Re:This shouldn't have happened: A vulnerability postmortem
by tptacek on Wednesday December 01, 2021 @05:28PM
(#29409978)
I don't know anybody who thought OpenSSL was well-maintained in and before the Heartbleed era (it's a fork of SSLeay, which was Eric Young's personal project). Post-Heartbleed --- a decade ago, longer than the time lapse between SSLay and OpenSSL --- maintenance of OpenSSL has improved dramatically.
[ Parent
| on HN ]
Re:This shouldn't have happened: A vulnerability postmortem
by Godel_unicode on Wednesday December 01, 2021 @11:17PM
(#29412520)
I think you and a sibling comment might be too close to the problem. When heartbleed dropped my Twitter feed had a few crypto engineers saying "I mean, eventually this was going to happen" and a ton of developers whose main language starts with a "p" going "how?? OpenSSL is core plumbing of the internet, it can't be this bad can it???".
Edit: to be clear, not maligning the "p" language developers, I was one myself. Simply saying there are a ton of technical people who are blissfully ignorant of the tiny pillars of clay that hold up the internet.
Re:This shouldn't have happened: A vulnerability postmortem
by bee_rider on Thursday December 02, 2021 @12:24AM
(#29412835)
To be fair, it was unreasonable to expect Prolog coders to keep up with crypto advancements, I mean the language pre-dates SSL by decades.
Re:This shouldn't have happened: A vulnerability postmortem
by tannhaeuser on Thursday December 02, 2021 @01:15AM
(#29413087)
Care to expand on what Prolog coders have to do with OpenSSL? Not getting the context here.
Re:This shouldn't have happened: A vulnerability postmortem
by wolf550e on Thursday December 02, 2021 @02:12AM
(#29413389)
A joke about "developers whose main language starts with a "p"", meaning presumably perl, php and python. I guess in this context, ruby and JavaScript are also languages starting with "p".
Re:This shouldn't have happened: A vulnerability postmortem
by Godel_unicode on Thursday December 02, 2021 @11:38AM
(#29418458)
Don't worry, I told both of them what was going on ;)
Re:This shouldn't have happened: A vulnerability postmortem
by seanhunter on Thursday December 02, 2021 @02:38AM
(#29413513)
Pascal does predate the era of SSL by some margin to be fair.
Re:This shouldn't have happened: A vulnerability postmortem
by hn_go_brrrrr on Thursday December 02, 2021 @01:49AM
(#29413266)
Yeah, those Perl hackers are really out of touch :-)