News for hackers. Stuff that matters.

A comment on Heartbleed disclosure timeline: who knew what and when. Parent comment

Re:Heartbleed disclosure timeline: who knew what and when by nl on Tuesday April 15, 2014 @02:05AM (#7590510)
I would imagine if a government discovers a bug like Heartbleed and has no evidence of anyone else knowing about it, they will classify it and use it offensively.

You seem to think "a government" is a unified entity. If the NSA (for example) discovered Heartbleed I'd expect you would be correct.

If someone in the IRS (for example) found it I'd expect they would behave very differently.

[ Parent | on HN ]
Re:Heartbleed disclosure timeline: who knew what and when by ig1 on Tuesday April 15, 2014 @05:10AM (#7590976)
I believe standard procedure would be for IRS to report it to US-CERT who are part of the Department of Homeland Security.
[ Parent | on HN ]
Re:Heartbleed disclosure timeline: who knew what and when by anfedorov on Tuesday April 15, 2014 @05:57AM (#7591060)
I believe standard procedure would be for IRS to report it to US-CERT who are part of the Department of Homeland Security.

At which point (I imagine), decisions would be made along the same lines as I described, the key questions being "can we keep it secret?" and "who has this capability?".

I tried to be nation-agnostic, as I imagine there may be a bit of difference in how a given nations' intelligence agency weighs the value of their offensive capabilities and the public defensive capabilities in light of who knows about the bug.

[ Parent | on HN ]
Re:Heartbleed disclosure timeline: who knew what and when by stingraycharles on Tuesday April 15, 2014 @04:57AM (#7590942)
Too bad we all know which agency is far more likely to discover such a vulnerability.
[ Parent | on HN ]