses GPG to securely distribute the OpenSSL package.

[1] http://www.linuxfoundation.org/programs/core-infrastructure-...

View on HN

NTP is important as well. If I remember correctly, that decision was made around the time that NTPD was found to have multiple exploits allowing amplification attacks. Given that there are so many publicly available NTP servers, that makes it a pretty important project.

The fact is that all of these projects need better funding. Frankly it surprises me that large multinational corporations that care about security don't just fund these people. The downside risk for them is terrible.

Visibility, those who scream loudest win, people were screaming about NTP (long before heartbleed as it happens).

Reply on news.ycombinator.com