Re:Heartbleed disclosure timeline: who knew what and when
by daeken on Monday April 14, 2014 @07:21PM
(#7589476)
My issue with the Cloudflare Challenge can be summed up in: no matter what the results are, it will give people a diminished impression of the bug's actual impact. I can't fathom any way in which the Cloudflare Challenge was beneficial to the security of their customers (or anyone else, for that matter), which should be the goal of bounties; not to simply be a PR move.
[ Parent
| on HN ]
Re:Heartbleed disclosure timeline: who knew what and when
by tptacek on Monday April 14, 2014 @07:24PM
(#7589485)
My problem is that if you're trying to figure out how key material is distributed throughout heap memory, asking people to answer that question about an unknown private key through heartbleed "peeks" is about the most obtuse possible way to find out.