Hacker News Reader

I like to be AI sceptical as well but I think it's even more noticeable if the flaw is in 20 year old code which thousands of people have read and reviewed and not noticed, isn't it?

View on HN

Hardly anyone reads and reviews in open source. It is a myth from ESR. Probably one person wrote it and another one said LGTM.

Today ESR would say "All bugs are really shallow this time, thanks to our robot friends!"

The exact bug was reported two times in the past. But only as DOS and incorrectly patched. Clearly people actually read the code.

The recent signed keys being '4' is an example.

Looks good, validates, works, and then trust is assumed.

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.

It was assumed the private keys were private, not easily figureoutable, so they were most likely never tested.

Reply on news.ycombinator.com