Trivial authentication bypass in libssh leaves servers wide open

Re:Trivial authentication bypass in libssh leaves servers wi... by heavenlyblue on Thursday October 18, 2018 @06:49AM (#18247277)

>> developers should be liable for the damage caused by their negligent code

To be fair, at this point I would rather see developers not writing code; rather than writing buggy one.

I had a friend on FB who's just completed a security course and wrote a password generator in Go. The random was seeded from a current date in nanoseconds. The issue is that while no one will probably ever reverse his passwords, but the guy open-sourced his script. How many people will be influenced by that piece of code?

Lawyers have that: if you can't be liable - you're not a lawyer. GTFO.

[ Parent | on HN ]

Re:Trivial authentication bypass in libssh leaves servers wi... by lrvick on Thursday October 18, 2018 @12:45PM (#18249861)

I found that same exact issue in Terraform Go code where it generates passwords for AWS IAM users: https://www.cvedetails.com/cve/CVE-2018-9057/

We need to find out who is teaching this stupidity and make them stop.

[ Parent | on HN ]