4 ms·
Can someone explain how bad this is in multiples of Heartbleed? Any big time automated processes with decades of dubious history now, etc?
by jchanimal 8y ago
Can someone explain how bad this is in multiples of Heartbleed? Any big time automated processes with decades of dubious history now, etc?
- kingofhdds 8y agoThe attack can only succeed when victim's gpg is run with 'verbose' option turned on. Which is rather unusual situation.
- jerf 8y agoIt's difficult to be precise, but I'd bid it out as a minimum of 6 orders of magnitude less, and if someone wanted to bid out 8 or 9 I wouldn't fight them. It's not a zero-impact issue, but there's so many differences between this and Heartbleed that it just can't be that large. For one thing, there's several orders of magnitude fewer users of GPG than SSL. Then you need a vulnerable configuration. Then you need to have been exploited. Those three things multiply out to quite a few orders of magnitude.
- jcranmer 8y agoApproximately 0 Heartbleeds. A Heartbleed-level vulnerability means "everyone is vulnerable, exploitation is trivial, consequences of exploitation are severe" so therefore you need to a) update yesterday and b) assume that the fact you haven't updated yet (because you just found out) means you've already been screwed. These kind of bugs are very rare, and the only comparable one I can think of is Debian's OpenSSL bug.