Slashdot Mirror

← Back to Stories (view on slashdot.org)

13-Year-Old Password Security Bug Fixed

Posted by timothy on from the not-13-year-old's dept.

arglebargle_xiv writes "In a sign that many eyes don't really make (security) bugs shallow, a thirteen-year-old password-hashing bug that affects (at least) PHP, some Linux distros (Owl, ALT Linux, SUSE), and a variety of other apps has just been patched. This problem had been present in widely-used code since 1998 without anyone noticing it." Better late than never; reader Trailrunner7 points to this article outlining the dangers of old exploits, given old code for them to toy with.

3 of 130 comments (clear)

  1. Re:At least it was fixed by LordLucless · · Score: 4, Insightful

    Uh-huh. Because "In a sign that many eyes don't really make (security) bugs shallow" is such an unbiased opening for the story.

    --
    Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
  2. Re:At least it was fixed by Anonymous Coward · · Score: 4, Insightful

    And why is that not a reasonable opening for the summary?

    Isn't the 13 year existence of a security bug in open source code a valid argument that open source does not really mean a product is more secure?

    The correct answer for what makes a product secure: Proper coding practices combined with proper configuration.

    IMO, Apache is certainly a better choice for a web server, but my opinion is not based on that fact that it is open source and instead based on the fact that it is actually more secure than IIS. Apache appears to be less often compromised, therefore I trust it more. However, if IIS one day holds the mantle of least compromised, then I will certainly consider it (I'm holding my breath though).

  3. Re:Come on, it's PHP by Firehed · · Score: 4, Insightful

    To be fair, it's hardly PHP's fault that the shared library's implementation was broken. The primary benefits of using a library (not reinventing the wheel, wisdom of many, etc.) are generally outweighed by occasionally inheriting one of their bugs. Especially since you also inherit their bugfixes. While the core PHP team is actually quite well accomplished at security (even if PHP enables any idiot to make insecure sites by virtue of being easy to learn), I'd still rather them use widely adopted libraries than come up with their own implementation.

    --
    How are sites slashdotted when nobody reads TFAs?