Security quotes of the week

All of those concerns--if borne out--fall short of security theater. OpenSSL probably still has buffer overflows, like most other complex crypto stacks, lurking somewhere. Granted, that's different than the timing attacks, which arguably could be considered design flaws in the algorithm. But none of those mean that they're unusable, they're just far from perfect.

On the other hand, the process of checking people's shoes at the airport isn't merely suboptimal. It's not like we're doing it wrong. It's that we have no evidence its worthwhile at all, and it may even be counterproductive. It's a stretch to argue that ripping out AES and similar algorithms would improve the state of network security.