Huge Hole in Open Source Software Found, Leaves Millions Vulnerable

[Lucas]

It is incredible just how big the effects of the newly discovered error in open source key generation is

For all the criticism of Microsoft and its security flaws, the software giant has
made an impressive turnaround. While Vista has been derided for a variety of reasons, most would agree that it’s much more secure than Windows XP. Recently, a hacker conference showed just how vulnerable systems running Mac OS X are, due to their slow rate of patches. The Mac machine was hijacked within 10 minutes, while the Linux and Windows boxes survived the day.

Now an even worse security flaw has been found in some of the basic code used by a wide variety of Linux security programs. The error originated back in May 2006 when workers on the open-source security project committed a grave and unrealized error.

A simple programming error reduced the entropy in the generated program keys created by the OpenSSL library. Why does this matter? The OpenSSL library's key generation and other routines are used by the SSH remote access program, the IPsec Virtual Private Network (VPN), the Apache Web server, secure email clients, programs that offer secure internet portals and more.


Read More

[tedanderson]

This is interesting.

The old addage says that locks are for honest people. As long as there is an exchange of sensitive information over the internet there will be people who are trying to steal it and people who will figure out how to circumvent any form of securty.

I don't concern myself too much about things like this. I just make sure that I watch my own back and remain extra careful as to not put all of my eggs in the same basket. If any of my personal information is ever compromised, the crook can only go so far with it.

It amazes me as to how many people use the same password for EVERYTHING that they do online and then wonder how their password got "hacked".

[shayward]

I'd expect a patch very soon for this. The one benefit of open source is that many, many developers are going to jump all over this and fix it ASAP.

I think both the Windows and the Linux communities have been good as of late in patching things. There will always be security holes in every platform. For every 1000 lines of solid, 20-year-old thoroughly patched-and-tested production code, there are 2 bugs.

Now consider how many lines of code make up Windows, Linux, et al.

[tedanderson]

Now consider how many lines of code make up Windows, Linux, et al

I wonder what went through the programmer's mind when he typed out the very first line of the code and if he even thought it would grow to be as big as it is today.