<div dir="ltr"><div>Testing "programs like OpenSSL as if no source were available" is a good idea. But it's a weird question to ask, because if OpenSSL wasn't open source, it probably wouldn't be as widely used as it is, and therefore the impact of the bug would be far less.</div>
<div><br></div><div>Also, it's a weirdly tone-deaf article given the recent Apple goto-fail. Everyone is in a glass house, software is hard!</div><div><br></div><div>cheers,</div><div>Brianna</div><div><br></div></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On 14 April 2014 22:37, Kathy Reid <span dir="ltr"><<a href="mailto:kathy@kathyreid.id.au" target="_blank">kathy@kathyreid.id.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi everyone,<br>
<br>
There's a post on ZDnet that posits that OpenSSL benefitted little from<br>
being open source;<br>
<a href="http://www.zdnet.com/did-open-source-matter-for-heartbleed-7000028378/" target="_blank">http://www.zdnet.com/did-open-source-matter-for-heartbleed-7000028378/</a><br>
I strongly disagree with a lot of the points in the article, but am<br>
interested in the thoughts of others.<br>
<br>
* If OpenSSL wasn't open source, the vulnerability may never have been found<br>
* The CVE was dealt with transparently and openly<br>
* The patch was freely available when the CVE was made public<br>
* The specific code vulnerability, now patched, will make other C codes<br>
more secure as people learn from the error<br>
<br>
--<br>
--<br>
<br>
Kathy Reid<br>
<a href="mailto:kathy@kathyreid.id.au">kathy@kathyreid.id.au</a><br>
<a href="tel:0418%20130%20636" value="+61418130636">0418 130 636</a><br>
@kathyreid<br>
<br>
<br>
_______________________________________________<br>
linux-aus mailing list<br>
<a href="mailto:linux-aus@lists.linux.org.au">linux-aus@lists.linux.org.au</a><br>
<a href="http://lists.linux.org.au/listinfo/linux-aus" target="_blank">http://lists.linux.org.au/listinfo/linux-aus</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>They've just been waiting in a mountain for the right moment: <a href="http://modernthings.org/">http://modernthings.org/</a>
</div>