4 ms·

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in

by jmathai 13y ago

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it. That's an enormous win.

teacup50 13y ago
> That's an enormous win. Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. A problem we used to have, however, is people engaging in grandstanding and irresponsible disclosure, leaving users insecure and catching the industry flat-footed. Empty scare marketing is a solution to a problem we don't have. It's also a great tool for self-advertisement, and I can only assume that's why patio11 jumped on it.
- anigbrowl 13y ago
  Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I refer you back to this recent article, which was also discussed extensively here: http://arstechnica.com/security/2014/03/ancient-linux-servers-the-blighted-slum-houses-of-the-internet/ http://arstechnica.com/security/2014/03/ancient-linux-server... 'Our industry' is not just the parts people are proud of, it includes a multide of craptacular bit players that nevertheless participate in the information economy.
- jmathai 13y ago
  > Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I probably don't agree with that. I think there are plenty of systems in our industry that aren't actively maintained and don't have dedicated ops to manage them. A fix to a bug this large in magnitude needs to find their way onto those systems.
computer 13y ago
He did because this is the worst internet bug in the past 10 years, not because the page was so masterfully written. Private keys and user passwords/data being disclosed will be cared about by systems administrators even without such a fancy page.
- jmathai 13y ago
  That's my point. Systems administrators will fix security bugs regardless. So there's not really any negative impact on how Heartbleed was "marketed" besides making their job a little bit harder. I think that cost is outweighed by the significant increase in exposure. I'm not saying to make it difficult for people to understand the root cause. We should strive for both. But if I had to choose one over the other I think for a bug this big that marketing it as such wins. The long tail.
  - tptacek 13y ago
    Systems administrators WILL NOT invariably fix security bugs no matter what. They'll apply patches as they are made conveniently available, and during maintenance windows. This bug demanded a faster remediation, and a more consistent one, than most bugs do. Normally, to get out of the standard sysadmin patch rut and into an expedited state, your bug needs to convincingly cough up code execution. Since this bug didn't do that, but was nonetheless very severe, it makes perfect sense to me that additional marketing was required to expedite fixes.
- tptacek 13y ago
  It is not the worst Internet bug in the past 10 years. It's among the most widespread Internet bugs, but: * An identical bug impacted nginx a few years ago * A far worse bug impacted Debian (when they commented out the randomness in their CSPRNG), which coughed up code execution on tens of thousands of machines; lots of companies that didn't officially deploy on Debian still had a Debian box somewhere vulnerable * The Rails YAML bug was perniciously exposed in lots of places for months after the initial disclosure, and also coughed up code execution Losing authenticators for "live" users and TLS private keys is bad, but it's not the kind of bad where you invariably need to nuke your servers from orbit and rebuild. Other widespread bugs were actually like that.
  - cdelsolar 13y ago
    This bug is on 70% of systems and ANYONE can run a python script and pull out plaintext Paypal or bank passwords. It is the worst Internet bug perhaps ever.

by jmathai 13y ago

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it. That's an enormous win.

teacup50 13y ago

> That's an enormous win. Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. A problem we used to have, however, is people engaging in grandstanding and irresponsible disclosure, leaving users insecure and catching the industry flat-footed. Empty scare marketing is a solution to a problem we don't have. It's also a great tool for self-advertisement, and I can only assume that's why patio11 jumped on it.

anigbrowl 13y ago
Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I refer you back to this recent article, which was also discussed extensively here: http://arstechnica.com/security/2014/03/ancient-linux-servers-the-blighted-slum-houses-of-the-internet/ http://arstechnica.com/security/2014/03/ancient-linux-server... 'Our industry' is not just the parts people are proud of, it includes a multide of craptacular bit players that nevertheless participate in the information economy.
jmathai 13y ago
> Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has. I probably don't agree with that. I think there are plenty of systems in our industry that aren't actively maintained and don't have dedicated ops to manage them. A fix to a bug this large in magnitude needs to find their way onto those systems.

computer 13y ago

He did because this is the worst internet bug in the past 10 years, not because the page was so masterfully written. Private keys and user passwords/data being disclosed will be cared about by systems administrators even without such a fancy page.

jmathai 13y ago
That's my point. Systems administrators will fix security bugs regardless. So there's not really any negative impact on how Heartbleed was "marketed" besides making their job a little bit harder. I think that cost is outweighed by the significant increase in exposure. I'm not saying to make it difficult for people to understand the root cause. We should strive for both. But if I had to choose one over the other I think for a bug this big that marketing it as such wins. The long tail.
- tptacek 13y ago
  Systems administrators WILL NOT invariably fix security bugs no matter what. They'll apply patches as they are made conveniently available, and during maintenance windows. This bug demanded a faster remediation, and a more consistent one, than most bugs do. Normally, to get out of the standard sysadmin patch rut and into an expedited state, your bug needs to convincingly cough up code execution. Since this bug didn't do that, but was nonetheless very severe, it makes perfect sense to me that additional marketing was required to expedite fixes.
tptacek 13y ago
It is not the worst Internet bug in the past 10 years. It's among the most widespread Internet bugs, but: * An identical bug impacted nginx a few years ago * A far worse bug impacted Debian (when they commented out the randomness in their CSPRNG), which coughed up code execution on tens of thousands of machines; lots of companies that didn't officially deploy on Debian still had a Debian box somewhere vulnerable * The Rails YAML bug was perniciously exposed in lots of places for months after the initial disclosure, and also coughed up code execution Losing authenticators for "live" users and TLS private keys is bad, but it's not the kind of bad where you invariably need to nuke your servers from orbit and rebuild. Other widespread bugs were actually like that.
- cdelsolar 13y ago
  This bug is on 70% of systems and ANYONE can run a python script and pull out plaintext Paypal or bank passwords. It is the worst Internet bug perhaps ever.