Late yesterday we learned that a two-thirds of the world’s websites have a major security vulnerability that could be used to crack encrypted connections and steal user passwords or a company’s encryption keys. The news set system administrators for the estimated 117,000 servers affected (including at major companies like Yahoo) scrambling to roll out a fix. It is also leading some people to ponder why the widely-used software in which the critical bug was found doesn’t get better support.
The Heartbleed bug, as it is known, is a small flaw in a version of an open source package called OpenSSL. It’s used by Web servers to offer encrypted “TLS” connections that appear to users as a padlock and “HTTPS” prefix in a browser’s address bar and are used to protect online banking and other private communications.
There are alternatives to OpenSSL but it is by far the most widely used software for the job. Most websites use it to protect their data and that of their users. Yet the OpenSSL project is mostly run by volunteers. It relies on donations and unlike some other open source project has no corporate sponsors.
It’s impossible to say if more funding would have prevented the Heartbleed bug. But some security experts see the incident as a reminder that what is essentially a critical part of the Web’s infrastructure seems to lack appropriate support from those who rely on it.
Christopher Soghoian, a privacy researcher at the ACLU, suggests that government support might be appropriate:
The US gov spends billions on cybersecurity. Why isn’t any of that spent improving core software libs like OpenSSL, which we all depend on.— Christopher Soghoian (@csoghoian) April 8, 2014
Cryptography professor Matthew Green of Johns Hopkins University came to similar conclusions in his blog post explaining the attack:
“The OpenSSL developers have a pretty amazing record considering the amount of use this library gets and the quantity of legacy cruft and the number of platforms (over eighty!) they have to support. Maybe in the midst of patching their servers, some of the big companies that use OpenSSL will think of tossing them some real no-strings-attached funding so they can keep doing their job.”
Others in the security industry argue that OpenSSL’s design has become outdated and a ground-up replacement is needed. Either way, the chaos – and hazards – created by the Heartbleed bug make a good case for Web companies or even governments to put up the funds to keep basic components of online security like OpenSSL secure.
A gene-edited pig’s heart has been transplanted into a human for the first time
The procedure is a one-off, and highly experimental, but the technique could help reduce transplant waiting lists in the future.
A horrifying new AI app swaps women into porn videos with a click
Deepfake researchers have long feared the day this would arrive.
The worst technology of 2021
Face filters, billionaires in space, and home-buying algorithms that overpay all made our annual list of technology gone wrong.
The metaverse has a groping problem already
A woman was sexually harassed on Meta’s VR social media platform. She’s not the first—and won’t be the last.
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.