open source security flaw

[Fighterpilot]

This article(and its comments) is pretty interesting.
http://www.dailytech.com/article.aspx?newsid=11869

[cheesyking]

Yeah this has been a gigantic cockup. I've spent several hours installing the patches and regenerating keys, very time consuming and very annoying.

[FireGryphon]

Several programmers should have to look over code before it gets put in any official release. The error was ridiculous. You can't just comment out code because it causes you problems, least of all when it's part of an important security module. I smell sabotage.

On the bright side, the problem had been fixed by the time the press got a hold of it, which is pretty good. I suppose I should boot into Ubuntu and update now.

[just brew it!]

Yup, this is a serious black eye for the Debian team, which (until now) had a pretty good track record on security issues.

We found and replaced a couple of "bad" keys on a Debian server we recently set up where I work. Fortunately, none of the affected services were exposed outside our workgroup before the flaw was discovered, so we should be in the clear.

[notfred]

Several programmers should have to look over code before it gets put in any official release.

"Looks Good" is not a code review

[FireGryphon]

*an awesome t-shirt*

Put some Debian reference on that shirt and it's worth $20.