Heartbleed and XZ Backdoor Learnings: Open Source Infrastructure Can Be Improved Efficiently With Moderate Funding
optimizedbyotto.com
The XZ Utils backdoor, discovered last week, and the Heartbleed security vulnerability ten years ago, share the same ultimate root cause. Both of them, and in fact all critical infrastructure open source projects, should be fixed with the same solution: ensure baseline funding for proper open source maintenance.\n

The XZ Utils backdoor, discovered last week, and the Heartbleed security vulnerability ten years ago, share the same ultimate root cause. Both of them, and in fact all critical infrastructure open source projects, should be fixed with the same solution: ensure baseline funding for proper open source maintenance.

  • kbotc@lemmy.worldEnglish
    43·
    7 months ago

    This entire post is asinine. The root cause of Heartbleed was the RFC was fucked. A German graduate student wrote and implemented an RFC, and was then reviewed by the only full time (and paid) member of the OpenSSL team. Claiming it was because it wasn’t funded is stupid on its face as Dr. Henson was paid for his review.

    XZ’s problem was that the maintainer had a mental breakdown and lacking structure to vet the replacement, he handed control off to what seems like a very sophisticated attack group. Money would not have fixed one of the fundamental problems with anarchistic-style code production, which is how do you trust the people who vet the code?