A New Round Of OpenSSL Vulnerabilities Discovered

[libv]

So, can we put to bad the argument of "OSS is by nature more secure" argument now?

Have you ever looked at BIOS code? Because if you had, that would've told you that at the other end of the openness spectrum things are unbelievably broken.

Proprietary software will be somewhere between open source and BIOS code.

Also, have you ever looked at vendor driver code?

If you had done any of those two above, you would never have dared state what you just stated.

[MannerMan]

... HPSB (Hewlet-Packard Security Bulletins) are comming!

Last time (Heartbleed) i counted 66 on bugtraq

Haha, classic

[Awesomeness]

So, can we put to bad the argument of "OSS is by nature more secure" argument now?

So you'd say a proprietary tls implementation would fix such bugs earlier?

[erendorn]

So, can we put to bad the argument of "OSS is by nature more secure" argument now?

A closed source project with as many developer as OpenSSL (ie, very small project), would never have ended up in as much machines as OpenSSL did, even if it was free. Mostly because it would be neither auditable nor accountable, in other word, in a sense, too insecure.
As such, it's quite difficult to reach a comparative conclusions when comparable non-OSS projects don't exist.

[Apopas]

So, can we put to bad the argument of "OSS is by nature more secure" argument now?

Not at all.
If so many vulnerabilities are to be found in an open piece of software like openssl, I do not dare to think what happens in the heart of a proprietary package...

[gamerk2]

So, can we put to bad the argument of "OSS is by nature more secure" argument now?

[DanL]

I wonder how long the NSA has known about these...

[arabek]

Brace yourself

... HPSB (Hewlet-Packard Security Bulletins) are comming!

Last time (Heartbleed) i counted 66 on bugtraq

[phoronix]

Phoronix: A New Round Of OpenSSL Vulnerabilities Discovered

Further fallout from the Heartbleed bug has occurred with another set of security vulnerabilities now being disclosed for OpenSSL...

http://www.phoronix.com/vr.php?view=MTcxMTI