4 ms·

I would imagine the motivation is less about money and more about having fun breaking stuff (and bragging rights). I agree though. Hard to argue that this part

by eli 13y ago

I would imagine the motivation is less about money and more about having fun breaking stuff (and bragging rights). I agree though. Hard to argue that this particular security issue needed any extra attention in order to get it fixed.

danielweber 13y ago
One of the biggest root causes of problems in the security industry is that often the only way to make a name for yourself is to cause pain to others. (It's not too hard to convince yourself that those others deserved it.) If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you.
- nitrogen 13y ago
  If you invented time travel people would definitely be writing about it.
- vezzy-fnord 13y ago
  If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you. This is hardly something isolated to the security industry. It's human nature. Some person sealing a hole is nowhere near as attention-gathering as a hole leading to a catastrophic flood due to no one realizing that it needs to be sealed. The potential for something bad to happen doesn't raise anywhere near as much eyebrows as the bad thing actually happening, especially for something as invisible to the average person as a software vulnerability.
- robertgraham 13y ago
  Nobody is writing articles at Neel Mehta, the guy who discovered the bug. They should, he's a god.
makomk 13y ago
It's quite easy to argue that actually. People pointed out that those Snort and other IDS rules were inadequate as soon as they were released, yet it hasn't stopped vendors from claiming they offer protection.
- danielweber 13y ago
  I totally understand the desire to tweak the IDS vendors. Having spent a lot of time working for vendors in that space, they often need tweaking. But I don't get the leap from "IDS vendors suck" to "I made a command-line tool so any idiot can suck down private keys from a server." If the idea was to show that the IDS rules sucked, then just release a slightly different version of the previous heartbleed testers that gets around it. But that's not as much fun.
- clogston 13y ago
  "yet it hasn't stopped vendors from claiming they offer protection" 100% true. The argument Dan and others are trying to make is there are a lot of people caught in the cross-fire who have nothing to do with IDS-vendors claims.

by eli 13y ago

danielweber 13y ago

One of the biggest root causes of problems in the security industry is that often the only way to make a name for yourself is to cause pain to others. (It's not too hard to convince yourself that those others deserved it.) If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you.

nitrogen 13y ago
If you invented time travel people would definitely be writing about it.
vezzy-fnord 13y ago
If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you. This is hardly something isolated to the security industry. It's human nature. Some person sealing a hole is nowhere near as attention-gathering as a hole leading to a catastrophic flood due to no one realizing that it needs to be sealed. The potential for something bad to happen doesn't raise anywhere near as much eyebrows as the bad thing actually happening, especially for something as invisible to the average person as a software vulnerability.
robertgraham 13y ago
Nobody is writing articles at Neel Mehta, the guy who discovered the bug. They should, he's a god.

makomk 13y ago

It's quite easy to argue that actually. People pointed out that those Snort and other IDS rules were inadequate as soon as they were released, yet it hasn't stopped vendors from claiming they offer protection.

danielweber 13y ago
I totally understand the desire to tweak the IDS vendors. Having spent a lot of time working for vendors in that space, they often need tweaking. But I don't get the leap from "IDS vendors suck" to "I made a command-line tool so any idiot can suck down private keys from a server." If the idea was to show that the IDS rules sucked, then just release a slightly different version of the previous heartbleed testers that gets around it. But that's not as much fun.
clogston 13y ago
"yet it hasn't stopped vendors from claiming they offer protection" 100% true. The argument Dan and others are trying to make is there are a lot of people caught in the cross-fire who have nothing to do with IDS-vendors claims.