A Black Eye For Debian

News of a massive security hole in the Debian distribution of Linux has dropped jaws everywhere, mine included.  It's the sort of thing that speaks very badly indeed for the way Debian does code review -- exactly what's required urgently for open source to work well.

The problem involves Debian's version of the openssl package, which was changed back in 2006 in such a way that the encryption keys generated by the package could theoretically be guessed by an attacker.  Bad.  But what's worse, every encryption key generated with that edition of openssl since the change was made -- since 2006 -- now has to be dumped.  (Instructions on how to replace compromised keys are forthcoming.)

This is a huge mess, to put it mildly.  Debian's one of the most broadly used distributions out there, and many other distributions -- Ubuntu, just to name one -- are built from it.  And anyone who's built a derivative distribution from Debian will have almost certainly inherited this problem.  The most staggering thing is that this particular change took upwards of two years to get flagged, during which time who knows how many potentially weak encryption keys have been generated and now have to be junked.

This all involves something people who are critical of open source single out, quite rightfully, as a problem with the process: just because the code is out there for review doesn't mean it's automatically going to get looked at.  It also has to be looked at in a timely fashion by people who know what to look for, and who are in a position to do something about it -- and the changes have to be accepted by the people responsible for the code.

In short, just making source available for review is barely even the first step toward making open source a viable methodology.  And it says nothing about the people involved -- about how trustworthy they are, what their work habits or pedigree for code review are like, and so on.  These things don't come automatically.

I should emphasize that if this problem had happened with a closed source product, there's a fair chance it might only have surfaced in the form of a key exploit tool for hackers.  At least here the problem was discovered in the right place: in the source itself.  But I'm hoping Debian takes this kind of thing as hard evidence that just being "open" isn't in and of itself enough.  And I also hope this isn't just the tip of a very pointy iceberg.