tmsr - Search: heartbleed

asciilifeform: BingoBoingo: lol, hearn's old thing , the cocktail where tried to slip heartbleed in

asciilifeform: i.e. exact preview of the 2013 'movie', where the nsa radiobugism docs leaked, and yet somehow still 'why wouldja want emshielded comp, paranoiac'. or heartbleed , and then somehow still 'openssl is standard, shuddup and Don't Write Own Crypto(tm)(r), terrorist'

asciilifeform: and i'd prefer that the next heartbleed ends up fetching rubbish from ram of dedicated toilet, rather than errywhere.

asciilifeform: ( the lib itself is a hairball , not unlike winblowz, i pointed this out even before 'heartbleed' etc., in e.g. http://www.loper-os.org/?p=1299 )

asciilifeform: zx2c4: well, you seem to see the burden of proof, on asciilifeform , to show that debiankeys , or e.g. heartbleed, was a work of nsa plant

mircea_popescu: you KNOW they'll have heartbleed and orc glyphs and so on and so forth, even as the "security tokens" never expire and the gameplay just isn't there.

asciilifeform: mircea_popescu: the spot check model is, again, wholly inadequate. if you have ONE debianism or heartbleed etc. it literally does not matter worth a shit how 'clean' the remainder of it may have been.

asciilifeform: does, e.g., heartbleed, qualify as 'good toy' ? considering that openssl was known, to everyone who gave half a rat's arse, to be a cistern of liquishit, long prior ?

a111: Logged on 2017-01-14 01:28 mircea_popescu: aqnyway, the "hive mind" is fucking comedic already. FIVE YEARS with the subverted python, got them nowhere. close to five years pushing rust, nothing to show for it. systemd is still mostly a joke, and the hatred is growing exponentially while the pustule is growing logarithmic at that. meanwhile the republic cracked open the heartbleed in quite the painful fashion, no matter how much effort went into "rehappening" it. not t

mircea_popescu: aqnyway, the "hive mind" is fucking comedic already. FIVE YEARS with the subverted python, got them nowhere. close to five years pushing rust, nothing to show for it. systemd is still mostly a joke, and the hatred is growing exponentially while the pustule is growing logarithmic at that. meanwhile the republic cracked open the heartbleed in quite the painful fashion, no matter how much effort went into "rehappening" it. not t ☟︎

Framedragger: i think he's just young (https://github.com/FiloSottile). i remember his heartbleed test tool, it wasn't innovative but was useful. (but i hear what mircea_popescu is saying)

mircea_popescu: notice how he glued himself to heartbleed (which, unlike the normal hanno bockian crap, was a surprise to the empire).

asciilifeform: hoose to use corporate-maintained tools like OpenSSL, which are deeply compromised. Do you think the people responsible for HeartBleed were held accountable, and fundamental changes were made? Guess again. It’s simply ignored by most of Linux. (You’ll notice real UNIXes like OpenBSD did not ignore it and have begun serious changes. Yet even there, it took such a serious, obvious exploit for them to see the engineering problem.)'

asciilifeform: 'Remember Heartbleed? Don’t let that example escape your attention. OpenSSL is open, yet it is so large and poorly designed that it’s a dark mystery. Heartbleed was easily shown to be a deliberate hack, and was even deliberately coded to hide itself from tools that would otherwise have shown the leak. And it was sitting there in ‘open’ sight. Instead of using small, well-reviewed crypto libraries, corporate Linux developers c

hanbot: for the record, it's not just phuctor that your friend Boeck [could have done] did. See also [could have] found Heartbleed: http://www.openwall.com/lists/oss-security/2015/04/07/7

BingoBoingo: <davout> for some reason this hoaxtoshi stuff seems very interesting to journos << Heartbleed and the bash vulnerability made radio

asciilifeform: the modus operandi of the enemy is to insert 'bugs', e.g., 'heartbleed', and to prevent attribution.

assbot: Logged on 06-01-2016 15:46:58; ascii_butugychag: 'Filippo Valsorda. I'm Italian and I work on the CloudFlare Security Team in London. I built the public Heartbleed test and I mess with cryptography. Public speaker. Motorbike rider. Frequent flyer. Hacker School F'13.'

ascii_butugychag: 'Filippo Valsorda. I'm Italian and I work on the CloudFlare Security Team in London. I built the public Heartbleed test and I mess with cryptography. Public speaker. Motorbike rider. Frequent flyer. Hacker School F'13.' ☟︎

assbot: Logged on 31-07-2015 03:53:10; asciilifeform: coderwill: on top of the thousand and one other sins, tor linked in ssl at the height of 'heartbleed' - something which pretty much nobody is speaking of today

asciilifeform: coderwill: on top of the thousand and one other sins, tor linked in ssl at the height of 'heartbleed' - something which pretty much nobody is speaking of today ☟︎

asciilifeform: i personally refuse to make any distinction between someone who wrote, e.g., 'heartbleed', into existence - and some other fella who ~knew of it and didn't tell me~

BingoBoingo: <asciilifeform> 'Andy confirmed that Coverity does not spot the heartbleed flaw and said that it remained stubborn even when they tweaked various analysis settings.' << Can't spot heartbleed because custom OpenSSL malloc

asciilifeform: 'Andy confirmed that Coverity does not spot the heartbleed flaw and said that it remained stubborn even when they tweaked various analysis settings.'

thestringpuller: mircea_popescu: do you have the source for the pull request where hearn tried to merge in heartbleed?

mircea_popescu: note for instance that the various "emergency problem - update required" stuff is in NEW-ish versions. like, heartbleed ? ubuntu 10.04 was fine. 12.04 ? owned.

ascii_field: 'When we tried wget, it detected errors, retried, and finally succeeded. It said the error was a bad length field in a TLS packet. That didn't make sense at first because we thought TLS packets were error corrected by TCP.' << incidentally, i am not certain that i agree with the author's conclusion ('reverse heartbleed'.) it may very well be an attempt to exploit other braindamage in http stack

mircea_popescu: "Heartbleed is a read buffer overflow. What that means is that an application is reading outside the boundaries of a buffer. For example, imagine an application has a space in memory that's 10 bytes long. If the software tries to read 20 bytes from that buffer, you have a read buffer overflow."

assbot: How Heartbleed could've been found - Hanno's blog ... ( http://bit.ly/1GlIn4J )

mircea_popescu: if there isn't another heartbleed in there, someone's been slacking on their job.

BingoBoingo: <thestringpuller> well only OpenSSL had heartbleed << The other big SSL implementations had their own flaws unveiled in the following months that essentially accomplished the same insecurity.

assbot: Logged on 29-03-2015 16:49:24; Chillum: most protocols have had a vulnerability at some point. Heartbleed was a bug in openssl, not a bug in ssl

Chillum: most protocols have had a vulnerability at some point. Heartbleed was a bug in openssl, not a bug in ssl

asciilifeform: <Chillum> Routers are a sad state of affair. Something like 70% of consumer wifi routers in the wild are vulnerable to heartbleed << and a fella who knows this, is still fond of ssl ? amazing

Chillum: Routers are a sad state of affair. Something like 70% of consumer wifi routers in the wild are vulnerable to heartbleed

asciilifeform: mats: if you have philosophical objections to 'behave as if X even if possibly ~X is true' then try to come up with some other syllogism. but it -must- end in 'the people who gave us heartbleed and dual_ec DO NOT GET TO MAKE CRYPTO ANY MORE'

assbot: Logged on 27-09-2014 02:35:49; asciilifeform: if you create a 'heartbleed' - you are a вредитель. and whether you did it intentionally, given the impossibility of proof - does not matter.

asciilifeform did not test with anything other than the shortly post-heartbleed turdball specified in 'portatronic'

assbot: heartbleed in rust ... ( http://bit.ly/1Dz2WFT )

mircea_popescu: leaving aside that nobody i ever knew was seriously using the newer debian releases anyway for any purpose, you';d have to be fucking insane to think the way this goes is, we kill their heartbleed and they sit and wait.

mircea_popescu: "A failure to properly filter specially formed packets makes it possible for attackers to execute attack code of their choosing by sending malicious traffic to a Windows-based server." << sounds like windows had a replica of heartbleed.

mircea_popescu: and that n is pretty fuckingly scary high, what with the heartbleed headshot and all the other outlays generously handed out by la serenissima.

thestringpuller: mircea_popescu: what if someone doesn't sign "heartbleed introduction" then no one is accountable and system is moot

asciilifeform: the hidden little shitgnomes like author of heartbleed - they are the ones who needs the lethal sunlight rays the most.

asciilifeform: if you create a 'heartbleed' - you are a вредитель. and whether you did it intentionally, given the impossibility of proof - does not matter. ☟︎

asciilifeform: (and yes - we know author of 'heartbleed.' and he's alive and well and still contributing code to public projects, afaik. why? don't ask me)

ben_vulpes: this guy helped shut watch-only wallets and addresses out of the core client, while merging in heartbleed.

ben_vulpes: <asciilifeform> no heartbleed, no pagerank. << search engines. next frontier of bitcoin.

mircea_popescu: GinAddict1 mike is the chief enemy plant in bitcoin. he's the guy that merged heartbleed in bitcoin for absolutely no legitimatereason, and he's the guy that forced a hard fork, idem.

assbot: The author of the OpenSSL Heartbleed bug also wrote the spec : programming

asciilifeform: everybody can get behind the impalement of author of 'heartbleed' but problem goes deeper.

mircea_popescu: btw, speaking of the derp foundation : did it yet get around to pointing out that people who had stopped updating bitcoin pre 8.0 were invulnerable to heartbleed, whereas people who hadn't stopped updating lost all their key material in the interval ?

mircea_popescu: <asciilifeform> this is also the answer for why 'heartbleed' was necessary, considering that usg has at-will access to root certs << not that simple.

asciilifeform: this is also the answer for why 'heartbleed' was necessary, considering that usg has at-will access to root certs

assbot: Meet Cupid, the Heartbleed attack that spawns evil Wi-Fi networks | Ars Technica

HeySteve: they hint it's related to heartbleed, NRPE or Ebury, not that I'd heard of the other 2

mircea_popescu: ThickAsThieves i dare not think they perhaps haven't reported on heartbleed yet, because well...

mircea_popescu: on that note, often manufacturers explicitly forbid to install updates and servicepacks since it might well break the app. << since heartbleed i'm going to forbid any upgrades as part of the contract in all cases, always and forever.

fluffypony: HeySteve: it depends - if you're trading with them then they generally have to auth; whilst you can check with nickserv if they have enforce on and are identified Freenode have said that it's possible NS passwords were leaked coz of heartbleed

fluffypony: davout: I'll fathom that they had logins etc. scraped when they were Heartbleed vulnerable, and the attackers waited till now to use them