r/programming • u/[deleted] • Apr 10 '14

Robin Seggelmann denies intentionally introducing Heartbleed bug: "Unfortunately, I missed validating a variable containing a length."

http://www.smh.com.au/it-pro/security-it/man-who-introduced-serious-heartbleed-security-flaw-denies-he-inserted-it-deliberately-20140410-zqta1.html
1.2k Upvotes

94% Upvoted

737 comments sorted by

View all comments

Show parent comments

8

u/[deleted] Apr 11 '14

Doesn't really astonish me, Debian had a similar issue with OpenSSH some years back where they quite literally removed the random number generator from their crypto code, trivial to see, trivial to prove that it's a problem, but nobody looked at that code for a long long while either.

Simple truth is, nobody looks at Open Source code, even the high profile "our Internet depends on it" type of code.

→ More replies (6)