Re:Amazon ELBs are vulnerable to Heartbleed
by drdaeman on Tuesday April 08, 2014 @09:19AM
(#7553170)
In a same manner CloudFlare had it before the disclosure, OpenSSL team should've contacted major GNU distro (Debian, Fedora, Arch) packagers privately and do the announcement as new releases hit the repos (i.e. not having a 4-8 hour window, given the bug's pretty much critical).
[ Parent
| on HN ]
Re:Amazon ELBs are vulnerable to Heartbleed
by 001spartan on Tuesday April 08, 2014 @11:06AM
(#7553840)
I was under the impression that they did in fact contact package maintainers in addition to companies like CloudFlare.
Re:Amazon ELBs are vulnerable to Heartbleed
by rincebrain on Tuesday April 08, 2014 @11:41AM
(#7554060)
Nope; package maintainers said they didn't get notified, and OpenSSL explicitly has no notification mechanism for such things. CF found out because the private entities which found the bug warned them a priori with a request to not disclose it to anyone else. See also: https://news.ycombinator.com/item?id=7549986