News for hackers. Stuff that matters.
Re:Heartbleed disclosure timeline: who knew what and when by tptacek on Monday April 14, 2014 @08:15PM (#7589653)
It's interesting you put it that way, because it hadn't occurred to me that your team had an early heads-up on the bug before writing that blog post. So what you're saying is that for 5+ days, the team was working on the assumption that the only time OpenSSL RSA private keys touched heap memory was when they were first loaded.

It seems like you can just look at the code and see how that's not the case. But I might be wrong, too.

It is a tricky thing, being in the center of a critical vulnerability disclosure story.

Re:Heartbleed disclosure timeline: who knew what and when by danielweber on Tuesday April 15, 2014 @09:11AM (#7591571)
Since other people seem unaware, I'm going to rip open a personal emotional wound and explicitly tell people: 'tptacek knows exactly what he's talking about because he did in the past, almost exactly, what Cloudflare did right now.

(If you really want to know the issue, google his name with "dns", but it's not really relevant to rehash his mistakes here, except for the fact that in his choice of words on this thread ("They didn't find the bug. They benefited from a heads-up on the bug. Then they promoted a mistaken assumption about the bug") are a screamingly obvious reference to his old mistakes.)

He's not being hypocritical; he's speaking from the voice of experience and having had things blow up in his face. He's trying to stop other people from making the same mistakes he did. When the guy with the big burn mark on his face talks to your chemistry class about the importance of lab safety, you should LISTEN.

"Experience is a dear teacher but fools will learn at no other." Sometimes your elders know what they are talking about.

(Now to re-bandage that wound. Another big piece of advice from another elder: people change and mature, yourself included. You should get over other people's mistakes.)

Re:Heartbleed disclosure timeline: who knew what and when by tptacek on Tuesday April 15, 2014 @09:46AM (#7591751)
Yep, that happened.
Re:Heartbleed disclosure timeline: who knew what and when by gojomo on Monday April 14, 2014 @11:37PM (#7590193)
An expert's hindsight is 20/20. (Mehta's team had the bug 17+ days, and he still tweeted his reassurance on 4/8 with "#dontpanic".)

The challenge result instantly convinced a lot of people who still had doubts, because of the mixed messages elsewhere. The sideshow drama, much like the catchy name 'heartbleed' before it, worked perfectly for its intended purpose.

Re:Heartbleed disclosure timeline: who knew what and when by anonymouse01 on Tuesday April 15, 2014 @04:35PM (#7594115)
You're missing the obvious here: they have no idea what they're doing. Which is pretty evident from every aggrandizing post on their blog.