Originally Posted By: Arney
Originally Posted By: dougwalkabout
BTW, Linux folks shouldn't get too smug. Just as Apple recovers from a gaping security hole, a serious hole of similar size has been found in Linux and affects most of the major distributions: http://arstechnica.com/security/2014/03/...-eavesdropping/

I'm amused that the outcry about this GnuTLS flaw seems pretty muted, at least from what I've read, compared to the breathless "this is as bad as it gets" media coverage of Apple's similar "goto fail" flaw that was just publicized. And this is a security vulnerability in an important open source module that has potentially been around since 2005! That's like 75 years in Internet time!


Apple stubbornly refused to comment on anything related to security before eventually fixing the "goto" bug. (They KNEW, and for a very long time).

The GnuTLS community immediately publishes any information about bugs, security flaws and recommendations. (And fixes it, as soon as humanly possible)

The GnuTLS flaw meant that under some very specific circumstances the security check would indicate "OK" where it should go "Fail".

The Apple "goto" failure meant that under no circumstances would you get a red flag when visiting a https-site; the actual security verification was by-passed all together.

As for legacy code versus open source code, the quality of the code depends on the actual team and management. But would you like the worlds leading cryptographic expert to scrutinize your work? Then you need to make the code public.