'Heartbleed' contributor denies he inserted it deliberately
1–10 of 86 posts
Re: 'Heartbleed' contributor denies he inserted it deliberately
#2Yeah most of my bugs are deliberate. I like the feeling of making mistakes and seeing my boss run out of his office frantic.
Re: 'Heartbleed' contributor denies he inserted it deliberately
#3I believe it. Crafting a weapon that can be used by both you and your enemies would be pyrrhic.
The lesson out of this ordeal is probably to be as skeptical as possible of everything you take for granted. How do you know that you're secure? What if your assumptions are wrong? Try to invent ways to break your own assumptions. The best way to protect yourself is to try to defeat yourself.
Unfortunately, "ain't nobody got time for that," as they say. But if you find time, it's quite rewarding. And disconcerting. You'll wonder why we're still wrestling with these fundamental problems in 2014, and then you'll start questioning the foundations we've been relying on until now.
Re: 'Heartbleed' contributor denies he inserted it deliberately
#4Yeah most of my bugs are deliberate. I like the feeling of making mistakes and seeing my boss run out of his office frantic.
Just wait till you have been told - it is running too fast so the client won't perceive it as a "serious" software ... slow it down.
Re: 'Heartbleed' contributor denies he inserted it deliberately
#5It may be impossible to distinguish genuine bugs from bug-backdoors, which is why it's important to start developing crypto in safer frameworks and languages. C considered harmful.
Re: 'Heartbleed' contributor denies he inserted it deliberately
#6Yeah most of my bugs are deliberate. I like the feeling of making mistakes and seeing my boss run out of his office frantic.
Just wait till you have been told - it is running too fast so the client won't perceive it as a "serious" software ... slow it down.
The problem is not that bugs happen, but that certain categories of bugs still happen when we have means to avoid them altogether.
Re: 'Heartbleed' contributor denies he inserted it deliberately
#7Compare with the attempted 2003 Linux kernel backdoor [1], which gave root when sys_wait4() is passed uncommon combination of flags. The bug looked inconspicuous and honest enough.
[1] http://lkml.iu.edu//hypermail/linux/kernel/0311.0/0635.html --
Re: 'Heartbleed' contributor denies he inserted it deliberately
#8It may be impossible to distinguish genuine bugs from bug-backdoors, which is why it's important to start developing crypto in safer frameworks and languages. C considered harmful.
The problem is that GCs are considered harmful to crypto code, though that may be changing with Go. We won't know for about 5 years whether it's trustworthy, and even then, the side channel threat posed by GC may be worth worrying about.
Some big-name cryptographers have started implementing some useful crypto services in Go, so we'll see whether it catches on.
EDIT: Is the JVM generally trusted by cryptographers? I just realized that TextSecure is java code. Is the side channel threat posed by GC not too serious, then?
Re: 'Heartbleed' contributor denies he inserted it deliberately
#9I can't imagine what this guy must be feeling right now. I find it embarrassing enough when I am outed in my small team for producing a bug that makes it into production. To be known around the entire internet to have caused the largest security bug in recent times must be quite a slammer.
I really hope it doesn't affect his career..
Re: 'Heartbleed' contributor denies he inserted it deliberately
#10Earlier quoted context omitted.
Just wait till you have been told - it is running too fast so the client won't perceive it as a "serious" software ... slow it down.
The problem is not that bugs happen, but that certain categories of bugs still happen when we have means to avoid them altogether.
Does static code analysis or something like that would have caught the bug?