The logistics of disclosure for something as ground breaking as this are probably very difficult.
I suppose the details are still sketchy at this point, but I have no idea how CloudFlare received a week's notice, and no one more important[1] knew of it until it was publicized. CloudFlare being the special group makes me suspicious of how it all went down.
[1] I'm not picking on CloudFlare, they have a huge footprint on the internet.
https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-syste...
I wonder why the various linux distros like debian could not have been notified simultaneously.
This stuff is always tricky, and I admittedly have a strong adverse reaction to the "just blow everything open, it will be lulzy when the web breaks" attitude.
To be on such a list you also need to have a positive prior record demonstrating your ability to keep your mouth shut, which is hard to prove.
Has this sort of behaviour been observed for other vulnerabilities in the wild that can be cited? I would think that the patch is small enough that a co-ordinated deployment to all the distros could have been managed so that they had packages ready before attackers could exploit the vulnerability. Not sure that the correct solution is to announce it with a corporate blog post and a vanity web site instead.
The lulzy thing about this bug is that people who are still on 0.9.8 aren't doing the right thing; they just got lucky on this one bug.
Yes. The mailing list that was used as recently as 2011 to coordinate exactly this kind of issue was backdoored.
Further reading: http://www.openwall.com/lists/oss-security/2011/03/03/3
The worst situation you can be in is where everyone knows something is going on, but only a small group of people know what it is. At that point, the incentives strongly favor the attackers, who will work quickly to join the in-crowd and exploit the window of time where they know how to exploit the flaw, and site operators don't know enough about it to take it seriously.
It's especially hard to stage-manage these updates with open source software. Look at the patch; to someone who takes exploit code seriously, the vulnerability is instantly obvious. How was anyone supposed to give you a heads up without tipping off attackers?