7 ms·
Note the almost painfully predictable response to the thread. Instead of focusing how OpenSSL can pull in, let me pick a number, $800k in revenue in the next y
by patio11 13y ago
Note the almost painfully predictable response to the thread. Instead of focusing how OpenSSL can pull in, let me pick a number, $800k in revenue in the next year, they immediately zero in on $70 of Paypal fees as the organization's leading financial problem.
- bhousel 13y agoThe events of this past week make me wonder how much Heartbleed would have been worth to an entity that buys zero day exploits.
- rubiquity 13y agoAsk CloudFlare how much they paid. No, I'm not saying they buy zero day expolits to be evil, but how else did they get 12 days notice?
- mschuster91 13y agoBecause the researchers had the common sense of notifying the biggest targets in advance, I think.
- danielweber 13y agoI'll defend the researchers for trying to do a managed notification. But I wonder, did they try to reach out to the major OS vendors to see if they could get them any advance warning? Or ask OpenSSL if OpenSSL knew how to get in touch with people on the down-low?
- mschuster91 13y agoThe problem with distributions is that you, in most cases, don't know who is on the other end of the security@xxx.tld email address. Being google engineers, they should have direct contacts with Cloudflare and some other high-profile targets.
- danielweber 13y agoObviously they don't just send the exploit directly in mail to a mailing list. Email, ask to talk to someone over the phone, explain the situation to that person, ask for references on prior releases being well-handled. I want to avoid Monday morning quarterbacking, though. In hindsight the right course of action is always obvious.
- akerl_ 13y agoITYM "target", and not even "biggest", really. They didn't responsibly disclose to any distributions.
- antihero 13y agoWouldn't it have made most sense to e-mail the OpenSSL team so they could have pushed a critical patch that everyone would have updated to via APT before shit went off of the hook?
- mschuster91 13y agoThey did, the problem is that the patch immediately shows you the security issue - and distributing a patch means then to disclose the bug.
- danielweber 13y agoI'm not 100% on the timeline but I'm pretty sure the OpenSSL team knew about this well before April 7th.
- ceejayoz 13y agoIf that were the case, AWS would've been on the list.
- daeken 13y agoBy being a major site that uses SSL. Many such users were notified ahead of time; it's nothing abnormal with responsibly disclosed bugs. As far as I'm aware, no money changed hands whatsoever.
- mkal_tsr 13y agoCDNs are part of a group that receives advanced notification because of their reach on the web - they're a valuable attack vector.
- rubiquity 13y agoWhat about CloudFront? What about Akamai? What about every other CDN but CloudFlare?
- emilsedgh 13y agoYou make it sound so easy. Any suggestions you've got regarding $800K in revenue in the next year? :)
- ForHackernews 13y agoHow about hitting up all the multi-million dollar companies that run their businesses on top of OpenSSL?
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- tlrobinson 13y agoHow much do you think companies[1][2] would collectively donate in order to try to avoid another Heartbleed? [1] http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/ http://mashable.com/2014/04/09/heartbleed-bug-websites-affec... [2] https://gist.github.com/dberkholz/10169691 https://gist.github.com/dberkholz/10169691
- jbooth 13y agoProbably none, what with game theory and the free-rider problem. Or, as it seems, about $2k.
- patio11 13y agoRounding error in donations, but easily $X0k+ to purchase proactive mitigation. It's not like (without loss of generality) Yahoo is a stranger to paying for engineers, security technology, software licenses, or insurance policies.
- amalcon 13y agoAnyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month (though of course membership in this club is still offered at OpenSSL's sole discretion, and they would be allowed to waive this fee). Google, Amazon, Facebook, and Akamai (off the top of my head) will each pay that without batting an eye; that's $480k/yr. right there. I imagine they could probably get some banks in that club as well.
- ericd 13y agoYeah, wow... Anyone in that group/know anyone in that group that can refocus them on the real problem of them being paid <10 engineer days per year to maintain/improve this vital piece of infrastructure?
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- lifeisstillgood 13y agoI have often thought we need something akin to gittip on Enterprise Scale. A central point of collection, but I can direct the donation to any project, and "EnterpriseOSSFoundation" just handles the messy admin. There are an awful lot of CTOs who would be happy to "pay back" to projects if it looked legit on the budget and the brand was something the Chairman would hear about at the golf club.
- whit537 13y agoWhat's to stop Gittip from being enterprise scale? Just got home from PyCon and had a lot of conversations there about how to translate Gittip into terms that legal/accounting can deal with.