patch: https://aws.amazon.com/security/security-bulletins/heartblee... (4/8/2914)
IIRC: 12 or 18 hours rolled out to all of aws ELB (main part affected).
https://usn.ubuntu.com/usn/usn-2165-1/
Patch was available at time of vulnerability release for current and LTS releases of ubuntu. apt-get update.
But you know... That's just too hard.
Isn't it interesting that one needs a license to drive an automobile and yet companies that handle this type of information get to do so without demonstrating the required level of competence.
Oh, it's the whole industry tho'. VMS running on DEC hardware was at a level of security and reliability that we can only dream of today, but it was abandoned on the scrapheap and replaced by glorified PCs running a hobbyist OS. If you wanted to build an infrastructure on old-skool principles now you couldn't, you can't get the components anymore. The truth is we're fighting a losing battle and the real enemy is ourselves.
They can, but it requires automation. I've worked on and used tooling for just such things. We can see an upstream CVE and have it patched in production inside 48hrs. Usually the same day.
Disclosure: I work for Pivotal. All this stuff (Cloud Foundry, BOSH etc) is opensource, but we sell commercial versions too.
You don't need to patch your software right away, but you should have other strategies for mitigation such as a WAP in front of your services that you can configure to block malicious traffic when you identify a remote code execution vulnerability.
Immediately? No real company can do this. 1-2 weeks after the announcement is the best you'll see, even with something of the magnitude and publicity of Heartbleed. I'm not saying that's how it should be but that's how it is. Most organisation's it's quarterly!
All of these can be designed into a system and still maintain 100% uptime
Sure. If you were designing from a clean slate right now. The vast majority of organisations in the world aren't.
And believe me: in 10 or 20 years your new design would have revealed flaws too, and look laughably primitive to the practitioners of the day.
What's the solution then? An architecture in which no single compromise can compromise the entire system. That's getting harder and harder to do as the landscape homogenises around Lintel.