[170942] in North American Network Operators' Group
Re: [[Infowarrior] - NSA Said to Have Used Heartbleed Bug for Years]
daemon@ATHENA.MIT.EDU (Warren Bailey)
Sun Apr 13 13:27:20 2014
From: Warren Bailey <wbailey@satelliteintelligencegroup.com>
To: Niels Bakker <niels=nanog@bakker.net>, "nanog@nanog.org" <nanog@nanog.org>
Date: Sun, 13 Apr 2014 17:26:39 +0000
In-Reply-To: <20140413165250.GI36211@burnout.tpb.net>
Reply-To: Warren Bailey <wbailey@satelliteintelligencegroup.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Doesn't OpenSSL even fundraise? Based on the number of dollars they've take=
n in (what I could find online) most of them are better off taking side job=
s as psychics to pay for audits. I know of at least one thing they could ha=
ve predicted in the future. ;)
Sent from my T-Mobile 4G LTE Device
-------- Original message --------
From: Niels Bakker <niels=3Dnanog@bakker.net>
Date: 04/13/2014 10:55 AM (GMT-07:00)
To: nanog@nanog.org
Subject: Re: [[Infowarrior] - NSA Said to Have Used Heartbleed Bug for Year=
s]
* randy@psg.com (Randy Bush) [Sun 13 Apr 2014, 16:52 CEST]:
>>>the point of open source is that the community is supposed to be
>>>doing this. we failed.
>>Versus all of the closed source bugs that nobody can know of or do
>>anything about?
>for those you can blame the vendor.
BSAFE is almost worse if you go by the recent advisories that have
been released about it. Many vendors incorporated OpenSSL into their
products and sold the result for commercial profit without doing
(in retrospect) enough due diligence. Besides, having a third party
to blame doesn't make our data safer...
At least one vendor, Akamai is helping out now:
http://marc.info/?l=3Dopenssl-users&m=3D139723710923076&w=3D2
I hope other vendors will follow suit.
>this one is owned by the community. it falls on us to try to lower
>the probability of a next one by actively auditing source as our
>civic duty.
I donated some money to the OpenSSL project and hope others will do,
or have already done, the same. It's clear that they are internet
infrastructure and need more support.
-- Niels.
