5 ms·
I think we can agree that there is a happy medium between the slow and risky process of notifying every single organization, and only one SSL terminator "in the
by chomp 13y ago
I think we can agree that there is a happy medium between the slow and risky process of notifying every single organization, and only one SSL terminator "in the know".
The logistics of disclosure for something as ground breaking as this are probably very difficult.
I suppose the details are still sketchy at this point, but I have no idea how CloudFlare received a week's notice, and no one more important[1] knew of it until it was publicized. CloudFlare being the special group makes me suspicious of how it all went down.
[1] I'm not picking on CloudFlare, they have a huge footprint on the internet.
- 0x0 13y agoApparently Akamai was also given early notice, from the OpenSSL team. https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-systems-patched.html https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-syste... I wonder why the various linux distros like debian could not have been notified simultaneously.
- jessaustin 13y agoHas distro notification caused problems in the past? E.g. patches posted early, emails forwarded, public discussion, etc.?
- danielweber 13y agoNo advance channel set up? This stuff is always tricky, and I admittedly have a strong adverse reaction to the "just blow everything open, it will be lulzy when the web breaks" attitude. To be on such a list you also need to have a positive prior record demonstrating your ability to keep your mouth shut, which is hard to prove.