top | item 7659033

How Heartbleed Leaked Private Keys

99 points| jgrahamc | 12 years ago |blog.cloudflare.com | reply

26 comments

order
[+] junto|12 years ago|reply
Every time I see a blog post from the Cloudflare team I am impressed.

It isn't just their attention to detail that is impressive. They go out of their way not just to point out issue, but suggest fixes.

Too many Heartbleed blog posts from across the blogosphere, and sadly, HN comments, set out to criticize without suggesting something better.

Cloudflare has shown again that they are actively engaging the community for the communities benefit as well as their own.

This seems to be a very effective marketing strategy (I assume it is anyway).

[+] ibmthrowaway218|12 years ago|reply
I would have been more impressed had their original assessment of heartbleed (on nginx) not been "We've reviewed the code and we don't think it's vulnerable."

Looking impressive with hindsight is relatively easy.

[+] yread|12 years ago|reply
I am still surprised there is code like

      if(b->d) OPENSSL_free(b->d);
in OpenSSL :(
[+] bbwharris|12 years ago|reply
Forgive me for asking but what is wrong in particular with this single line?

To me it reads fine and the idea is that is frees that data address if its occupied. I'm sure I'm not the only one who is curious why this is bad.

[+] pyvpx|12 years ago|reply
some folks much smarter than I thought it best to proverbially take it out back and shoot it. if you're not familiar with it already, the left overs are called LibreSSL.