On Debian OpenSSL problem DSA-1571-1

It is sad what happened to Debian OpenSSL leaving all keys weak (DSA-1571-1 openssl -- predictable random number generator) (Slashdot | Debian Bug Leaves Private SSL/SSH Keys Guessable).

When I started using Valgrind long time ago and Valgrind warning about it, I knew something like this could happen.

To detect weak keys, all the keys to take advantage of this problem are already available: Debian OpenSSL Predictable PRNG Toys.

Open source software is getting lots of momentum and it needs software changes reviewing to prevent this kind of things happening. The Linux kernel has mostly good reviewing by having each patch needing review from at least two developers, one of the module maintainers and a core Linux developer (Introduction to Linux kernel development process).

On SQL Injection

SQL injection is sadly still a very common problem. Software broadly deployed like WordPress still has SQL Injection Vulnerabilities because instead of using prepared statements in PHP with MDB2 they encode the parameters they think that could be used in a SQL injection. I really think that is not the way to go and I suggest to everyone using prepared statements (java). Also, many SQL servers like MySQL have support for prepared statements, so it may even speed up the application. To force you to use prepared statements and clean your application from unsafe SQL some databases, like H2, allow you to disable literals in SQL statements.

Using object-relational mapping solutions like Java Persistence API/Hibernate can ease programming to prevent SQL injection because most INSERT, UPDATE, DELETE takes care the ORM directly. You still have to use setParameter in SELECT.

On cryptographic hash functions

Now that MD5 is considered too weak for most uses, it is time to look at other cryptographic hash functions like Whirlpool (it is even an ISO standard). We should be reviewing most software and protocols to stop generating MD5 hashes and use some of the currently recommended alternative hash functions like Whirlpool. Even the NIST has started a process to find a new secure hash function (the same process they did with AES).