News for hackers. Stuff that matters.

A comment on GnuTLS certificate verification vulnerability announced (CVE-2014-0092).

Re:GnuTLS certificate verification vulnerability announced (... by illumen on Tuesday March 04, 2014 @02:42AM (#7338998)
This is similar to the Apple SSL bug.

Good on them for looking for similar errors in their own code. Thanks Redhat, for the audit, and for making the internet safer!

This is a win for Free software (and OSS), since the history of the bug can be traced, and outside developers can audit it. We still don't know how the bug got in there with the Apple bug - since the repository is not open.

[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by stephenr on Tuesday March 04, 2014 @07:45AM (#7339831)
So Apple has an admittedly serious bug that is in the wild on iOS for ~17 months, and desktops for ~ 4 1/2 months, and everyone shits on Apple for it.

GNUTLS has a (using your words) "similar" bug in the wild for more than 13 YEARS, and its nothing but praise because "they audited the code"?

[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by lawnchair_larry on Tuesday March 04, 2014 @08:51AM (#7340112)
This is definitely a moment of shame, not praise. Good on RedHat for the audit, but a dark moment for GnuTLS. That was some dumb code in a very important place. Nobody reviewed that at all, clearly.
[ Parent | on HN ]