Upstream was involved in it as well. Sure it was a communication problem, but it's not like the maintainer just decided to this unilaterally. Also this WAS undefined behaviour, so from a language perspective it was already broken, even if it worked accidentally in practice.
One that mixed uninitialised data to the entropy pool.
And another one that mixed initialised data to the entropy pool with the exact same function call. Which was, in fact, almost all of the entropy.
I don't think its wise to make current security decisions based on screw ups from almost 2 decades ago.
I don't really care one way or another. I use Linux and I use macOS. But I'm not naive to think the security is any better in one or the other.
Do you use macOS? Because if you did, then how did you recover from them allowing anyone to straight-up log in as root without password? And then mess up the fix for that bug? That wasn't 2008, that was 8 years ago.
Then as it has been 2 decades you should be all good right?
I don't see the point of being so fixated on that.
If that's the worst you have against Linux then it looks like it has done very well.
And not just GMail, this was virtually every service out there. From a perspective, it's laughable how bad security was back then.
Morality doesn't solely depend on action or inaction, it also matter what you act or don't act to.
Besides, how does this relate to my Linux point, where no one installs anything without you knowing it?
How is that worse than NOT having any sort of fix from Apple?