Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

Late yesterday we learned that a two-thirds of the world’s websites have a major security vulnerability that could be used to crack encrypted connections and steal user passwords or a company’s encryption keys. The news set system administrators for the estimated 117,000 servers affected (including at major companies like Yahoo) scrambling to roll out a fix. It is also leading some people to ponder why the widely-used software in which the critical bug was found doesn’t get better support.

The Heartbleed bug, as it is known, is a small flaw in a version of an open source package called OpenSSL. It’s used by Web servers to offer encrypted “TLS” connections that appear to users as a padlock and “HTTPS” prefix in a browser’s address bar and are used to protect online banking and other private communications.

There are alternatives to OpenSSL but it is by far the most widely used software for the job. Most websites use it to protect their data and that of their users. Yet the OpenSSL project is mostly run by volunteers. It relies on donations and unlike some other open source project has no corporate sponsors.

It’s impossible to say if more funding would have prevented the Heartbleed bug. But some security experts see the incident as a reminder that what is essentially a critical part of the Web’s infrastructure seems to lack appropriate support from those who rely on it.

Christopher Soghoian, a privacy researcher at the ACLU, suggests that government support might be appropriate:

 

 

Cryptography professor Matthew Green of Johns Hopkins University came to similar conclusions in his blog post explaining the attack:

“The OpenSSL developers have a pretty amazing record considering the amount of use this library gets and the quantity of legacy cruft and the number of platforms (over eighty!) they have to support. Maybe in the midst of patching their servers, some of the big companies that use OpenSSL will think of tossing them some real no-strings-attached funding so they can keep doing their job.”

Others in the security industry argue that OpenSSL’s design has become outdated and a ground-up replacement is needed. Either way, the chaos – and hazards – created by the Heartbleed bug make a good case for Web companies or even governments to put up the funds to keep basic components of online security like OpenSSL secure.

1 comment. Share your thoughts »

Credit: Credit: Codenomicon

Tagged: Web

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me
×

A Place of Inspiration

Understand the technologies that are changing business and driving the new global economy.

September 23-25, 2014
Register »