Re: Does Heartbleed count for the purposes of BR 4.9.1.1 point 11? ("proven or demonstrated method")

2019-05-27 Thread Jakob Bohm via dev-security-policy
On 27/05/2019 04:05, Matt Palmer wrote: On Sun, May 26, 2019 at 06:57:08PM -0700, Han Yuwei via dev-security-policy wrote: If malloc() is correctly implemented, private keys are secure from Heartbleed. So I think it doesn't meet the criteria. Just to make sure I'm understanding you correctly

Re: Does Heartbleed count for the purposes of BR 4.9.1.1 point 11? ("proven or demonstrated method")

2019-05-27 Thread Han Yuwei via dev-security-policy
在 2019年5月27日星期一 UTC+8上午10:05:25，Matt Palmer写道： > On Sun, May 26, 2019 at 06:57:08PM -0700, Han Yuwei via dev-security-policy > wrote: > > If malloc() is correctly implemented, private keys are secure from > > Heartbleed. So > > I think it doesn't meet the criteria. > > Just to make sure I'm unde

Re: Does Heartbleed count for the purposes of BR 4.9.1.1 point 11? ("proven or demonstrated method")

2019-05-26 Thread Matt Palmer via dev-security-policy
On Sun, May 26, 2019 at 06:57:08PM -0700, Han Yuwei via dev-security-policy wrote: > If malloc() is correctly implemented, private keys are secure from > Heartbleed. So > I think it doesn't meet the criteria. Just to make sure I'm understanding you correctly, you're saying that being vulnerable