Attempts to belittle the "eyeballs on the code" motto

Summary: Another week brings another set of bugfixes, which some choose to characterise as a very big deal despite evidence to the contrary

WHEN one has an agenda one can accentuate a particular side by covering it excessively. To be frank, not only FOSS-hostile circles are to be blamed for security hype; even some FOSS-friendly sites are releasing articles like "Linux Malware And Antivirus" or cover every security fix as though it's major news. Consider just the past few days in Softpedia: A Steam OS bugfix is news and the same goes for Ubuntu because these projects make attractive headlines, especially after the whole "Heartbleed" hype [1, 2, 3]. Guess who was behind it: the firm of Microsoft's 'Former' Security Chief. GnuTLS was subjected to the same treatment by the same Microsoft-connected firm because like any project it has bugfixes [1, 2], never mind the real security issues (back doors in proprietary software like Windows).

Amid some of the latest reports from Microsoft-friendly sources and FOSS-friendly sources like SJVN (we cited two of these articles before) we should keep in mind that not all bugs are created equal and if we let every bugfix in a project like Linux or OpenSSL become major news, then we will lose sight of the real issue, which is proprietary software having bugs by design, to facilitate intrusion.

Kevin Poulsen, who did some Wikileaks-hostile coverage back in the days, correctly points out that "After Heartbleed, We’re Overreacting to Bugs That Aren’t a Big Deal". Here is how his article begins:

Here’s something else to blame on last April’s Heartbleed security bug: It smeared the line between security holes that users can do something about, and those we can’t. Getting that distinction right is going to be crucial as we weather a storm of vulnerabilities and hacks that shows no sign of abating.

Last week the OpenSSL Foundation announced it was patching six newly discovered vulnerabilities in the same software that Heartbleed lived in. The first reaction from many of us was a groan–here we go again. Heartbleed triggered what was probably the single largest mass-password change in history: In response to the bug, some 86 million internet users in the U.S. alone changed at least one password or deleted an internet account. The thought of a repeat was (and is) shudder-inducing.

Be aware that there's a disturbing trend right now, where so-called 'security' firms (opportunists/attention whores) or media companies try to exploit general security paranoia (or privacy concerns) to 'sell' us stories about 'gaping holes'; the reality is usually just some routine bugfixes, wrapped up by those who have agenda. Dan Goodin and the Microsoft-connected firm (which even branded a bug) are some of the worst in this regard. ⬆