3 ms·

You don't think for a second that the reason you were all working so hard to fix this is entirely because of the marketing? The intense marketing of Heartbleed

You don't think for a second that the reason you were all working so hard to fix this is entirely because of the marketing? The intense marketing of Heartbleed alerted legit crackers (who would have found out anyway), and a thousand times worse, it alerted wannabe crackers of low hanging security exploit fruit. Marketing works both ways, you know.

teacup50 13y ago
My apologies, I accidentally downvoted this. I strongly agree -- this should have NOT been publicly marketed in this way until vendors had some to assembly updates, and possibly not even then. Serious security vulnerabilities do their own marketing for the people that need to know about them. This is just lowering security to the tabloid level for mass consumption by users who can't fix the issue anyway.
- eridius 13y ago
  The moment it was made public information, there was absolutely no reason whatsoever to hold back on marketing it. Even if your chosen Linux distribution isn't quite ready to go with an easy fix, by being aware of the problem you're a lot more prepared to deploy a fix the moment it becomes available. The only people that holding back (after the vulnerability becomes public knowledge) helps are the attackers.
  - teacup50 13y ago
    > The moment it was made public information, there was absolutely no reason whatsoever to hold back on marketing it. There's a lot of different kinds of public. "Possibly in the wild" is very different than "available to every script kiddie under the sun".
rbanffy 13y ago
Communication of the vulnerability was mind-bogglingly bad - knowledge of its existence became widespread well before major distros had patches ready - but the fact remains our servers were vulnerable (and had been vulnerable for a very long time) and needed to be patched ASAP. We must err on the side of caution and consider everyone that should not know of the vulnerability was already fully aware of it and capable of exploiting it. The same arrogance that makes someone think they are the first to uncover an exploitable security bug makes it sound perfectly natural to build your own memory manager when the one provided by the OS has "bad enough" performance.
TeMPOraL 13y ago
Intense marketing forces everyone to fix the problem because every bad guy has just been told about the vulnerability. But one could reasonably argue that it's better than let the process drag for days, weeks or months, with all the serious bad guys still knowing about the issue (don't believe for a second that secret disclosure to vendors won't leak immediately to some criminal darknets). Unfortunately, sometimes you need to force people into doing things for their own benefit.

teacup50 13y ago

My apologies, I accidentally downvoted this. I strongly agree -- this should have NOT been publicly marketed in this way until vendors had some to assembly updates, and possibly not even then. Serious security vulnerabilities do their own marketing for the people that need to know about them. This is just lowering security to the tabloid level for mass consumption by users who can't fix the issue anyway.

eridius 13y ago
The moment it was made public information, there was absolutely no reason whatsoever to hold back on marketing it. Even if your chosen Linux distribution isn't quite ready to go with an easy fix, by being aware of the problem you're a lot more prepared to deploy a fix the moment it becomes available. The only people that holding back (after the vulnerability becomes public knowledge) helps are the attackers.
- teacup50 13y ago
  > The moment it was made public information, there was absolutely no reason whatsoever to hold back on marketing it. There's a lot of different kinds of public. "Possibly in the wild" is very different than "available to every script kiddie under the sun".

rbanffy 13y ago

Communication of the vulnerability was mind-bogglingly bad - knowledge of its existence became widespread well before major distros had patches ready - but the fact remains our servers were vulnerable (and had been vulnerable for a very long time) and needed to be patched ASAP. We must err on the side of caution and consider everyone that should not know of the vulnerability was already fully aware of it and capable of exploiting it. The same arrogance that makes someone think they are the first to uncover an exploitable security bug makes it sound perfectly natural to build your own memory manager when the one provided by the OS has "bad enough" performance.

TeMPOraL 13y ago

Intense marketing forces everyone to fix the problem because every bad guy has just been told about the vulnerability. But one could reasonably argue that it's better than let the process drag for days, weeks or months, with all the serious bad guys still knowing about the issue (don't believe for a second that secret disclosure to vendors won't leak immediately to some criminal darknets). Unfortunately, sometimes you need to force people into doing things for their own benefit.