161 entries in 0.3s
: BingoBoingo: lol, hearn's old thing , the cocktail where tried to slip heartbleed
: i.e. exact preview of the 2013 'movie', where the nsa radiobugism docs leaked, and yet somehow still 'why wouldja want emshielded comp, paranoiac'. or heartbleed
, and then somehow still 'openssl is standard, shuddup and Don't Write Own Crypto(tm)(r), terrorist'
: and i'd prefer that the next heartbleed
ends up fetching rubbish from ram of dedicated toilet, rather than errywhere.
: zx2c4: well, you seem to see the burden of proof, on asciilifeform , to show that debiankeys , or e.g. heartbleed
, was a work of nsa plant
: you KNOW they'll have heartbleed
and orc glyphs and so on and so forth, even as the "security tokens" never expire and the gameplay just isn't there.
: mircea_popescu: the spot check model is, again, wholly inadequate. if you have ONE debianism or heartbleed
etc. it literally does not matter worth a shit how 'clean' the remainder of it may have been.
: does, e.g., heartbleed
, qualify as 'good toy' ? considering that openssl was known, to everyone who gave half a rat's arse, to be a cistern of liquishit, long prior ?
: Logged on 2017-01-14 01:28 mircea_popescu: aqnyway, the "hive mind" is fucking comedic already. FIVE YEARS with the subverted python, got them nowhere. close to five years pushing rust, nothing to show for it. systemd is still mostly a joke, and the hatred is growing exponentially while the pustule is growing logarithmic at that. meanwhile the republic cracked open the heartbleed
in quite the painful fashion, no matter how much effort went into "rehappening" it. not t
: aqnyway, the "hive mind" is fucking comedic already. FIVE YEARS with the subverted python, got them nowhere. close to five years pushing rust, nothing to show for it. systemd is still mostly a joke, and the hatred is growing exponentially while the pustule is growing logarithmic at that. meanwhile the republic cracked open the heartbleed
in quite the painful fashion, no matter how much effort went into "rehappening" it. not t ☟︎
: notice how he glued himself to heartbleed
(which, unlike the normal hanno bockian crap, was a surprise to the empire).
: after heartbleed
OpenSSL should have been avoided like the plague
: hoose to use corporate-maintained tools like OpenSSL, which are deeply compromised. Do you think the people responsible for HeartBleed
were held accountable, and fundamental changes were made? Guess again. It’s simply ignored by most of Linux. (You’ll notice real UNIXes like OpenBSD did not ignore it and have begun serious changes. Yet even there, it took such a serious, obvious exploit for them to see the engineering problem.)'
: 'Remember Heartbleed
? Don’t let that example escape your attention. OpenSSL is open, yet it is so large and poorly designed that it’s a dark mystery. Heartbleed
was easily shown to be a deliberate hack, and was even deliberately coded to hide itself from tools that would otherwise have shown the leak. And it was sitting there in ‘open’ sight. Instead of using small, well-reviewed crypto libraries, corporate Linux developers c
: <davout> for some reason this hoaxtoshi stuff seems very interesting to journos << Heartbleed
and the bash vulnerability made radio
: the modus operandi of the enemy is to insert 'bugs', e.g., 'heartbleed
', and to prevent attribution.
: the 'why' of this is best illustrated by the heartbleed
: Logged on 06-01-2016 15:46:58; ascii_butugychag: 'Filippo Valsorda. I'm Italian and I work on the CloudFlare Security Team in London. I built the public Heartbleed
test and I mess with cryptography. Public speaker. Motorbike rider. Frequent flyer. Hacker School F'13.'
: 'Filippo Valsorda. I'm Italian and I work on the CloudFlare Security Team in London. I built the public Heartbleed
test and I mess with cryptography. Public speaker. Motorbike rider. Frequent flyer. Hacker School F'13.' ☟︎
: Logged on 31-07-2015 03:53:10; asciilifeform: coderwill: on top of the thousand and one other sins, tor linked in ssl at the height of 'heartbleed
' - something which pretty much nobody is speaking of today
: coderwill: on top of the thousand and one other sins, tor linked in ssl at the height of 'heartbleed
' - something which pretty much nobody is speaking of today ☟︎
: your point about heartbleed
is well taken
: i personally refuse to make any distinction between someone who wrote, e.g., 'heartbleed
', into existence - and some other fella who ~knew of it and didn't tell me~
: <asciilifeform> 'Andy confirmed that Coverity does not spot the heartbleed
flaw and said that it remained stubborn even when they tweaked various analysis settings.' << Can't spot heartbleed
because custom OpenSSL malloc
: 'Andy confirmed that Coverity does not spot the heartbleed
flaw and said that it remained stubborn even when they tweaked various analysis settings.'
: mircea_popescu: do you have the source for the pull request where hearn tried to merge in heartbleed
: note for instance that the various "emergency problem - update required" stuff is in NEW-ish versions. like, heartbleed
? ubuntu 10.04 was fine. 12.04 ? owned.
: 'When we tried wget, it detected errors, retried, and finally succeeded. It said the error was a bad length field in a TLS packet. That didn't make sense at first because we thought TLS packets were error corrected by TCP.' << incidentally, i am not certain that i agree with the author's conclusion ('reverse heartbleed
'.) it may very well be an attempt to exploit other braindamage in http
is a read buffer overflow. What that means is that an application is reading outside the boundaries of a buffer. For example, imagine an application has a space in memory that's 10 bytes long. If the software tries to read 20 bytes from that buffer, you have a read buffer overflow."
: if there isn't another heartbleed
in there, someone's been slacking on their job.
: <thestringpuller> well only OpenSSL had heartbleed
<< The other big SSL implementations had their own flaws unveiled in the following months that essentially accomplished the same insecurity.
: Logged on 29-03-2015 16:49:24; Chillum: most protocols have had a vulnerability at some point. Heartbleed
was a bug in openssl, not a bug in ssl
: most protocols have had a vulnerability at some point. Heartbleed
was a bug in openssl, not a bug in ssl
: <Chillum> Routers are a sad state of affair. Something like 70% of consumer wifi routers in the wild are vulnerable to heartbleed
<< and a fella who knows this, is still fond of ssl ? amazing
: Routers are a sad state of affair. Something like 70% of consumer wifi routers in the wild are vulnerable to heartbleed
: I am aware of heartbleed
, an implementation failure
: Chillum: if you worked in security, did you sleep through 'heartbleed
: mats: if you have philosophical objections to 'behave as if X even if possibly ~X is true' then try to come up with some other syllogism. but it -must- end in 'the people who gave us heartbleed
and dual_ec DO NOT GET TO MAKE CRYPTO ANY MORE'
: Logged on 27-09-2014 02:35:49; asciilifeform: if you create a 'heartbleed
' - you are a вредитель. and whether you did it intentionally, given the impossibility of proof - does not matter.
: not that heartbleed
really matters for our purposes
: i suggest fixing by using a pre-heartbleed
: kinda weird how older clients naturally won't have heartbleed
did not test with anything other than the shortly post-heartbleed
turdball specified in 'portatronic'
: asciilifeform: or a lot of malice in the case of heartbleed
found it very surprising that tor survived as a going concern after 'heartbleed
: leaving aside that nobody i ever knew was seriously using the newer debian releases anyway for any purpose, you';d have to be fucking insane to think the way this goes is, we kill their heartbleed
and they sit and wait.
: "A failure to properly filter specially formed packets makes it possible for attackers to execute attack code of their choosing by sending malicious traffic to a Windows-based server." << sounds like windows had a replica of heartbleed
: and that n is pretty fuckingly scary high, what with the heartbleed
headshot and all the other outlays generously handed out by la serenissima.
: mircea_popescu: what if someone doesn't sign "heartbleed
introduction" then no one is accountable and system is moot
: you think heartbleed
: the hidden little shitgnomes like author of heartbleed
- they are the ones who needs the lethal sunlight rays the most.
: if you create a 'heartbleed
' - you are a вредитель. and whether you did it intentionally, given the impossibility of proof - does not matter. ☟︎
: (and yes - we know author of 'heartbleed
.' and he's alive and well and still contributing code to public projects, afaik. why? don't ask me)
: this is like saying that heartbleed
affected the better ssh implementation.
: Seems Heartbleed
gave OpenBSD the full paranoia as well
: this guy helped shut watch-only wallets and addresses out of the core client, while merging in heartbleed
: <asciilifeform> no heartbleed
, no pagerank. << search engines. next frontier of bitcoin.
: GinAddict1 mike is the chief enemy plant in bitcoin. he's the guy that merged heartbleed
in bitcoin for absolutely no legitimatereason, and he's the guy that forced a hard fork, idem.
: The author of the OpenSSL Heartbleed
bug also wrote the spec : programming
: imagine if you could be publicly executed for distributing heartbleed
: everybody can get behind the impalement of author of 'heartbleed
' but problem goes deeper.
: btw, speaking of the derp foundation : did it yet get around to pointing out that people who had stopped updating bitcoin pre 8.0 were invulnerable to heartbleed
, whereas people who hadn't stopped updating lost all their key material in the interval ?
: <asciilifeform> this is also the answer for why 'heartbleed
' was necessary, considering that usg has at-will access to root certs << not that simple.
: this is also the answer for why 'heartbleed
' was necessary, considering that usg has at-will access to root certs
: mircea_popescu: might be heartbleed
: Meet Cupid, the Heartbleed
attack that spawns evil Wi-Fi networks | Ars Technica
: they hint it's related to heartbleed
, NRPE or Ebury, not that I'd heard of the other 2
: ThickAsThieves i dare not think they perhaps haven't reported on heartbleed
yet, because well...
: on that note, often manufacturers explicitly forbid to install updates and servicepacks since it might well break the app. << since heartbleed
i'm going to forbid any upgrades as part of the contract in all cases, always and forever.
: HeySteve: it depends - if you're trading with them then they generally have to auth; whilst you can check with nickserv if they have enforce on and are identified Freenode have said that it's possible NS passwords were leaked coz of heartbleed
: Canadians arrest a Heartbleed
hacker - Apr. 16, 2014
: davout: I'll fathom that they had logins etc. scraped when they were Heartbleed
vulnerable, and the attackers waited till now to use them
: This reader mocked Heartbleed
, posted his passwords online. Guess what happened next.
: test its servers for heartbleed