Re: OpenSSL development (Heartbleed)

[Alan Browne <alan.browne@FreelunchVideotron.ca>]

On 2014.04.19, 12:42 , Georg Bauhaus wrote:
> On 19/04/14 18:06, Alan Browne wrote:
>> On 2014.04.19, 11:36 , Georg Bauhaus wrote:
>>
>>> In between, reports of booing, bemoaning, and demanding; journalist
>>> tries to establish a scape goat (OpenSSL users don't fund!).
>>> No proof, no clear indication of causation, but alluding in style.
>>> By saying that OpenSSL is not a well funded project, she obviously
>>> tries to imply that this is (a) true in effect, and (b) that funding
>>> prevents bugs. (a): most of OpenSSL does exist only after work
>>> of payed employees. (b): See bugs discovered at the same time in well
>>> funded MS Word and MS Outlook projects, of similar reach.
>>
>> And how does that make you feel?
>
> Depends. Sometimes I feel that industry should rid itself of
> its dependence on so few suppliers of an ever increasing number
> of "industry standards",  open source or not, and on
> PR style people. Some things are just too important for healthy
> living, both at work and at home. So important that these things
> should be exempt from being nothing but a business opportunity.

I think so too.

IMO interchange on intra/internets should be formal standards based. 
Those standards should be done in the same manner as aerospace and 
defense s/w.  It's okay if a pool of companies create the company that 
does so - but the sole source of release should be that company.

>> Please see this as well:
>>
>> http://bits.blogs.nytimes.com/2014/04/18/openssl-and-linux-a-tale-of-two-open-source-projects/?action=click&contentCollection=Technology&module=RelatedCoverage&region=Marginalia&pgtype=article
>>
>
> Same thing...

No.  Where OpenSSL is underfunded and has a population of maybe 4 
programmers dedicated to it (the guy who created the bug not being one 
of the 4) released an important security breach upon the masses;

Contrast with OpenSourced Linux which has a well (corporate) funded 
organization and has a lot more eyeballs on the code and hasn't (Linux 
itself) suffered any major or embarrassing problems.

That was the point of the article.

-- 
"Big data can reduce anything to a single number,
  but you shouldn’t be fooled by the appearance of exactitude."
      -Gary Marcus and Ernest Davis, NYT, 2014.04.07