3 ms·

No, that goes too far the other way. If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its p

by blahedo 13y ago

No, that goes too far the other way. If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument is totally correct if I am simply unsure---if I don't know whether an exploit affects me but I suspect it might, I assume the worst and act accordingly. But in this case Akamai had good reason to believe they were unaffected. (And, when someone demonstrated otherwise, they responded responsibly.)

daeken 13y ago
> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? If you have a memory read out of a process that contains sensitive data, you should always assume that the sensitive data was breached, even if you "programmed defensively against it". Period. No exceptions. They had good reason to believe they were unaffected, which is why they shouldn't have hit the "oh shit, the world is ending" button. But the decision to not roll their keys in the face of a breach was a massively irresponsible one. We have how many years of major bugs to look at? And in how many cases are the likes of Akamai (that is, organizations with theoretical mitigations in place) actually safe when they think they are? Always, always assume your protections are faulty in a way that a motivated attacker will figure out.
makomk 13y ago
Take a look at how much protection people's legitimate reasons to believe that this didn't affect them have given so far - the only people who haven't been proven wrong were the ones who weren't running a vulnerable OpenSSL. Their arguments all assumed that because they couldn't imagine a way to get the keys there wasn't one, when in fact they just hadn't thought about it enough.
grayclhn 13y ago
> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument hinges on the word "legitimate." I don't do security, but "it looks good to me" is not a legitimate reason to believe that the exploit does not affect you (for any value of "me"). OTOH "I've never used the versions of OpenSSL that have this bug" is a legitimate reason to believe that you're not affected, e.g. Tarsnap's explanation [1]. I'd also recommend that post for another take on what defensive programming looks like in this context. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb... on HN: https://news.ycombinator.com/item?id=7562125 https://news.ycombinator.com/item?id=7562125

by blahedo 13y ago

daeken 13y ago

> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? If you have a memory read out of a process that contains sensitive data, you should always assume that the sensitive data was breached, even if you "programmed defensively against it". Period. No exceptions. They had good reason to believe they were unaffected, which is why they shouldn't have hit the "oh shit, the world is ending" button. But the decision to not roll their keys in the face of a breach was a massively irresponsible one. We have how many years of major bugs to look at? And in how many cases are the likes of Akamai (that is, organizations with theoretical mitigations in place) actually safe when they think they are? Always, always assume your protections are faulty in a way that a motivated attacker will figure out.

makomk 13y ago

Take a look at how much protection people's legitimate reasons to believe that this didn't affect them have given so far - the only people who haven't been proven wrong were the ones who weren't running a vulnerable OpenSSL. Their arguments all assumed that because they couldn't imagine a way to get the keys there wasn't one, when in fact they just hadn't thought about it enough.

grayclhn 13y ago

> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument hinges on the word "legitimate." I don't do security, but "it looks good to me" is not a legitimate reason to believe that the exploit does not affect you (for any value of "me"). OTOH "I've never used the versions of OpenSSL that have this bug" is a legitimate reason to believe that you're not affected, e.g. Tarsnap's explanation [1]. I'd also recommend that post for another take on what defensive programming looks like in this context. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb... on HN: https://news.ycombinator.com/item?id=7562125 https://news.ycombinator.com/item?id=7562125