Comment by nope1000
12 hours ago
I like to be AI sceptical as well but I think it's even more noticeable if the flaw is in 20 year old code which thousands of people have read and reviewed and not noticed, isn't it?
12 hours ago
I like to be AI sceptical as well but I think it's even more noticeable if the flaw is in 20 year old code which thousands of people have read and reviewed and not noticed, isn't it?
Hardly anyone reads and reviews in open source. It is a myth from ESR. Probably one person wrote it and another one said LGTM.
Today ESR would say "All bugs are really shallow this time, thanks to our robot friends!"
The recent signed keys being '4' is an example.
Looks good, validates, works, and then trust is assumed.
Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.
It was assumed the private keys were private, not easily figureoutable, so they were most likely never tested.