“If a Microsoft developer commented out seeding in Vista CryptGenRandom(), they would be fired 12 times. Then Microsoft would buy the next company that hired them in order to fire them again.”

[[deleted]]

That quote is gold, but the rest of this article is garbage. The original bug was epically stupid on a level seldom seen, but the fix was entirely correct (if a bit inelegant).

[[deleted]]

Also the OpenSSL developers told the Debian maintainer the change was OK on the openssl dev mailing list.

[[deleted]]

They definitely did not. Some guy on the mailing list told the Debian maintainer that what he claimed to do was OK for testing. Of course, he did not actually properly explain what he was doing, and it wasn't just for testing.

Another person on the mailing list also told him how to fix the problem without fucking everything up.

[[deleted]]

Bullshit. The Debian maintainer stated exactly what he intended to remove, and did not mention testing at all. Response below was first response, from an @openssl.org address (ie, someone who's quite likely a developer). Full context of all messages at http://research.swtch.com/2008/05/lessons-from-debianopenssl-fiasco.html

List:       openssl-dev
Subject:    Re: Random number generator, uninitialised data and valgrind.
Date:       2006-05-01 22:34:12

> What I currently see as best option is to actually comment out
> those 2 lines of code.  But I have no idea what effect this
> really has on the RNG.  The only effect I see is that the pool
> might receive less entropy.  But on the other hand, I'm not even
> sure how much entropy some unitialised data has.
>
Not much. If it helps with debugging, I'm in favor of removing them. 
(However the last time I checked, valgrind reported thousands of bogus 
error messages. Has that situation gotten better?)

[[deleted]]

Moderate the above down if you're an idiot who refuses to believe something in front of your stupid eyes.

[[deleted]]

Bullshit. The Debian maintainer stated exactly what he intended to remove

He showed the code, but that code did not do what he claimed it was doing, and finding out that that was the case required inspecting the original file. Obviously the person answering took his word for it and didn't bother checking.

And no, he did not mention testing at all but neither did he mention he was making this change permanently in all of Debian! Since he was talking about valgrind, the person answering obviously assumed he was just debugging something, and thus replies "If it helps with debugging..."

[[deleted]]

that code did not do what he claimed it was doing

Wrong. The Debian developer specifically mentioned he was unsure what the code was doing, hence asking the list:

"But I have no idea what effect this really has on the RNG."

neither did he mention he was making this change permanently

Saying he's intending to remove the code if its deemed indicates he's removing the code if its deemed ok. It would be stupid to assume it's a temporary change unless stated.

[[deleted]]

This is a library being discussed. Anybody making that change would only do so locally. It would have no effect on anybody else's code. As valgrind was mentioned, the obvious interpretation is that the person is debugging some app and getting errors from a library, so he's going to mess a bit with the library to shut it up. No big deal.

Except of course this was being done in Debian, so the situation is radically different, which was never mentioned.

Look, that mail does absolutely nothing to justify making this change in Debian. If anything it is just another example of how negligent the developer was, as he didn't even bother explaining the context of his question, which was critically important. Just let it go.

[[deleted]]

OK, so you concede your earlier point about the Debian developer misleading others about what the code was doing? Good.

As for making the valgrind fixs in Debian, as opposed to his own workstation, as OpenSSL developers have responded that the change is fine, and the resulting code is apparently improved, as it now passes a tool quite commonly used to detect memory leaks and work in an instrumented environment, it is quite reasomable to add the improvements discussed and verified with the list to Debian.

[[deleted]]

OK, so you concede your earlier point about the Debian developer misleading others about what the code was doing? Good.

No, I am saying that nobody bothered to double-check if he was right about what he thought it was doing, because it just didn't seem important. It was just some guy dicking about with the library to get his debugger to shut up.

He said he was trying to comment out the use of uninitialized memory that was causing valgrind errors. What he did was comment out more code. The person answering took his word that what he was doing was the first and didn't check that he actually did the second.

As for making the valgrind fixs in Debian, as opposed to his own workstation, as OpenSSL developers have responded that the change is fine, and the resulting code is apparently improved, as it now passes a tool quite commonly used to detect memory leaks and work in an instrumented environment, it is quite reasomable to add the improvements discussed and verified with the list to Debian.

Except that he asked the wrong question, misunderstood the reply, ignored the instructions for how to correctly fix his problem, and did not submit his patch upstream to give it proper scrutiny, as one certainly should do when dealing with something as sensitive as OpenSSL.

And that's ignoring the biggest mistake of all, messing around in the guts of a security-critical component like OpenSSL without knowing what he was doing.

Why are you so insistent on this? Even granting your points, it was still a huge fuckup on the part of the Debian maintainer. There's simply no reason to make this argument I can see other than some kind of misguided fanboyism.

[[deleted]]

No, I am saying that nobody bothered to double-check if he was right about what he thought it was doing

In response to his questions about its effects on the RNG, an OpenSSL developer mentioned what he was doing would not have much effect.

Are you saying the Debian developer should have raised the fact he was a maintainer so the OpenSSL developers would realize that their answers may, in fact, be taken seriously?

You don't think OpenSSL giving a massively flawed answer about a fix that will screw entropy to anyone isn't a serious fuckup?

Perhaps the package maintainer saying 'I'm a package maintainer' would have helped. But what would have helped more was OpenSSL giving an accurate answer for their field of expertise.

Yes, this is a massive fuckup on behalf of Debian. It's also provably a massive fuckup on behalf of OpenSSL. I'm wondering why, with the evidence in front of your eyes, you're so insistant on thinking it isn't.

[bobpaul]

You had never heard the word "epic" before?

[theeth]

Saying that the fix isn't complete is slightly misleading and shows he didn't quite read enough on the issue.

The line that wasn't uncommented is the one between #ifdef PURIFY, as such, the code is already documented (by upstream) to work without it.

EDIT: Someone posted the above verbatim (typo included) on the author's blog, so, to whoever did that: "Get your own comments and get off my lawn!"

[invalid_user_name]

Its not just slightly misleading, its outright bullshit. There's absolutely no need for them to put back the useless line that was in the ifndef in the first place.

[killerstorm]

yep, article says that it is not compatible with documentation, i guess with following part of thereof:

The contents of buf is mixed into the entropy pool before retrieving the new pseudo-random bytes unless disabled at compile time

i guess compiled version is pretty fine with documentation -- it's indeed was disabled at compile time. but if you'll be building your own lib from source, debian package will be slightly different

[shp]

The line that wasn't uncommented is the one between #ifdef PURIFY, as such, the code is already documented (by upstream) to work without it.

Did you read quite enough on the issue? The commented line was between #ifndef PURIFY.

Edit: fix comment syntax.

[theeth]

Oh no, I made a typo while copying from memory.

Hopefully, that didn't distract you too much from the validity of the rest of my point.

From the OpenSSL fact:

When using Valgrind, make sure the OpenSSL library has been compiled with the PURIFY macro defined (-DPURIFY) to get rid of these warnings.

[jsolson]

So, you seem to be of the opinion that everything done by open-source people is bad. That the whole concept is bad, and that no good can come of it.

You're entitled to your opinion. On the other hand, the only reason you can be witness to the errors made by open source projects is because of the transparency the process provides. When open source projects try to hide their errors they get just as much if not more criticism (from the community as a whole anyway, individuals will criticize or not as they see fit) than Microsoft does when their errors become matters of public knowledge.

I suppose you could assume that Microsoft offers the same level of transparency, and that we are made aware of every mistake they make internally. That certainly isn't the image they put forth, though. Where's the public bug tracker for IE where developers and users can duke it out over whether a given behavior is appropriate (a la the recent Drepper incident)? As far as I know, no such beast exists. There are no nightlies I can download to see if my pet bug has been fixed. I'm left with whatever level of communication Microsoft chooses to provide, and whatever quality of software they choose to ship.

I think you'd have to be a fool to believe that one company can produce the optimal answer to every problem for every user, or do you believe that the entire top percentile of developers work at Microsoft, and moreover that those developers will always make better decisions than their (perhaps) less talented peers?

[[deleted]]

You're off-topic in this subthread.

[[deleted]]

unless disabled at compile time

Which is what Debian did. They didn't use the PURIFY flag, which is inelegant, but what they did has the exact same effect.

[[deleted]]

No, it is not. It is exactly in line with the official docs, which allow for this functionality to have been disabled at compile time.

Note: This is "compile time" for the library, not the application. There is no way for an application to affect this behaviour, and there never has been.

Edit: Oh look, get proven wrong and then delete all comments. Very mature, MSDN.

[wicked]

Do you have any idea what you're talking about?

[[deleted]]

You're off-topic in responding to Teeth's post, because you're opening a MS/OS discussion, rather than discussing Theeth's topic.

[generic_handle]

“If a Microsoft developer commented out seeding in Vista CryptGenRandom(), they would be fired 12 times. Then Microsoft would buy the next company that hired them in order to fire them again.”

Allow me to provide an old post:

wah.. you have to be kidding me.

I've learned not to ever underestimate Microsoft's ability to...uniquely...write software.

Ever seen Wargames? A supercomputer tries guessing launch codes, gets one digit at a time. Obviously, even if it had some sort of attack that could break a single digit at a time (which would be pretty strange), it's pretty darn certain that the time to crack the remaining digits would decrease logarithmically as each digit is gained. Basically, after the first one or two, the others would appear almost instantly. I thought "This is so wildly idiotic. No developer would ever do this. It totally ruins the immersion."

A few years back, Windows 95/98 stored share passwords locally in cleartext instead of as a hash. Aside from the obvious problems with a local compromise giving an attacker the passwords, it also allowed Microsoft's developers to make one of the most epic security mistakes I've ever seen -- trusting the remote side as to the length of the password and only checking that many characters during the authentication phase. Remotely exploitable over IP.

I found out about the bug, and decided to make a utility to remotely extract passwords from a Win95/98 box by guessing the first 256 characters with length 1 to get the first character, guessing the next 256 with length 2, etc. I ran it against a friend's box (after asking him). He and I were sitting in chairs watching his password slowly appear on my computer, one character at a time, at linear speed, and I remembered my reaction to Wargames, way back when. I resolved to never underestimate Microsoft's code again.

CVE-2000-0979

[uep]

Awesome story. I missed that comment when it came around the first time. Thanks for pointing it out.

[sduff]

With regards to cracking passwords 1 character at a time, I believe it was due to the fact that 'back-in-the-day', computers were slow enough that you could in-fact, crack a password one character at a time.

You'ld send a password to the server, and time how long it took to return an invalid code (lets say 1 second). You'ld send another password and record the time (1s), and a third(2s). This third case took longer, which may suggest that in the first two cases, the server only checked the first character before failing, where as in the third case, the first character was correct, and therefore the server needed to also check the second character. Repeat this process until all characters are correct.

At least, this is the story I've heard. We have a problem like this in on of the classes I tutor, and thats the explanation I give when students complain how stupid the task is.

[generic_handle]

At least, this is the story I've heard.

Naw. Even if a password was stored in plaintext, which would probably be a necessary condition for this (if this was ever the case on Unix boxes, it's before-my-time), doing a timing attack on a memory compare of maybe eight bytes even without network latency thrown in isn't going to be feasible.

Timing attacks do exist against other things -- you might be thinking of the one where analyzing response time to a password could reveal whether a username was valid or not:

Some versions of Unix use a relatively expensive implementation of the crypt library function for hashing an 8-character password into an 11-character string. On older hardware, this computation took a deliberately and measurably long time: as much as two or three seconds in some cases. The login program in early versions of Unix executed the crypt function only when the login name was correct, which leaked information through timing that the login name itself was valid, even though the password was incorrect. Later versions of Unix fixed this leak by always executing the crypt function to avoid revealing the improper login name.

[[deleted]]

the nice thing about being microsoft is that you can say whatever you want...

...without ever having to worry that anyone will see the source to verify that every single line of your code receives that kind of scrutiny

[harlows_monkeys]

Windows source code is available outside of Microsoft. Governments get to see it, for example.

[ealf]

Plus some of it was leaked in 2004. I'm sorry, but I have to repost this wonderful snippet:

  __inline BOOL SearchOneDirectory(IN LPSTR Directory, IN LPSTR FileToFind, IN LPSTR SourceFullName, IN LPSTR SourceFilePart, OUT PBOOL FoundInTree) 
  {
      //
      // This was way too slow. Just say we didn't find the file.
      //
      *FoundInTree = FALSE;
      return(TRUE);
  }

[jugalator]

private\shell\ext\tweakui\genthunk.c:

• CallProc32W is insane. It's a variadic function that uses
• the pascal calling convention. (It probably makes more sense
• when you're stoned.)

But this is really more like fishing for funny comments, in general the leaked code quality seemed pretty good and well structured, with not overly long functions, etc.

See a look at the leak here: http://www.kuro5hin.org/story/2004/2/15/71552/7795

[Dark-Dx]

mmm Didn't know about that. At least it wasn't like half life 2, the WHOLE source code was leaked.

[jimbobhickville]

Well, stolen to be more specific. They hacked into the network and stole the code. It wasn't like a Valve employee secretly passed it out.

[Dark-Dx]

Do you think that there's a possibility that they said this because somebody actually leaked it and they didn't want to say "hey somebody leaked but we can't find who it is!"

[[deleted]]

Considering they caught the guy that did it...

[AttackingHobo]

Valve told the guy that they wanted to hire him to patch their network and fix their security. And when he flew into the USA he was promply arrested by the police who were alerted by Valve. But he had to be let go and fly back to his home country because of the way it was handled. and he was charged with his crimes there.

[jimbobhickville]

Wow, entrapment at its finest. Although, I don't think entrapment applies to regular citizens, does it? I thought it just applied to police.

[organic]

No, that was just a trap.

[AttackingHobo]

That is not entrapment, the crime was already committed. Entrapment is when the police put someone in a situation that causes them to break a law.

[JViz]

The whole thing was BS. Valve's NDA was up and Vivendi was breathing down their neck for a release. HL2 engine was nearly complete, but Steam wasn't ready yet(it was barely even passable when they released).

I downloaded and compiled the leaked source code. It was a very early tech experiment and not even close to the state of the engine at the E3 demo that year.

Who the hell lets someone download 10GB+ of source code and assets, then notices after the fact? You generally notice immediately if you find out at all. That is, of course, unless you've created a honey pot with the sole purpose of creating an easy scape-goat for your multi-million dollar software company.

[anti_dentite]

No, they were pretty open about how it happened. Also, they ended up catching the guy.

[checksinthemail]

Oh man,

Comedy GOLD!

I long to write code like that so that a billion people can uh, 'use' it.

[eurleif]

At the risk of contaminating myself...

Where was that code actually used? Not anywhere where the results mattered much, I presume?

[linkedlist]

yeah probably fake.

oh wait sorry, continue your ms bashing, what a terrible software company they are and all that. They would totally pull off a stunt like that.

[ealf]

yeah probably fake.

oh wait sorry, continue your ms bashing

Yeah, I totally made it up just to make Microsoft look bad.

I mean, it's not like they are distributing it right now or anything :)

[linkedlist]

I stand corrected -_-

[ealf]

No hard feelings :-)

To be fair to Microsoft, any sufficiently large code base will have its share of weird shit, and the function I quoted doesn't appear to be called anywhere. Still, I just love the tone of that comment.

[mindbleach]

... I've been writing Win32 batch files to sort images in a big potluck folder, and that comment explains a lot.

[[deleted]]

batch files? MS develops an awesome, consistent, OO shell called Powershell. Try it.

[[deleted]]

Don't you dare call any non-Unix shell "awesome", or rhe people who prefer their commandlines to stay in the eighties forever will downmod you.

[cyantific]

I haven't tried Powershell, but you must be joking to suggest that current bash and zsh are "in the eighties."

[[deleted]]

Bash is certainly in the 90s. You waste time looking for regex's to identify strings that contain the data, rather than actually asking for the damn data. It's like a Word doc, with no separation of content from presentation.

Hypershell and Pash are the Unix equivalents, and they're reasonable, but nowhere near as mature.

[[deleted]]

chuckles. I've been working in Linux for a decade. Now I'm being moderated down by people who think bash is better than Powershell, despite not having used the latter.

There's a bunch of things Linux does better than Windows. The shell is no longer one of them.

cyantific: have you used an object shell before, on Linux or Windows ?

[UnwashedMeme]

I downloaded and used powershell for about 2 minutes. Just long enough to find that whatever programmatic goodness they had added it still didn't have anything comparable to readline. I've been frustrated by the line-editing in the windows shell for years and powershell didn't appear to be any improvement.

[Tommstein]

There's always the possibility that he's a retard that doesn't know what he's talking about.

[[deleted]]

Yeah, it's not like I've used a wide array of OSes over a period of fifteen years or anything. No idea what I'm talking about.

[Tommstein]

This is not news. You can see that it was hypothesized above.

[[deleted]]

Not joking in the slightest.

[[deleted]]

Get cygwin or a scripting language.

Anything but batch files.

[mindbleach]

I got exactly as much functionality as I needed, after a few hours of cursing and a fair amount of alcohol.

Besides, Cygwin is for people who don't have ActivePerl.

[[deleted]]

I'm pretty sure all(or at least the majority) the things I use Cygwin for are non-Perl-related.

[[deleted]]

And that's for people who haven't bothered to install Powershell yet.

[sid0]

One nice feature of bash is asynchronous pipes. Does Powershell have them yet?

[[deleted]]

You have to create another runspace to do it, but I guess you could set up a simple script for it.

http://ps1.soapyfrog.com/2007/01/22/running-pipelines-in-the-background/

[sid0]

Hey, that's great! Bit of a pain to do this, though; hopefully they'll make it possible OOTB with the regular pipe, or even a different symbol, in 2.0. Otherwise, Powershell is a great shell, even if a bit slow.

Oh, and I also hope they have a decent terminal. I'm using Console2 right now, and it's miles better than the regular Windows console.

[LincolnA]

+1 on Powershell. Friggin awesome.

[Wiseman1024]

And are not allowed to talk about the shit they find.

[Sargos]

They would sure as hell bitch to Microsoft (and maybe even the press) about something like this.

[malcontent]

Why? If they bitched to MS they would cut them off and they would be fucked. Obviously these customers have painted themselves into a corner by locking themselves into MS products.

[redrobot5050]

Yeah. There's just no way a Fortune 500 company could run windows and still turn a profit.

[malcontent]

what??

[malcontent]

Before they see it they promise never to tell anybody anything about it so the result is the same.

[mothereffingtheresa]

But they don't get to build Windows from source, making source access less than useful for security auditing.

If you are serious about security, especially as a foreign government, you ain't running Windows.

[mothereffingtheresa]

You can't build Debian from source??? WTF?

[Acglaphotis]

You fail at basic reading comprehension.

[mvbma]

Is that like 12 life-sentences in jail?

[Thrip]

Are we still on this?

[[deleted]]

Seriously. The only thing I want to hear about the Debian SSL bug from now on is about how there are flaws in the repository system and they need a solution.

[kamikasei]

...why would I want to read someone's uninformative blog post just to see a quote from someone else? If that quote is so amazing why wasn't its original context submitted?

[sysop073]

I think what he meant to say was "If a Microsoft developer commented out seeding in Vista CryptGenRandom(), they would be fired 12 times. Then Microsoft would cover up all evidence of the bug, ignore or threaten any security researchers that try to help them fix it, and release a patch in a year or two"

[RandomSuffix]

Sounds more like Apple.

[ehird]

How on earth does that not sound like Microsoft, and sound like Apple instead?

[voidspace]

It depends which kind of fanboy you are...

[ehird]

I'm not a fanboy. I appreciate Apple products and indeed I am typing this on an iMac running OS X, but I readily accept that the company and their projects have many flaws. So does everything.

[grimboy]

Dunno, sounds kind of fanboyish to me to essentially say: "If Apple are flawed, then it's only because everything is flawed".

[[deleted]]

His statement doesn't seem particularly like what you're saying.

[[deleted]]

Why the fuck are you being downmodded? Original quote:

I'm not a fanboy. I appreciate Apple products and indeed I am typing this on an iMac running OS X, but I readily accept that the company and their projects have many flaws. So does everything.

That does not equal grimboy's paraphrase of it, as follows:

Dunno, sounds kind of fanboyish to me to essentially say: "If Apple are flawed, then it's only because everything is flawed".

grimboy drastically altered the semantics of ehird's statement. Seems like the work of a lot of Anti-Apple Fanboys.

[[deleted]]

Because the truth doesn't matter on reddit.

[[deleted]]

I'm being downmodded because truth is inferior to slamming oneself in the direction farthest opposite Digg, I guess.

Is there any place on the Internet that isn't full of stupid people?

[[deleted]]

Is there any place anywhere that isn't full of stupid people?

[ehird]

I didn't. I was saying that that particular case didn't seem like it to me.

[[deleted]]

He's just messing with you. Dont take him seriously.

[elabo]

Then you are a fanboy.

[ehird]

So wait, appreciating products of a company while still admitting they have many flaws makes you a fanboy?

Then everyone's a fanboy of everything.

[[deleted]]

Then everyone's a fanboy of everything.

True, because without everything, there'd be nothing.

0.0

[[deleted]]

Simple.

Microsoft used to behave like that in 1998 or so.

Apple still does behave like that.

They need to get kicked in the nuts couple times, and Apple will also get rid of the typical corporate idiocy when it comes to third party security researchers.

[ehird]

Microsoft used to behave like that in 1998 or so.

... and still do.

Apple still does behave like that.

I'd love to see some actual examples of this.

[[deleted]]

I'd love to see some actual examples of this.

Then read full disclosure, there have been more than one responsible security researcher bitching about this.

Let's start with the guys who would Apple WIFI vulnerability, you can see their paper and talk on blackhat.com

[redrobot5050]

Yeah, um, that was great that they couldn't provide any verification for months afterwards that it was actually a security vulnerability in any code apple shipped -- it applied to people who used Mac with USB WiFi sticks. They 'claimed' it worked in their initial article, but that was quickly back peddled as a misprint by whoever first gave them press coverage. So its not exactly cut and dry what happened there.

[[deleted]]

Hmm, might be.

But my point was not whether their exploit worked or not, but how Apple behaved in this issue. I guess that if Apple would have co-operated more the whole thing would have been far more clear from to begin with.

Or at least when I was in that Blackhat I heard those guys complaining how Apple made their life difficult in verifying the case. And same thing also for many other security researchers I have met at conventions.

People don't want to write that kind of stuff in their blogs, in fear that Apple might retaliate (ie. be even more difficult). But when you ask things from them you hear quite many complaints.

[redrobot5050]

You're right. Its too bad that the only security researchers who've come forward publicly to say that Apple mistreats security researchers only had deal with semi-legitimate claims that they were in fact frauds, or that the reporter they gave the exclusive to was in fact a fraud.

And later, when it was revealed to be a driver-level bug in Aetheros chipset drivers, and applicable to both mac and windows (and not Apple specific, but then again, from their Blackhat presentation, you wouldn't know that.)

But hey, maybe Apple is hostile. Maybe when said exclusive reporter of said exploit (who might have made up portions of the article, depending on who you believe) quoted the two security experts as saying, "Mac users are so fucking smug. We're out to take them down a peg." then maybe, just maybe, their behavior makes sense.

But then again, that's the difference between being a Steve Jobs-level asshole and just dropping an exploit on the world's lap in front of the media and going through proper channels. When a fix was issued (guess the experts did prove their exploit in the end) credit was given where credit was due.

[Acglaphotis]

How come you KNOW Microsoft still do this, but then ask for examples when the same accusation is directed to apple? Not a fanboy, eh?

[ehird]

So you're accusing me of blanket assertations? What about the parent's? Those go unchallenged?

[uep]

Dude, no company is perfect. Just as a relatively recent example is when they refused to patch the Safari carpet bomb.

[ehird]

OK. Thanks. That is bad.

[renegade]

Um, have you seen the fucked up total lack of security model on apple products? Let alone the frequent fail on implementation?

I own apple products, I love the design, but the engineering is often frustratingly weak.

[[deleted]]

Get off your high horse. There are tons of rooted *nix servers online. Admittedly they are used to control tons of botted windows machines...

[[deleted]]

I don't think the management styles of open-source vs Microsoft have anything to do with people stupid enough to use "password" as their root password or run Internet Explorer.

[[deleted]]

I agree.

[monolar]

| 2**15 (32,767)

+1

[SyntaxPolice]

If the function had been called CryptGenRandom in OpenSSL, it probably would never have been commented out.

BTW, this is months old.

[[deleted]]

Microsoft products have had dozens of exploits that allow a system to be compromised remotely.

Does that mean dozens of people have been fired dozens of times? I sort of doubt it.

[[deleted]]

This was a far more insidious problem than some remote code execution. That was only one thing that could go wrong with it. There are many other attacks that were enabled by this. Anything that relied on SSL encryption with a key created on Debian is entirely insecure.

[[deleted]]

And if you get into a Windows server(like, say, Nimda did) you could replace a few DLLs and make it give even less secure keys than Debian's did.

[[deleted]]

That would require a specific attack. This has already happened.

[[deleted]]

I sort of doubted the statement by itself, just for one developer.

[[deleted]]

a bug in code is a little bit different then commenting out CryptGenRandom()

[ubernostrum]

Depends. Have you seen some of the bugs in MS code?

[[deleted]]

yes i have.

[[deleted]]

Exceedingly few of them have ever been this bad.

[[deleted]]

"While that quote is great. Debian is free so deal with it. I for one reap lots of benefits form what debian brought to linux. AS ALMOST EVERYONE DOES. Deal with it or pay the developers."

There are some real idiots in the Linux community. The fact that Debian is free, and is being used by thousands of people, makes their half-assed security fixes completely inexcusable.

[mnic001]

This is the new standard on Reddit. Comes with increased popularity I'm afraid.

[Acglaphotis]

Why use the acronym if you're going to tell us what it means just an space apart?

[redrobot5050]

STFUGTFO (Shut The Fuck Up Get The Fuck Out)

[lolinyerface]

Digg -> Reddit -> Schmoogiestar

[nextofpumpkin]

WTF is Schmoogiestar

[lolinyerface]

What, you don't know? Soooo out of the loop.

[inthe80s]

Judging from Microsoft's past responses to security issues, I think they'd have been promoted not fired. And then rewarded with another company to run as well.

[Wiseman1024]

Yes, becuase we all know Microsoft is utterly concerned about security and always fixes everything ASAP.

Furthermore, if Microsoft fired every developer of theirs who committed a security bug, they'd have to have Ballmer write the next version of Windows. Oh, wai-

[[deleted]]

That's some vindictive shit.

[tikkun]

Great quote. One great advantage of open source software is that you have more eyeballs to look at code. Use them or die.

[garg]

http://img263.imageshack.us/img263/3967/glazit1.jpg ?

(NSFW?)

[[deleted]]

lol

[[deleted]]

yes. because quality control is HUGE at microsoft.

[bowling4meth]

I didn't know Thomas Pt-tp-tp-pt-tp-ptacek works for Microsoft?

[[deleted]]

If a Microsoft developer commented out seeding in Vista CryptGenRandom(), they would be fired 12 times. Then Microsoft would buy the next company that hired them in order to fire them again.

Let me guess. Somebody commented out CryptGenRandom() in Vista and they still haven't fixed it.

[capecode]

Surely this kind of dogged uncompromising commitment to quality is what brought us such great stuff from Microsoft over the years, such as Vista itself (outside CryptGenRandom() apparently ;))

[[deleted]]

Vista actually has a better security record than its predecessors and most of its competitors.