3 ms·

I don't follow -- how is it an independent discovery if it was posted after complete details had already been released by Google?

• tptacek 12y ago
  Pornin's comments on SE predate the publication.
  • haberman 12y ago
    Oh my bad. What is the explanation of this part? "given sure confidence that there is a vulnerability in a particular diff, skilled security researchers can find it very quickly." Was there previously an announcement that a vulnerability existed, without details of what the vulnerability was?
    • cesarb 12y ago
      Yes, there was: https://news.ycombinator.com/item?id=8452931 https://news.ycombinator.com/item?id=8452931 That announcement implied that the vulnerability was SSL 3.0 only. Knowing that, the obvious place to look at would be the differences between SSL 3.0 and its successor TLS 1.0.
    • brians 12y ago
      There was a lot of Twitter traffic about SSL3 being bad. But TLS1 has very few differences from SSL3. In Heartbleed, we knew that it was introduced with a particular OpenSSL version. That had 12 changes; 8 were DTLS. Two were clearly not relevant. One was heartbeat. Dan Franke took about fifteen minutes to go from that set of inputs to a sketch of heartbleed. I now advocate QA by what I call "virtual tests": you don't have to write the tests, just the failure messages. Developers will do the rest of the work on their own.