Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch
by UnoriginalGuy on Sunday April 13, 2014 @08:40PM
(#7583881)
> Akamai strongly implied that their patch protected customers.
Actually they said exactly the opposite of that:
> This should really be considered more of a proof of concept than something that you want to put directly into production. Let me restate that: do not just take this patch and put it into production without careful review.
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch
by ibmthrowaway218 on Monday April 14, 2014 @04:40AM
(#7585111)
I think polemic was referencing this statement[1] when he talks about "their patch" (and not the released patch):-
> This patch is a variant of what we've been using to help protect customer keys for a decade.
1. From the original Akamai missive: http://article.gmane.org/gmane.comp.encryption.openssl.user/...
Oh so what. Tone arguments are the least interesting arguments (he says, passive aggressively). In seriousness though, this is a blunt assessment from an expert in the field. The tone is entirely appropriate.
> No good deed goes unpunished.
Akamai strongly implied that their patch protected customers. If you make that claim then you need to be prepared to have the claim attacked. This is an issue of good will toward their customers - not to the Open Source community.
This isn't a case of "punishing a good deed", it's a case of "critically examining a provider's claim to their customers".