Originally Posted By: Arney
I'm amused that the outcry about this GnuTLS flaw seems pretty muted, at least from what I've read, compared to the breathless "this is as bad as it gets" media coverage of Apple's similar "goto fail" flaw that was just publicized.

Did Apple have a security flaw? I think I vaguely remember something like that, but no details. I trust they fixed it. Apple is quite good about that I think. I guess if Apple or opensource did have a security flaw, it might actually deserve breathless media coverage. Since these flaws are so extremely rare compared to that other closed course operating system out there. The novelty of having a security flaw in Apple/opensource would deserve some media coverage due to its rarity. Similar to someone observing a Sasquatch walking around in downtown Denver.

Quote:
And this is a security vulnerability in an important open source module that has potentially been around since 2005!

This statement goes to show you how difficult to exploit on a wide scale this flaw is, thus limiting potential harm. But go ahead media, scream breathlessly if you want. Just don't go mentioning that Linux used to make fine china, then furnaces, before they got into operating systems. That is about the ignorance level from mass media I've come to expect, unfortunately.

Quote:
Definitely a black eye for those who claim that open source software is inherently more secure JUST BECAUSE the source code is publicly available. ... BIG black eye to the OS community.

How so? A vulnerability has been found in opensource code. I don't think opensource said there would never ever be any flaw discovered. How does the quantity of these opensource vulnerabilities compare to the quantity of closed source (Microsoft, et.al.) vulnerabilities found? If you think about that, you'll have to admit that opensource *IS* inheritantly more secure. By a fantastically wide margin. I guess if you are saying one opensource flaw is equivalent to 1000 Microsoft flaws, then you could try to make your point based on that. But nobody would take you seriously if that was your basis.

Anyway, I hope the flaw is patched soon, if it hasn't been already. At least a patch to something like SSL can be applied without requiring all the servers to be rebooted, unlike that other common OS out there. Personally, I won't be throwing out opensource and running to closed source because somebody found a difficult to exploit bug. That would be silly.