I haven't seen it anywhere, has he been identified? Gotta think this is the kind of thing that can follow a guy around.
> I haven't seen it anywhere, has he been identified? Gotta think this is the kind of thing that can follow a guy around.
I think I saw a name (or names) associated with the error, which was made at Debian. Maybe on the original Slashdot post a couple weeks ago. But the responsibility actually extends farther within the Debian group than just that programmer.
That individual was responding to automated "bug-identification" software, which flagged things like reading uninitialized memory locations. Well, hell, that's a randomizing variable! But the programmer, not understanding the point of the code (good lord), eager to get the code to compile without warnings, COMMENTED OUT the randomizing lines, leaving in only the one that used the current process-id, which is 0-32767.
A larger problem was that his/her group at Debian apparently approved the changes! So there's plenty of poop to pass around.
Overall, the apparent feud between Debian and the other Open Source (OpenSSL) folks, in which Debian personnel refuse to communicate with original authors when changing code, is the most responsible aspect. That's just stupid, stupid, stupid -- and completely avoidable.
Note that I'm not personally involved in any of those projects; so not only don't I have an axe to grind, but all the above is 3rd-hand. So there could be errors in my re-telling.