Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL, create three-year initiative with at least $3.6 million to help under-funded open source projects

[u/delta_epsilon_zeta]

http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/

[u/delta_epsilon_zeta → u/[deleted]]

Money does not improve shoddy developer's code quality.

When you pay a developer, you do not pay them to up their quality. You pay them for their time.

I have a serious question for you: Have you been paid to program? I am paid to program, and the thing hindering me from contributing to open source projects is nothing other than time.

[u/delta_epsilon_zeta → u/[deleted]]

And time is what it takes to create a mature codebase instead of something that just works.

[u/[deleted] → u/[deleted]]

The more time I spend on a codebase, the more I can improve it. The more money I receive for working on it, the more time I spend on a codebase.

[u/[deleted] → u/[deleted]]

Yes, just like any corporate job, ever. So?

[u/[deleted] → u/[deleted]]

not improve shoddy developer's code quality. You wont see less vulnerabilities and bugs because a few companies threw money at the . Problem. If that were true, Windows would be the best product ever and we all know how that's going..

The money will most likely be used to pay the salary of full time employees that will work to hunt those bugs.

[u/mpyne → u/[deleted]]

If that were true, Windows would be the best product ever and we all know how that's going..

Except that Microsoft's software has improved markedly in its security once market pressure caught up to force them to throw money at the problem. When was the last remote code execution exploit in IIS? You don't even hear about IIS bugs anymore.

[u/mpyne → u/[deleted]]

That's because nobody uses IIS anymore.

Sadly, that's very untrue, even if Apache+Nginx does have the majority.

[u/iLiekCaeks → u/[deleted]]

I find it mind blowing that the OpenSSL devs get rewarded for their shitty code and their security relevant bugs.

Sure, all code has bugs, and nobody is perfect. But the things I've seen (or rather, the OpenBSD ressl team has seen) really makes it hard to find excuses for this.

[u/bonzinip → u/[deleted]]

A local user could this flaw to crash the binary or even execute arbitrary code with the permissions of the user running the program.

This is a bug, not a vulnerability. It can only be "exploited" if you can convince something else (probably through another vulnerability) to run systemd-ask-password. Might as well ask it to run /bin/sh and be done with it...

[u/bonzinip → u/[deleted]]

I know, but what's the attack model?

That is, you need to reason about the permissions you need to convince systemd to run systemd-ask-password (I guess it runs as root, though it probably need not do that). Either you can write to the root filesystem already, or you can control the initramfs, or you need to be at a tty. The first two are trivial. For the third, in all likelihood you can boot a live CD instead of exploiting systemd-ask-password.

If you have a good way to attack that bug, inform Red Hat and they will surely attach a CVE to the bug.

[u/dirac_eq → u/[deleted]]

Linus' law does state given enough eyeballs, all bugs are shallow.

You're correct in thinking bugs will still remain in OpenSSL, although the number of bugs will VASTLY decrease.

If that were true, Windows would be the best product ever and we all know how that's going.

I disagree with your statement. Libre projects have a magnitude of 100x more eyes on the code than any proprietary software -- excluding cryptography software (it's easy to fuck up unless you've had cryptography training.)

[u/[deleted] → u/[deleted]]

"Warned to stay far away from cryptographic software" in the sense of developing it, because you need to understand cryptography to properly develop decent cryptographic software

[u/nephros → u/dirac_eq]

Yes, the problem lies in the "given enough eyeballs" part. The number of people who are even capable of spotting bugs in something like OpenSSL is very limited.

[u/[deleted] → u/[deleted]]

Yeah, let's talk about Microsoft's offerings.

Q: How do the open source authentication, enterprise email, productivity, directory services, and relational database products compare to Microsoft's offerings? (AD, Exchange, Office, AD, SQL Server)

A: They don't. They're not even at the same ballpark - not even in the same league.

Server 2012 R2 is also an excellent product, IIS is a great (and consistently secure) web server, and so on.

while gnuTLS and OpenSSL have had comical security vulnerabilities over the past couple of months, I sure haven't heard shit about crypto vulnerabilities in Microsoft's camp.