The first one was a genuine bug, the second a malicions backdoor. The only common thing is they are both open source projects. I agree with having more oversight and funding on critical open source software, but suggesting that these two vulnerabilities are the same in some way is a bit of a stretch.
this post was submitted on 07 Apr 2024
91 points (76.9% liked)
Technology
58303 readers
11 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
This entire post is asinine. The root cause of Heartbleed was the RFC was fucked. A German graduate student wrote and implemented an RFC, and was then reviewed by the only full time (and paid) member of the OpenSSL team. Claiming it was because it wasn’t funded is stupid on its face as Dr. Henson was paid for his review.
XZ’s problem was that the maintainer had a mental breakdown and lacking structure to vet the replacement, he handed control off to what seems like a very sophisticated attack group. Money would not have fixed one of the fundamental problems with anarchistic-style code production, which is how do you trust the people who vet the code?
So am I understanding correctly that this code wasn’t exactly handled as a normal team? Like XZ had one person vetting the replacement?
Isn't that why boringSSL was created? I wonder if we'll see corpo forks of openSSH soon