6 ms·

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewher

by nodata 13y ago

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewhere. Edit: "masterful communication" this is not, since the reader doesn't know who the page is aimed at. Even a line at the top saying "Technical people go _here_", and then something aimed at technical people would be better.

jmathai 13y ago
But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it. That's an enormous win.
- teacup50 13y ago
  > That's an enormous win. Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. A problem we used to have, however, is people engaging in grandstanding and irresponsible disclosure, leaving users insecure and catching the industry flat-footed. Empty scare marketing is a solution to a problem we don't have. It's also a great tool for self-advertisement, and I can only assume that's why patio11 jumped on it.
  - anigbrowl 13y ago
    Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I refer you back to this recent article, which was also discussed extensively here: http://arstechnica.com/security/2014/03/ancient-linux-servers-the-blighted-slum-houses-of-the-internet/ http://arstechnica.com/security/2014/03/ancient-linux-server... 'Our industry' is not just the parts people are proud of, it includes a multide of craptacular bit players that nevertheless participate in the information economy.
  - jmathai 13y ago
    > Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I probably don't agree with that. I think there are plenty of systems in our industry that aren't actively maintained and don't have dedicated ops to manage them. A fix to a bug this large in magnitude needs to find their way onto those systems.
- computer 13y ago
  He did because this is the worst internet bug in the past 10 years, not because the page was so masterfully written. Private keys and user passwords/data being disclosed will be cared about by systems administrators even without such a fancy page.
  - jmathai 13y ago
    That's my point. Systems administrators will fix security bugs regardless. So there's not really any negative impact on how Heartbleed was "marketed" besides making their job a little bit harder. I think that cost is outweighed by the significant increase in exposure. I'm not saying to make it difficult for people to understand the root cause. We should strive for both. But if I had to choose one over the other I think for a bug this big that marketing it as such wins. The long tail.
    - tptacek 13y ago
      Systems administrators WILL NOT invariably fix security bugs no matter what. They'll apply patches as they are made conveniently available, and during maintenance windows. This bug demanded a faster remediation, and a more consistent one, than most bugs do. Normally, to get out of the standard sysadmin patch rut and into an expedited state, your bug needs to convincingly cough up code execution. Since this bug didn't do that, but was nonetheless very severe, it makes perfect sense to me that additional marketing was required to expedite fixes.
  - tptacek 13y ago
    It is not the worst Internet bug in the past 10 years. It's among the most widespread Internet bugs, but: * An identical bug impacted nginx a few years ago * A far worse bug impacted Debian (when they commented out the randomness in their CSPRNG), which coughed up code execution on tens of thousands of machines; lots of companies that didn't officially deploy on Debian still had a Debian box somewhere vulnerable * The Rails YAML bug was perniciously exposed in lots of places for months after the initial disclosure, and also coughed up code execution Losing authenticators for "live" users and TLS private keys is bad, but it's not the kind of bad where you invariably need to nuke your servers from orbit and rebuild. Other widespread bugs were actually like that.
jdubs 13y ago
"I know this is bad... but what exactly is broken... oh." I think this is a case where the message could have been more concise.
- cdelsolar 13y ago
  I agree. I saw the Heartbleed page while surfing HN, clicked through, saw something long with no TL;DR in red: THIS IS THE WORST SECURITY BUG IN MANY YEARS, AND YOUR SERVER IS VERY LIKELY AFFECTED, and ignored it for a couple of hours until I started seeing more and more posts about it.
valarauca1 13y ago
The announcement isn't for technical folks. If you want to know the in depth details then you likely have no issue referring to bugs as numbers, or reading up on the technical details of the exploit. When you announce something you give the information in a form that the public can understand. For example if I announce a new processor, I'll announce its clock speed, number of cores. If I feel like getting in depth cache levels, and bus speed. A technical person will still have a million questions. But my announcement isn't for them, its for the lowest common denominator of people who care. Often times who have no clue of every technical aspect. Only the most simplistic understanding of the topic, if any at all.
- teacup50 13y ago
  > The announcement isn't for technical folks. It's not for non-technical folks, either, because there's nothing they can possibly do other than be confused. It's empty self-promoting marketing that sent the entire industry scrambling.
  - patio11 13y ago
    Any result other than "the entire industry scrambling" following the public disclosure of Heartbleed would have been a failure case. How do you imagine that working out? "We need to patch millions of servers managed by hundreds of thousands of people. It all needs to happen today, and be conducted in total secrecy, because if any bad guy finds out about what we're doing there will bet net-wide exploitation by botnets running trivial PoC code within 30 minutes. But no need to scramble, nah, let's do this with due deliberation."
    - teacup50 13y ago
      You're demonstrating no understanding of how these things work. For updates to be deployed, the patches need to be integrated, tested, packages/updates build, and the update mechanisms tested. For complex systems -- like, say, embedded hardware -- this might involve targeting quite a few different devices and testing matrixes. Even scrambling, this can take days, and leaves users blowing in the wind in the meantime. This is why we have coordination with vendors PRIOR to public release, such that when the vulnerability is publicly disclosed, updates are available through standard update pipelines, the process is documented, and the update is known to be correct and not introduce deployment regressions. A vulnerability of this severity needed no marketing. Grandstanding for non-technical users simply increased the likelihood that they'd be exploited while vendors rushed out fixes.
joshdance 13y ago
Where? And if Heartbleed took to long to figure out, how long did it take to decipher other security vulnerabilities? Don't compare it to a landing page of a consumer service, compare it to most other OSS announcements and projects.

by nodata 13y ago

jmathai 13y ago

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it. That's an enormous win.

teacup50 13y ago
> That's an enormous win. Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. A problem we used to have, however, is people engaging in grandstanding and irresponsible disclosure, leaving users insecure and catching the industry flat-footed. Empty scare marketing is a solution to a problem we don't have. It's also a great tool for self-advertisement, and I can only assume that's why patio11 jumped on it.
- anigbrowl 13y ago
  Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I refer you back to this recent article, which was also discussed extensively here: http://arstechnica.com/security/2014/03/ancient-linux-servers-the-blighted-slum-houses-of-the-internet/ http://arstechnica.com/security/2014/03/ancient-linux-server... 'Our industry' is not just the parts people are proud of, it includes a multide of craptacular bit players that nevertheless participate in the information economy.
- jmathai 13y ago
  > Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I probably don't agree with that. I think there are plenty of systems in our industry that aren't actively maintained and don't have dedicated ops to manage them. A fix to a bug this large in magnitude needs to find their way onto those systems.
computer 13y ago
He did because this is the worst internet bug in the past 10 years, not because the page was so masterfully written. Private keys and user passwords/data being disclosed will be cared about by systems administrators even without such a fancy page.
- jmathai 13y ago
  That's my point. Systems administrators will fix security bugs regardless. So there's not really any negative impact on how Heartbleed was "marketed" besides making their job a little bit harder. I think that cost is outweighed by the significant increase in exposure. I'm not saying to make it difficult for people to understand the root cause. We should strive for both. But if I had to choose one over the other I think for a bug this big that marketing it as such wins. The long tail.
  - tptacek 13y ago
    Systems administrators WILL NOT invariably fix security bugs no matter what. They'll apply patches as they are made conveniently available, and during maintenance windows. This bug demanded a faster remediation, and a more consistent one, than most bugs do. Normally, to get out of the standard sysadmin patch rut and into an expedited state, your bug needs to convincingly cough up code execution. Since this bug didn't do that, but was nonetheless very severe, it makes perfect sense to me that additional marketing was required to expedite fixes.
- tptacek 13y ago
  It is not the worst Internet bug in the past 10 years. It's among the most widespread Internet bugs, but: * An identical bug impacted nginx a few years ago * A far worse bug impacted Debian (when they commented out the randomness in their CSPRNG), which coughed up code execution on tens of thousands of machines; lots of companies that didn't officially deploy on Debian still had a Debian box somewhere vulnerable * The Rails YAML bug was perniciously exposed in lots of places for months after the initial disclosure, and also coughed up code execution Losing authenticators for "live" users and TLS private keys is bad, but it's not the kind of bad where you invariably need to nuke your servers from orbit and rebuild. Other widespread bugs were actually like that.

jdubs 13y ago

"I know this is bad... but what exactly is broken... oh." I think this is a case where the message could have been more concise.

cdelsolar 13y ago
I agree. I saw the Heartbleed page while surfing HN, clicked through, saw something long with no TL;DR in red: THIS IS THE WORST SECURITY BUG IN MANY YEARS, AND YOUR SERVER IS VERY LIKELY AFFECTED, and ignored it for a couple of hours until I started seeing more and more posts about it.

valarauca1 13y ago

The announcement isn't for technical folks. If you want to know the in depth details then you likely have no issue referring to bugs as numbers, or reading up on the technical details of the exploit. When you announce something you give the information in a form that the public can understand. For example if I announce a new processor, I'll announce its clock speed, number of cores. If I feel like getting in depth cache levels, and bus speed. A technical person will still have a million questions. But my announcement isn't for them, its for the lowest common denominator of people who care. Often times who have no clue of every technical aspect. Only the most simplistic understanding of the topic, if any at all.

teacup50 13y ago
> The announcement isn't for technical folks. It's not for non-technical folks, either, because there's nothing they can possibly do other than be confused. It's empty self-promoting marketing that sent the entire industry scrambling.
- patio11 13y ago
  Any result other than "the entire industry scrambling" following the public disclosure of Heartbleed would have been a failure case. How do you imagine that working out? "We need to patch millions of servers managed by hundreds of thousands of people. It all needs to happen today, and be conducted in total secrecy, because if any bad guy finds out about what we're doing there will bet net-wide exploitation by botnets running trivial PoC code within 30 minutes. But no need to scramble, nah, let's do this with due deliberation."
  - teacup50 13y ago
    You're demonstrating no understanding of how these things work. For updates to be deployed, the patches need to be integrated, tested, packages/updates build, and the update mechanisms tested. For complex systems -- like, say, embedded hardware -- this might involve targeting quite a few different devices and testing matrixes. Even scrambling, this can take days, and leaves users blowing in the wind in the meantime. This is why we have coordination with vendors PRIOR to public release, such that when the vulnerability is publicly disclosed, updates are available through standard update pipelines, the process is documented, and the update is known to be correct and not introduce deployment regressions. A vulnerability of this severity needed no marketing. Grandstanding for non-technical users simply increased the likelihood that they'd be exploited while vendors rushed out fixes.

joshdance 13y ago

Where? And if Heartbleed took to long to figure out, how long did it take to decipher other security vulnerabilities? Don't compare it to a landing page of a consumer service, compare it to most other OSS announcements and projects.