News for hackers. Stuff that matters.

A comment on Heartbleed disclosure timeline: who knew what and when. Parent comment

Re:Heartbleed disclosure timeline: who knew what and when by makomk on Monday April 14, 2014 @07:08PM (#7589430)
Except that it isn't actually at all unlikely with some common configurations, which actually seem to give up the private key on every single attempt.
[ Parent | on HN ]
Re:Heartbleed disclosure timeline: who knew what and when by daeken on Monday April 14, 2014 @07:13PM (#7589448)
Fair point -- you're right that it's extremely configuration dependent. For many (especially in the Apache realm) it's trivial and very likely; others (especially Nginx) it's quite a bit more work. But even if he was 100% correct in it being unlikely, it still doesn't justify ignoring the threat, IMO.

I think we're in violent agreement here.

[ Parent | on HN ]