CAcert System Admins discussion list

[Philipp Gühring <pg AT futureware.at>]

Hi,

> Agree with Pat. It was a stupidity of Debian distro commenting out and
> decreasing the quality of key generation below acceptable level (and the
> believe of engineers around the person who did it that he was doing ok:-(
> ). The problem is does one believe a distribution? (OpenSSL as such was not
> failing). 

I would say that the quality control inside OpenSSL failed.

> It is risk management nothing more. 

It's missing quality control.

> Answer probably to my  
> question is yes: Debian is accepted and qualified and the world used
> experts to control it (and we will fail and learn).
> The question arises: which of the open source distro's ("assemblies" of
> OSS) do quality assessment on themselves? (I guess that even probably eg
> IBM is not doing it?).

> Is it a failure that CAcert did not detected it?

Yes. We tested OpenSSL on SUSE for that problem (1-3 years ago), and decided 
not to test OpenSSL on every distribution, on every processor architecture, 
on every system configuration, with every minor version and patch, 
hoping that testing OpenSSL itself would be enough.
(But it might be that we did the tests before OpenSSL introduced the bug. 
I'll 
have to review the logs, when I have time for that)


Best regards,
Philipp Gühring