3 ms·

You first. What browser and OS are you posting from?

throwawaymaths 4y ago
If your server is in Erlang, it's probably dodged this (Erlang dodged heart bleed because it only uses ssl libs for cryptographic primitives)
speedgoose 4y ago
Not OS or browser but my SSH servers use Teleport and my HTTPS servers use Traefik or Caddy. Caddy, Traefik, and Teleport are written in Golang and not using OpenSSL. It’s a start.
- timdoug 4y ago
  I adore Go, but it seems to be impacted too: https://groups.google.com/g/golang-announce/c/dRtDK7WS78g https://groups.google.com/g/golang-announce/c/dRtDK7WS78g
  - woodruffw 4y ago
    This is almost certainly a different bug. I don't believe Go's standard library uses OpenSSL.
    - timdoug 4y ago
      You’re right re: implementation —- I’m drawing a conclusion solely from the coordinated disclosure that it’s a similar crypto/TLS issue. If the Go issues were distinct I’d imagine they’d choose a different day to disclose/release?
      - woodruffw 4y ago
        > If the Go issues were distinct I’d imagine they’d choose a different day to disclose/release? I think it's just a funny coincidence. That's going based on what I know about the OpenSSL one; I don't know anything about the Go one. We'll find out!
      - komuW 4y ago
        it's unrelated; https://news.ycombinator.com/item?id=33382369 https://news.ycombinator.com/item?id=33382369
    - deleted 4y ago
      [deleted]
  - speedgoose 4y ago
    Indeed, it doesn’t sound like a coincidence.
  - komuW 4y ago
    Filippo Valsorda(FiloSottile), who is the maintainer of Go's cryptography libraries said on Go's slack channel that the patch is unrelated. See screenshot of the slack conversation: https://paste.pics/f5622033ae711b36e0bbcda393a67866 https://paste.pics/f5622033ae711b36e0bbcda393a67866
tester756 4y ago
>You first. What browser and OS are you posting from? The ones that use Rust - Firefox and Windows
- formerly_proven 4y ago
  Firefox uses NSS for TLS, no?
- bradleyjg 4y ago
  Neither Firefox nor Windows are written wholly, or even substantially, in rust. I thought “we” were rejecting programs written in unsafe languages?
  - pjmlp 4y ago
    True, but outside the kernel Windows has enough infrastructure running in .NET code. Additionally even if C++ is unsafe, it is still better than plain old C, which since Vista has been the migration path from kernel code. Nowadays there are even template libraries that can be used on kernel and drivers like WIL. Finally the Microsoft Security Guidelines are: 1 - use managed languages if one can afford it 2 - use Rust 3 - use C++, alongside SAL and Core Guidelines checkers

If your server is in Erlang, it's probably dodged this (Erlang dodged heart bleed because it only uses ssl libs for cryptographic primitives)

speedgoose 4y ago

Not OS or browser but my SSH servers use Teleport and my HTTPS servers use Traefik or Caddy. Caddy, Traefik, and Teleport are written in Golang and not using OpenSSL. It’s a start.

timdoug 4y ago
I adore Go, but it seems to be impacted too: https://groups.google.com/g/golang-announce/c/dRtDK7WS78g https://groups.google.com/g/golang-announce/c/dRtDK7WS78g
- woodruffw 4y ago
  This is almost certainly a different bug. I don't believe Go's standard library uses OpenSSL.
  - timdoug 4y ago
    You’re right re: implementation —- I’m drawing a conclusion solely from the coordinated disclosure that it’s a similar crypto/TLS issue. If the Go issues were distinct I’d imagine they’d choose a different day to disclose/release?
    - woodruffw 4y ago
      > If the Go issues were distinct I’d imagine they’d choose a different day to disclose/release? I think it's just a funny coincidence. That's going based on what I know about the OpenSSL one; I don't know anything about the Go one. We'll find out!
    - komuW 4y ago
      it's unrelated; https://news.ycombinator.com/item?id=33382369 https://news.ycombinator.com/item?id=33382369
  - deleted 4y ago
    [deleted]
- speedgoose 4y ago
  Indeed, it doesn’t sound like a coincidence.
- komuW 4y ago
  Filippo Valsorda(FiloSottile), who is the maintainer of Go's cryptography libraries said on Go's slack channel that the patch is unrelated. See screenshot of the slack conversation: https://paste.pics/f5622033ae711b36e0bbcda393a67866 https://paste.pics/f5622033ae711b36e0bbcda393a67866

tester756 4y ago

>You first. What browser and OS are you posting from? The ones that use Rust - Firefox and Windows

formerly_proven 4y ago
Firefox uses NSS for TLS, no?
bradleyjg 4y ago
Neither Firefox nor Windows are written wholly, or even substantially, in rust. I thought “we” were rejecting programs written in unsafe languages?
- pjmlp 4y ago
  True, but outside the kernel Windows has enough infrastructure running in .NET code. Additionally even if C++ is unsafe, it is still better than plain old C, which since Vista has been the migration path from kernel code. Nowadays there are even template libraries that can be used on kernel and drivers like WIL. Finally the Microsoft Security Guidelines are: 1 - use managed languages if one can afford it 2 - use Rust 3 - use C++, alongside SAL and Core Guidelines checkers