News for hackers. Stuff that matters.

A comment on "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable". Parent comment

Re:"OpenSSL has exploit mitigation countermeasures to make s... by nosefrog on Wednesday April 09, 2014 @10:11AM (#7559360)
Yes, and that's how this bug was found.
[ Parent | on HN ]
Re:"OpenSSL has exploit mitigation countermeasures to make s... by awj on Wednesday April 09, 2014 @12:26PM (#7560329)
So "many eyes" means "paid researches at Google and a security firm"?

Also, this bug was in place for what, two years? If the many eyes hypothesis has a two year lead time to find bugs this severe, we can stop talking about it because it's fucking worthless.

[ Parent | on HN ]
Re:"OpenSSL has exploit mitigation countermeasures to make s... by charonn0 on Wednesday April 09, 2014 @01:21PM (#7560731)
> two years

If that's how we're measuring things, then closed source isn't going to win either, e.g. [1].

[1]: http://www.computerworld.com/s/article/9146820/Microsoft_con...

[ Parent | on HN ]
Re:"OpenSSL has exploit mitigation countermeasures to make s... by mannykannot on Wednesday April 09, 2014 @08:38PM (#7563520)
A false dichotomy. Writing reliable, complex-in-function software is hard for everyone.
[ Parent | on HN ]