Emva kwe-HeartBleedGate kunye nemilambo yabalinganiswa ebhalwe kwityala, loo manga inenkani engabaphuhlisi be-OpenBSD, ekhokelwa nguTheo de Raadt, ithe "Masenze eyethu i-OpenSSL ngemidlalo yethamsanqa kunye nama-sluts." Kodwa kanjani Inkxaso-mali ayibaniki yokungcakaza kunye ne-sluts, bashiyeke kuphela ngemfoloko ye-OpenSSL, abaya kuyibiza I-FreeSSL kwaye okokuqala iya kuba ye-OpenBSD 5.6 kwaye, ukuba konke kuhamba kakuhle, kwezinye iinkqubo ze-POSIX, kubandakanya neLinux.
Ewe uTed Unangst, umphuhlisi weOpenBSD ukhankanya ukuba yayiyintliziyo Inye kuphela ye-OpenSSL yonyaka yeebugs eziyingozi kwaye le bug ibingeyo sizathu sefolokhwe. Ibug i-Ted egxile kuyo (eya kuthi ekugqibeleni ibangele ifolokhwe) inento yokwenza nayo ii-freelists zangaphakathi ze-OpenSSL ke ngoku ntoni Ngnix ayisebenzi ngaphandle kwezo freelists. Kodwa eyona imbi kakhulu ukungabikho kwempendulo kwi-OpenSSL kuba le bug sele inesicatshulwa esicetywayo kwaye abakasisebenzisi okwangoku. Elo qhekeza linjalo unyaka ongafakwanga; I-OpenSSL, i-OpenBSD, kunye ne-Debian zizenzele zona. Ukuba abaphuhlisi be-OpenSSL bengakhange basebenzise i-patch, bebengazukuqinisekisa ukuba bayekise inkxaso yabo ye-Visual C ++ 5.0 (C programmers can laugh) ngale mizekelo).
Ke balahle malunga ne-150 lamawaka emigca yekhowudi kunye nokubala, ngakumbi emva kokususa inkxaso ye-VMS, inkqubo ecekisekayo yokusebenza evaliweyo yeeseva ezigcinwa nguHewlett Packard. Ingathi i-X ithelekiswa ne-Wayland.
Okwangoku, ndikushiya nesiza I-OpenSSL iValhalla Rampage ngegalari eyoyikisayo ethi i-OpenBSD izame ukuyilungisa.
Enkosi kwezi foloko, isoftware efana neLibreOffice kunye neMariaDB ziye zanokhetho (kwiSlackware, bathathe indawo ye-MySQL noMariaDB, kwaye kuninzi lwee-distros, bonke bathathe indawo yeOpenOffice yabo neLibreOffice).
Kodwa ezo folokhwe kungenxa yokuba zazingafuni ukuba nesiphelo esifanayo ne-OpenSolaris ezandleni "zomnini" omtsha, yayiyimeko yesidingo esinyanzelekileyo, kwaye uninzi lwaluxhasa ngokukhawuleza enye indlela (enyanisweni ingabenzi bayo kodwa nge elinye igama). Oku kundibetha ngakumbi njengabantu abakwi-OpenBSD (Ndikunye noRaadt's Theo "iLinux yeyabalahlekileyo" kwi-helm) abonwabanga ngokungabandakanyi utshintsho lwabo. Ngeso sizathu kukho iFreeBSD, iNetBSD, kunye neOpenBSD.
Ndiyavumelana nawe 100%. Akunyanzelekanga ukuba ube krwada, okanye ube yintshatsheli.
Uxolo, into endiyicinga ngayo yayingu "Nikzon, weehemorrhoids."
Kuyabonakala ukuba namhlanje babandakanya isiqwenga sempikiswano.
https://rt.openssl.org/Ticket/Display.html?id=2167#txn-39826
NjengoFelipe, umhlobo kaMafalda wathi:
"Umyolelo kufuneka ube kuphela kwento ekuthi xa usonyuliwe, kufuneka uhlatyiwe."
Andiqondi ukuba irant ngale foloko, emva kwayo yonke le nto, le yindlela esebenza ngayo imithombo yoluntu, kunye neefolokhwe kunye nokudibana. Ngokuchasene noko, kuyandincoma ukuba bathathe isigqibo sokwenza iphakheji enkulu kangaka.
Andiyiyo ingcali kwi-OpenSSL, kodwa ngokwamanqaku amathathu akhankanywe nguDiazepan, oko kukuthi "Inkxaso yenkqubo evaliweyo ngokupheleleyo" (VMS), "Ikhowudi endala" (iVisual C ++ 5.0) "kunye" nokusilela kwenkxaso " , kubonakala kum ukuba ngekhe ibe ngenye indlela.
Kwaye ewe, ndithe ukunqongophala kwenkxaso, ukuba le ndawo ikhankanywe ngasentla ibandakanyiwe namhlanje, oko akuthethi ukuba ibingaphezulu konyaka kwizintlu zezicelo. Inyaniso yokuba i-OpenBSD, yenye yeenkqubo ezizinzileyo phaya, kungekuphela kuba yi-OpenBSD, kodwa nangenxa yokuba iyi-BSD, kwaye iDebian iyifakile koovimba bayo ibonisa ukuba yayingeyiyo indawo yokulinga, kodwa izinzile.
Ngelishwa i-Linux Foundation ayiboni ngaloo ndlela kwaye yabela imali i-OpenSSL, ethi, ngokwembono yam yimpazamo, kufuneka baxhase i-LibreSSL, into eqala phantse, ukuqala imikhwa emibi ye-OpenSSL, njengomzekelo malloc.