TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Heartbleed and the misconceptions about Open Source

41 点作者 pytrin大约 11 年前

18 条评论

jleader大约 11 年前
Generalizations about whether open-source developers or closed-source source developers have more resources, or are more professional, or whatever, are silly. The two groups of developers are very large with high variance in many dimensions, and a lot of overlap. There are open-source projects with one or 2 developers, and open-source projects that are the primary focus of $100-million, thousand-employee companies. There are also closed-source commercial projects developed by teams of hundreds, and closed-source commercial projects developed by a solo programmer when he&#x27;s not busy answering customers&#x27; phone calls. Lots of developers work on both open and closed-source projects at one time or another.<p>It&#x27;s important to discuss what changes we can (and should) make to make problems like heartbleed less likely in the future, but wildly waving competing generalizations in the air doesn&#x27;t help anything.
评论 #7580759 未加载
mehrdada大约 11 年前
&quot;you cannot expect a person working in academia to be held to the same standards as professionals working in the industry for many years&quot;<p>This is absolutely BS, especially in security and cryptography. Most security related code written by most so-called &quot;professional&quot; software developers is astonishingly terrible (e.g. ECB mode encryption, storing encryption key in code, reusing encryption keys, relying on (unauthenticated) encryption for authenticity, reusing IVs, linear time MAC verification, ...). Most cryptographers are academics. Also, anecdotally, the poisonous &quot;demo an exploit or it doesn&#x27;t happen&quot; attitude in response to hints at a flawed system design is much more prevalent among &quot;professional software developers&quot; than in academia.<p>If anything, we should encourage more security experts in academia to engage in implementation, verification, and improvement of security code, not the other way around.<p>(Not that most academics write good code either, but this is not an academia&#x2F;industry issue. It is a security expert&#x2F;non-expert issue.)
评论 #7579941 未加载
评论 #7579620 未加载
linuxhansl大约 11 年前
It seems to me that the author of this piece has a lot of &quot;misconceptions about Open Source&quot; himself.<p>An example: &quot;anyone can contribute, regardless of background or proficiency&quot;. I&#x27;d encourage the author to research how open source projects are run before making claims like this.<p>Also.. How was this bug found again? Oh yeah. By analyzing the _open_ source code.<p>Professionalism is orthogonal to open source vs. closed source. There&#x27;s a place for both, and there is good and bad open source and closed source software.<p>Moving right along nothing to see here.
评论 #7579949 未加载
whatts大约 11 年前
Apple has all the resources, and they had the &quot;goto fail&quot;. You should not underrate open source. Bugs are shallow, but that can never mean <i>every</i> single bug. Some bugs will always be overlooked, no matter if open source or closed source.
owenversteeg大约 11 年前
This is BS; the bug was found by people analyzing the <i>open-source</i> code because anyone can do so. Also, criticizing the developer because he&#x27;s a PhD student makes zero sense; the two best developers I&#x27;ve known were a student and a 13-year-old.<p>I also love how the author puts a thinly-veiled plug of his slimy &quot;open-source&quot; code-selling website in the middle. As benatkin said in his excellent comment [0], all four of their featured products are closed-source. The OSI should sue them for violation of their trademark of the term &quot;open source&quot;.<p>[0] <a href="https://news.ycombinator.com/item?id=7579700" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=7579700</a>
jokoon大约 11 年前
open source doesn&#x27;t necessarily mean &quot;anyone can edit it and improve it&quot;.<p>patches and added features need to be reviewed by project owners.<p>open source mostly mean &quot;you can read the source and modify your version, but that doesn&#x27;t mean you can make a change that will go into the official release.&quot;<p>There are some very sensitive implementations of software which should be thoroughly examined by experts and criticized if they&#x27;re not good enough. If there is no resources available to maintain a particular open source software, don&#x27;t bother use it, ESPECIALLY if it&#x27;s sensitive like openssl.<p>Open source allows software companies and other programmers to easily work together to solve a problem. Developer&#x27;s time is precious so it&#x27;s often time-saving to use somebody&#x27;s else work, but that doesn&#x27;t mean you should use it blindly.
评论 #7579497 未加载
评论 #7579577 未加载
zobzu大约 11 年前
&quot;every software has bug and opensource has less resources to look at it&quot;<p>i&#x27;d rather say &quot;and you just don&#x27;t know about the closed source ones because they&#x27;re harder to find&quot; ;-)
upofadown大约 11 年前
There has been a lot of really insightful hindsight about the heartbeed issue. This one seems to fall into the category of &quot;we should of expended more resources on such a critical piece of infrastructure&quot;, where resources could of been time, attention or money. That is true, but not really very helpful.<p>This particular observation comes up any time something goes wrong in any context. The stuff about the shallowness of bugs really has nothing to do with the argument. This bug was in fact quite shallow, some random entity just found it by looking. If more people had of been looking then it would of likely been found sooner. You can only find a bug once.
benatkin大约 11 年前
BinPress is misusing the term Open Source in their slogan. All four of their featured &quot;Popular Products&quot; are closed source. IMO <a href="http://opensource.org/" rel="nofollow">http:&#x2F;&#x2F;opensource.org&#x2F;</a> should be suing them to protect their trademarks, because their use of the term is trying to piggyback on the popularity of the Open Source community that OSI represents.<p>So I don&#x27;t think they are in a good position to be talking about the meaning of Open Source, as they&#x27;re doing in this article.
评论 #7579987 未加载
评论 #7579740 未加载
njharman大约 11 年前
&quot;OpenSSL is used and run by millions of companies around the world, many of which have dedicated software engineers working for them full-time, while reaching hundreds of millions of users. And yet, this issue was undiscovered for almost 2 years&quot;<p>This is almost a non-sequitor (Sp?). Almost none of those software engineers looked at the source (and those few that did got eye bleed).<p>I quit reading after that.
stuhood大约 11 年前
Does the security team not count as one of the sets of &quot;eyes&quot;? Would they have discovered the bug without inspecting the code?
markbnj大约 11 年前
The main point, that more eyeballs doesn&#x27;t necessarily lead to more bugs found and fixed, is a good one. Reading code, or text, specifically with the intent of finding errors is very hard, and is itself an error-prone activity. Anyone who has had to do close proof-reading knows this. It&#x27;s hard work, so our brains are constantly fighting us and trying to &quot;relax&quot; back to a higher level of abstraction. That&#x27;s one of the reasons I read the Coverity post with some interest. We humans are hopelessly ill-suited for these tasks, and we need all the help we can get.
Ologn大约 11 年前
&gt; “Given enough eyeballs, all bugs are shallow” – Eric Raymond &gt; only obvious problems are easily caught. An issue that manifests itself only under very specific conditions or not in a way that is obvious to the end-user, can go undetected for a long time.<p>There are fundamental differences between bugs and security holes. Bugs are something everyone has an interest in fixing. If a bug rarely manifests itself - then it is not that much of a problem.<p>Security holes are things which some people scrupulously search for, and then sometimes keep secret, for their own ends. Sometimes people even try to create security holes where there are none ( <a href="http://lwn.net/Articles/57135" rel="nofollow">http:&#x2F;&#x2F;lwn.net&#x2F;Articles&#x2F;57135</a> ).
awalton大约 11 年前
That&#x27;s funny. When I make this <i>exact point</i> here on HackerNews I get downvoted to oblivion.<p>Open Source gives you potential to build a rocket to the moon. But it requires money and time and people willing to mind the code, and people with humble attitudes willing to accept when they&#x27;ve made mistakes and patch the code.<p>Quality Assurance requires effort, and that&#x27;s where the fallacy of &quot;Free&quot; software really comes from. If you&#x27;re not paying for it, you&#x27;re going to pay for it. (Either by being the QE team and fixing bugs yourself or by living with buggy software.)
评论 #7579713 未加载
评论 #7579976 未加载
quadrangle大约 11 年前
Binpress doesn&#x27;t promote Open Source software as anyone else knows it. Binpress promotes proprietary software where licensees can see the source code and modify it privately. Binpress calls this &quot;Open Source&quot; although it lacks all the qualities that everyone else assumes with that term.<p>Thus, Binpress always looks to combine their one very <i>good</i> point (that better funding for Open Source is important) with a bunch of junk trying to say that buying their proprietary software is the answer.
fidotron大约 11 年前
OpenSSL, and the other security problems lately, are just the top of a rabbit hole that is only ultimately resolved with isolated special hardware. Frankly we shouldn&#x27;t trust our systems, open or proprietary, on the very simple basis they are too complex to verify.<p>Only by moving crypto functions to a separate user maintainable black box will this tide ever be stemmed. Of course, verifying that black box then becomes problematic, but it would be easier than the current situation.
评论 #7579618 未加载
cabinpark大约 11 年前
I&#x27;ve always interpreted Linus&#x27;s law in the following way: given a bug, there will exist someone to whom the bug is obvious and will immediately spot it. However the law doesn&#x27;t state how many people you would need to check, it might be 2 or it might be 100,000 required.
arikrak大约 11 年前
If openSSL was closed-source and a vulnerability was found in it, couldn&#x27;t it have been patched without revealing what the issue was? This seems to be a big security issue with open-source.
评论 #7579768 未加载