How Heartbleed Leaked Private Keys

Re:How Heartbleed Leaked Private Keys by ibmthrowaway218 on Monday April 28, 2014 @08:18AM (#7659409)

I don't think it's unfair to paraphrase this statement:-

"And, we have reason to believe based on the data structures used by OpenSSL and the modified version of NGINX that we use, that it may in fact be impossible."

"We've reviewed the code and we don't think it's vulnerable."

Obviously you disagree.

[ Parent | on HN ]

Re:How Heartbleed Leaked Private Keys by willvarfar on Monday April 28, 2014 @09:50AM (#7659898)

Yeap, when I read the original statement it really seemed to be telling the customers there was nothing to worry about, and I think that's how it was meant to be read.

When the original statement was posted I actually went back to the header to check the author, thinking "surely jgc wouldn't post something this marketroid?"

Only in hindsight do they point at the get-out clauses.

[ Parent | on HN ]

Re:How Heartbleed Leaked Private Keys by Retric on Monday April 28, 2014 @09:18AM (#7659677)

Context is important when you see that many weasel words. "We do not yet feel comfortable saying that." Means there still undecided as does 'may' in 'may be impossible'.

[ Parent | on HN ]