Vlákno názorů k článku
Vážný bezpečnostní problém s OpenSSL v Debianu od pht - Debian ... delaj marchy ... a hajzl maj...

(přebráno z abclinuxu)

> More details show that someone seriously fucked up in debian.

Well, this Kurt has seriously asked for details on the relevant openssl-dev list:

http://marc.info/?l=openssl-dev&m=114651085826293&w=2

And see what "arrogant as usual" Ben Laurie states:

http://www.links.org/?p=327

"they should contribute their patches upstream to the package maintainers. Had Debian done this in this case, we (the OpenSSL Team) would have fallen about laughing, and once we had got our breath back, told them what a terrible idea this was."

Kurt has clearly done so, and I know personally of another totally ignored patch from our company and I have heard in the past about OpenBSD people trying to send patches to OpenSSL maintainers to no avail.

The OpenSSL maintainers have proven not to read their mail, they aren't interested in cleaning up their big mess.

Laurie also states "never fix a bug you don t understand" and this OpenSSL "hero" seems to forget that something that seems smart and OK now and here can be plain bad and ugly when looked at with some more distance or knowledge.

His "Adding uninitialised memory to it can do no harm and might do some good, which is why we do it." is pure arrogant and shortsighted shit to me.

+++chefren