News for hackers. Stuff that matters.

A comment on Willem Pinckaers on Akamai's flawed OpenSSL allocator patch.

Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by rgbrenner on Sunday April 13, 2014 @06:58PM (#7583497)
If this code was running on the Akamai networks for years, why did they have a copy laying around that didn't call mprotect?

Given the above problems I wonder how Akamai manages to run this in production.

How could you misread a two paragraph email so badly. Here, let me shorten it up for you:

  This patch is a _variant_ of what we've been using to help 
  protect customer keys for a decade.

  This should really be considered more of a proof of 
  concept than something that you want to put directly into 
  production. Let me restate that: do not just take this 
  patch and put it into production without careful review.
So to answer your question: this version was never running in production.. and it the initial patch didn't call mprotect because they stripped it out from their version when creating the POC.
[ Parent | on HN ]
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by tptacek on Sunday April 13, 2014 @09:09PM (#7583984)
This would be a more compelling rebuttal to Willem's post if Akamai hadn't confirmed his central thesis:

https://blogs.akamai.com/2014/04/heartbleed-update-v3.html

[ Parent | on HN ]
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by daeken on Sunday April 13, 2014 @09:28PM (#7584038)
> As a result, we have begin the process of rotating all customer SSL keys/certificates.

AGHHHHHHH! Even if their code was likely to have worked perfectly, this is a huge mistake. And I mean huge. They should've operated under the assumption that their defense didn't work and immediately rotated all keys. Period.

[ Parent | on HN ]
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by iiiears on Monday April 14, 2014 @04:03AM (#7585011)
They used their patch for some length of time, release it to the community and a few hours later a bug is spotted and fixed. Peer review is a good thing.
[ Parent | on HN ]
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by mst on Sunday April 13, 2014 @08:22PM (#7583822)
I would be more sympathetic if they'd said "do not take this patch and put it into production, it's almost certainly incomplete and buggy". "without careful review" suggests that they actually expected some possibility of it being complete and correct, at which point having somebody verify that currently it is neither is still really rather useful.

It's more an 'exemplar of concept' or something, really - which is still valuable, but I do wish they'd made that more clear.

[ Parent | on HN ]