Heartbleed exploit, inoculation, both released

[steve2470]

http://www.theregister.co.uk/2014/04/14/heartbleed_exploit_patch_both_released/

As the Heartbleed fallout continues, the good news is that code to protect against similar such attacks has been released. The bad news is that exploit code is also available.

Let's start with the latter, released by a chap who took up Cloudlare's challenge to coders in the hope someone, somewhere, would be able to use Heartbleed to extract a private SSL key from an undefended server it erected.

As we noted over the weekend, the challenge was met. The code for the 7th-fastest “solution” to the challenge is now available here.

The author apologises for the inelegance of the Python code he spent a day working on. Cloudflare says the winner took just nine hours to crack the server and run off with the SSL certificate.

more at link above

[Recursion]

1. Messy but convincing proof that open source is more secure

When exploits happen, they happen loudly.

Fortunately I run Debian, which is behind the times enough that this isn't an issue (and, yes, that is in fact why Debian stable stays so behind the times). If you're running Windows you don't need to worry; this is mostly for server administrators. I just wanted to comment to point out that this is actually an example of open source working: anybody who wants to can audit the code, and a few million auditors means it gets found pretty quickly.

If you run Mac, run an update. If you run a Linux distro, keep it updated. If you run a server, I assume you know what you're doing already...

[bemildred]

2. +1. Exactly right. nt