dive into mark

Yesterday: SSL defeated in IE and Konqueror.

Today: KDE smokes MS in SSL bug fix.

SSL, we should point out, is one of the most important consumer security protocols in use on the Web. It’s what makes your credit card transactions with pr0n sites appear safe. It’s what persuades you that sensitive personal data which you entrust to a Web site is a secret between you and them. Only it’s broken. Mozilla isn’t affected; Opera (on Windows, at least) is fixed as of today; Konqueror is vulnerable but [the patch has been checked into CVS and] will be fully patched by Monday or Tuesday, and IE is vulnerable and in Limbo while MS tries to figure out how to explain it to the teeming millions who trust their products, in preparation for eventually fixing it. But the spin comes first. That’s the meaning of Trustworthy Computing.

§

Respond privately

I am no longer accepting public comments on this post, but you can use this form to contact me privately. (Your message will not be published.)

§