Re:Heartbleed disclosure timeline: who knew what and when
by daeken on Monday April 14, 2014 @07:03PM
(#7589413)
No, he didn't. He said that it's unlikely, and he's right. It's unlikely that I'm going to get heads 100 times in a row if I'm flipping a coin, but it suddenly becomes likely if I try it a couple million times. Being unlikely doesn't mean you shouldn't assume that it's possible for a motivated attacker. Especially when the barrier to entry is so extraordinarily low, as we've seen repeatedly (Cloudflare and Akamai, I'm looking at you).
[ Parent
| on HN ]
Re:Heartbleed disclosure timeline: who knew what and when
by makomk on Monday April 14, 2014 @07:08PM
(#7589430)
Except that it isn't actually at all unlikely with some common configurations, which actually seem to give up the private key on every single attempt.
Re:Heartbleed disclosure timeline: who knew what and when
by daeken on Monday April 14, 2014 @07:13PM
(#7589448)
Fair point -- you're right that it's extremely configuration dependent. For many (especially in the Apache realm) it's trivial and very likely; others (especially Nginx) it's quite a bit more work. But even if he was 100% correct in it being unlikely, it still doesn't justify ignoring the threat, IMO.
I think we're in violent agreement here.