Heartbleed disclosure timeline: who knew what and when

Re:Heartbleed disclosure timeline: who knew what and when by johnvschmitt on Monday April 14, 2014 @07:03PM (#7589414)

There are many hackers who do not reveal their exploits.

This is an overly optimistic account of who knew what when.

And, how can we protect? Patch? Yes, that's necessary, but not sufficient. We have so many other protocols we rely on that are fragile & intercepted. Self-censorship sucks, and can't possible protect everything either. What to do?

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by lkd on Monday April 14, 2014 @07:38PM (#7589533)

This is not claiming to be a complete list of who knew what when. It is only a list of confirmed cases.

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by johnvschmitt on Monday April 14, 2014 @07:47PM (#7589566)

Really? If there are caveats or disclaimers, they are very well hidden.

For most people reading this actual article, I think they will come away with the impression that it's a complete account.

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by mcphilip on Monday April 14, 2014 @08:09PM (#7589637)

Was the article changed since you read it? The first three paragraphs make it clear that this is an attempted reconstruction of events and clarifications/corrections/ are requested.

>Ever since the "Heartbleed" flaw in encryption protocol OpenSSL was made public on April 7 in the US there have been various questions about who knew what and when.

>Fairfax Media has spoken to various people and groups involved and has compiled the below timeline.

>If you have further information or corrections - especially information about what occurred prior to March 21 at Google - please email the author: [email protected]. Click here for his PGP key.

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by johnvschmitt on Monday April 14, 2014 @08:18PM (#7589664)

Sorry, that just still looks like glossing it over.

I mean, when the NSA & other actors do NOT submit their data to this guy, they can say, it's complete now?

It just stinks to me like it's complacency. Just change your passwords & patch, & then don't worry, share everything again, it's private. In 2014, I don't think we're safe & private anymore at all. I can take the downvotes. I don't like it either.

[ Parent | on HN ]

Re:Heartbleed disclosure timeline: who knew what and when by lkd on Tuesday April 15, 2014 @05:08AM (#7590972)

Heartbeats are not logged on a standard configuration, so if people other than the confirmed parties independently discovered the vulnerability, told nobody (or at least nobody who would tell anybody), and then exploited it on systems where heartbeats are not logged (which would be most of them), then how could anyone possibly know?

[ Parent | on HN ]