Hacker News Reader

Comment by weavie | Hacker News Reader

I can't imagine what this guy must be feeling right now. I find it embarrassing enough when I am outed in my small team for producing a bug that makes it into production. To be known around the entire internet to have caused the largest security bug in recent times must be quite a slammer.

I really hope it doesn't affect his career..

View on HN

The armchair crypto brigade aren't helping much, either, by passing around these completely unfounded accusations of malfeasance.

I'm all for being aware of the possibility that shenanigans are involved, but until proof comes out, it is nothing but a possibility, and a remote one at that.

"Never attribute to malice that which is adequately explained by stupidity." Obviously "stupidity" is way too strong here, but the principle still applies.

In this case I would replace "stupidity" with "assumption". It was code-reviewed so that level assumed correctness. It's in OpenSSL, which is written by experts, so the millions of us that use it every day assumed correctness. Our customers know little about the workings of the internet, so they assume correctness.

This, incidentally, is the same sort of thinking that sometimes kills experts in dangerous situations: the assumption that someone smarter than us must by definition know more than us, so we can be lackadaisical. Witness Snow Fall (http://www.nytimes.com/projects/2012/snow-fall/?forceredirec...)

The rest of the quote is "...but don't rule out malice."

I'm actually more worried that this will result in a civil lawsuit from one of the affected companies. In an ideal world[1], it would get thrown out immediately, but I'm a bit worried. That would have a heck of a chilling affect.

1) and a simple reading of the license

Is it 'rayiner who tells us to always have the disclaimer for liability in our licenses? Whoever it is, this is why.

I think any company that is damaged by this should get all their money back, all $0 of it.

My only worry is some nasty lawyer will figure out a way around the disclaimer. I am hoping not and that it has been well established, but the courts are often a bit insane.

He works for T-Systems, which belongs to Deutsche Telekom. His job is pretty safe, I would say. People working for Deutsche Telekom work under conditions similar to German civil servants in terms of terminability.

Let the programmer who has never written a bug cast the first stone.

I'd be amazed if he doesn't break from the pressure and/or abuse.

I wouldn't be surprised if it was good for his career in the long run. Smart people will know that bugs like this can happen to anyone, and he'll have huge name recognition. As long as he's humble about it, "Yeah, I'm the guy who broke OpenSSL. Man, that sucked." I could see it being a big plus in interviews after a year or two.

Reply on news.ycombinator.com