News for hackers. Stuff that matters.

A comment on Willem Pinckaers on Akamai's flawed OpenSSL allocator patch. Parent comment

Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by tptacek on Sunday April 13, 2014 @09:09PM (#7583984)
This would be a more compelling rebuttal to Willem's post if Akamai hadn't confirmed his central thesis:

https://blogs.akamai.com/2014/04/heartbleed-update-v3.html

[ Parent | on HN ]
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by daeken on Sunday April 13, 2014 @09:28PM (#7584038)
> As a result, we have begin the process of rotating all customer SSL keys/certificates.

AGHHHHHHH! Even if their code was likely to have worked perfectly, this is a huge mistake. And I mean huge. They should've operated under the assumption that their defense didn't work and immediately rotated all keys. Period.

[ Parent | on HN ]
Re:Willem Pinckaers on Akamai's flawed OpenSSL allocator patch by iiiears on Monday April 14, 2014 @04:03AM (#7585011)
They used their patch for some length of time, release it to the community and a few hours later a bug is spotted and fixed. Peer review is a good thing.
[ Parent | on HN ]