🧢

Tag Archive for ‘Heartbleed’

How Apple Dodged Heartbleed ➝

Daniel Eran Dilger, writing for AppleInsider:

Building its own security software meant that Apple and its developers were no longer captive to the external development issues and eccentricities related to the OpenSSL open source project, which despite its critical importance and broad use by the industry, was being funded through donations and was, incredibly, maintained by a very small team of just four core developers.

Interesting piece about Apple deciding to build their own cryptography API.

NSA Said to Exploit Heartbleed Bug for Years ➝

What an embarrassment.

Researcher Proves Heartbleed Bug Exposes Private SSL Keys ➝

Josh Ong, reporting for The Next Web:

Fedor Indutny, a core member of the node.js team, has proved that it is in fact possible for an attacker to sniff out the private SSL keys from a server left exposed by the Heartbleed bug. The proof came in response to a challenge from CloudFlare that called on the security community to grab the keys from a demo server.

If there was ever a doubt in your mind, this proves that the Heartbleed bug is the real deal.

(Via Daring Fireball.)