Mr. Anonymous Coward:
What changes are you referring to? The changes I see are good re-factoring: clean up formatting, remove dead code, add missing bounds checks
Are you volunteering to do the code audit?
Massive rush? Evidence, please.
Security testing clearly hasn't been done before? Evidence, please. The counter-evidence is that the security testing tools were found not to work in this one particular case, and that problem has been patched. Security testing costs money; how much have you donated to the project?
Heartbleed exposes a problem, it doesn't invalidate the concept of Open Source. For one example that made world-wide news, there are hundreds of examples of open-source "wins" that never rose about the journalistic "noice" because it worked properly, and didn't make any waves. The mainstream says "who do we blame, who can we sue?"
And how do you manage projects, particularly open-source projects? Does early disclosure bother me? Yes, as the admin of a group of servers. Would I be comfortable if this were done behind a wall? No. We need all the eyes we can get looking at the problem. And you need to be more explicit: are the bugs that you are complaining about being exposed exploitable in some bad way? Examples, please.
SUMMARY: It's bad, but not as bad as you make it out to be.
- clean up
- tighten up
- field test
In a clean-up operation, you don't vet each change, especially when the change is reformatting instead of a real code change. It's clear from the commits I've looked at that the people doing this are working to eliminate the cruft that inevitability builds up in any project as it matures. See http://en.wikipedia.org/wiki/C... -- you take baby steps, and check your work as you go.
In the process of clean-up, of re-factoring, one may find and fix subtle bugs, such as the missing bounds check that is at the heart of, um, heartbleed. Elimination of the custom memory management in favor of the native OS code (particularly when the OS takes pains to clear out free memory -- which would have stopped heartbleed cold on some platforms) decreases the complexity of the code, and -- arguably -- makes it easier to read. Replacing clumsy code with better-crafted code that does the same thing but far more clearly makes it easier to read. Removing out-dated portability hacks removes a lot of chaff so the wheat is easier to see. But you can't do this all in one commit and expect not to stub your toe.
Repeat as necessary
When the clean-up tighten-up passes are complete, and the cruft is mostly gone, the developers then need to comb through the code looking for issues missed in the first pass, and brokenness caused by unfortunate re-factoring. It happens. Also, error patterns will pop up when the code is reformatted to a single standards. Further, because people are looking not just at syntactic content at this point, but semantic content, comments can be added to document any awkward or un-obvious constructs.
An integral part of examining the code is the development of test cases for the scaffolded version of the code. This needs to check for conformance to the RFC, and also explore what happens with intentionally malformed packets. This is the crucial step which appears to have been missing or incomplete with the pre-heartbleed OpenSSL code. Code inspection will catch stuff; test cases will expose those problems that were missed during the inspection. This process assumes that the program is structured in such a way that scaffolding is possible from a library of the code base, so each function, or small set of functions, can be tested in isolation. I find, in my own work, that I typically write several thousand lines of code during development to ensure that each major function works as expected -- and that code lives on as scaffolded test code so that when I make a change I can test it against a known set of test cases. (Sometimes, you have to change the test , or add tests, because the function changes or a bug sneaks through, but then you have a check-and-balance to minimize issues.)
You ask "Who is watching the watchers?" The answer is an easy one: as usually happens, management will work to solve yesterday's problems. I fully expect, when the work is finished, that the security researchers will pounce on the "new and improved OpenSSL" to find the bugs and holes that didn't get fixed during the current round. They struck gold once -- and like most gold bugs, they will mine the same hill until they go broke, just like the 49ers did.
One interesting effect is that Coverity [coverity.com] made improvements in their code-scanning product. (See comments above this one.) The net effect is that all the products scanned by Coverity products will benefit. Which further answers your question: we now have improved computer watchers, too.
But I am not thinking some nice gradual switch over, but a nice 'if you don't upgrade by X time you loose your insurance and can no longer peer'. If nothing else we could kill at least two birds with one stone... think about the massive economic fallout from the Y2K update, all the money that flowed into tech and job for that had a ripple effect through the economy. Requiring a complete upgrade of the internet would put a real dent in the current economic downturn.
Another benefit: we can see the sequel, Office Space 2, and see how Initech inflates the work needed to solve the spoofed-source problem. Will it end in another fire? Will Milton come back?
just remember to turn them off before cresting a hill, because otherwise you will be fined and/or imprisoned for firing lasers into the sky in an effort to down aircraft.
You need to look up how laser-pumped headlights work. The light isn't coherent outside of the bulb assembly. The laser fires into a phosper, which then generates the wide-spectrum illumination. So the FBI wouldn't be interested, although I would watch using high-beams on a hill.
Oh, wait, this is slashdot. Where facts get in the way of a good joke...
... though they can't file bugs or get a support hotline.
But they can file bugs with CentOS, which can then be upstreamed to the original authors so the bug gets taken care of. Yes, there is no formal support from the CentOS team, but I've been quite happy with the community support I've received the few times I've run into trouble.
My main use of CentOS has been for my mail server. It's still running CentOS 4; I'm working to build a new server with CentOS 6 when I have some spare cycles. That will upgrade both the OS and the hardware, the hardware getting a little long in the tooth.
Does it? Really? I don't think so. It isn't "government regulaton" that is driving my desire to replace incandescent light bulbs with LEDs -- it's the long-term cost savings and the elimination of bulb-changing hassles. I shun CFLs because they represent a hazard to the environment I live in, so out they go. My shift is driven by market forces, not by rules enforced with the working end of a gun.
What the new proposed law does, as I see it, is slow down the rate of rule-making to something approaching sanity. The new rules and regulations are coming so fast and furiously that keeping up with them is a full-time job in and of itself.
SCIENCE is all about showing your work, and having others verify that the work is accurate. When the raw data is labelled "proprietary" or the analysis methods "trade secrets", yet the summary of that data/analysis is presented as justification to force changes on people, that's not a good use of science. Indeed, it's bad government.
To add to the problem of climate "science", there is quite a bit of elitism applied to the judgements of articles -- if you aren't a member of the "club" you are not allowed to play. This has led to some very interesting criticism of contrary work on non-scientific grounds. That's what feeds my skepticism of the "crisis". When a non-environmentalist criticism of the models used to "measure climate change" (remember when the mantra was "measure global warming"?) leads to a knee-jerk "he doesn't know what he's talking about," I cringe.
I personally witnessed what open, transparent science can do. The clean-up of Lake Michigan was based on transparent science, and carefully-considered enforcement against those who polluted the waters. No esoteric regulations, just prove-beyond-a-reasonable-doubt science. Effective.
If you think things should change, find a way -- other than regulation or other use of violence -- to move people to less harmful activities. Make it part of their self-interest to do so. You don't need government to make a difference.
I used to write articles for magazines as a full-time job. When I first started using the outliner MORE, I found that the task of writing became much, much easier: I would outline the article, then fill in text for each outline item. When I was finished, I would then export the text and there was my article. It let me design the articles top-down, just as a EE designs a circuit top-down. Moreover, as the article would develop, I could shift things around very easily without having to do massive cut-and-paste exercises.
Software design? I do that top-down mostly. I design the top level with functions, then fill in the functions. Lather, rinse, repeat as many times as you need to. The result is a piece of software that is highly maintainable.
One of my biggest complaints about "graphical" programming is that you can't have much on the display -- you end up paging *more* than with a text-based system. It isn't the text that's the problem; its the lack of top-down designing on the part of the human.
Now, one system that I absolutely loved working with had an IDE (text-based) where you deal in layers. When you click on the function name, the function itself comes up in different windows. I found that paradigm encouraged small, tight functions. Furthermore, the underlying "compiler" would in-line functions that were defined only once automatically. (You could request a function be in-lined in all cases, like in C, if you needed speed over code size.)
The patent: http://www.google.com/patents/US7986426
Analysis of the patent: http://www.patentbuddy.com/Patent/7986426
The dispute of the patent: http://www.ricoh-usa.com/news/news_release.aspx?prid=1052&alnv=pr
Possible prior art:
He can argue his case honorably and with authority
Not in the Star Chamber into which he would be thrust. You assume that the people on the other side of the "debate" are honorable. That's an assumption that is, on its surface, laughable. I don't believe that lying to Congress is honorable. I don't believe that lying to the American people is honorable. I don't believe that unequal application of the law is honorable. Show me where the majority of the Executive Branch of the US Government has demonstrated honor, and I'll agree with you. From where I sit as a citizen, though, "honor" is conspicious by its absence.
If he really wanted to make a point, he should come back and argue his case in court. Plenty of lawyers would be happy to work for him due to the high-profile nature of the case..
And who guarantees he will get a fair trial, with a jury of his peers, before he returns? Who can give assurance that Snowden's attorneys can discover and submit all the evidence? If The System wants to be "fair" about this, then let them demonstrate their fairness by having a trial of those who violated the Constitution as exposed by the revelations to date. Will that happen?
Why hasn't US Attorney General Holder done anything yet about the violations? Because he's part of the problem, perhaps? (I'm a citizen, who thinks that with the current Administration there are legal "haves" and "have nots" in the USA today. Witness Fast and Furious as an example of the uneven application of justice.)