News for hackers. Stuff that matters.

A comment on Millions of accounts compromised because there is no specialised user database.

Re:Millions of accounts compromised because there is no spec... by teen on Tuesday April 21, 2015 @09:53PM (#9418262)
"What developers need is a minimal, single purpose database specifically designed for protecting user information and designed to move user data access away from the rest of the application data to minimise the impact of access by hackers." - Yea this sort of homogenization of security worked great for OpenSSL
[ Parent | on HN ]
Re:Millions of accounts compromised because there is no spec... by andrewstuart2 on Tuesday April 21, 2015 @10:03PM (#9418292)
I'd argue that it worked exactly as expected. The bug was found, fixed, and patches released immediately. For most people that was just a package-manager update away.

If anybody imagined that openssl had no bugs, they've obviously been proven wrong several times already, and I'm sure they will be proven wrong again.

The point of a single library (or few libraries) is (at least) twofold. It's much less likely to have defects, and when those defects that remain are found, answering the "does this affect me" question is easier and prompts quick action.

[ Parent | on HN ]