OpenSSL 1.0.0 released
OpenSSL 1.0.0 released
Posted Mar 30, 2010 8:36 UTC (Tue) by mpr22 (subscriber, #60784)In reply to: OpenSSL 1.0.0 released by rsidd
Parent article: OpenSSL 1.0.0 released
Your argument fails for the simple reason that it clearly didn't keep that guy away. (I'm inclined to say that it also amounts to advocating security through obscurity.)
My recollection that guy did find something that could fairly be called a bug (something along the lines of an array being algorithmically transformed without first being initialized to a state of known quality) and fix it. Unfortunately, another piece of (entirely correct) code looked sufficiently like the buggy code that he thought it was broken in the same way and "fixed" it, resulting in the Debian keystrength fiasco.
The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:
Note: you can avoid this step in the future by logging into your LWN account.