Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-14 Thread Matthias Apitz
some nice pictures how the bug works: http://www.xkcd.com/1354/ HIH matthias -- Sent from my FreeBSD netbook Matthias Apitz, , http://www.unixarea.de/ f: +49-170-4527211 UNIX since V7 on PDP-11, UNIX on mainframe since ESER 1055 (IBM /370) UNIX on x86 since SVR4.2 UnixWare 2.1.2, FreeB

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Michael Smith
On Apr 12, 2014, at 5:40 PM, Michael Tuexen wrote: >> >> "Introduced with intent" vs. "known to the NSA" -- two >> different things, right? > My statement was referring to the "Introduced with intend". Understood. I'm personally quite sure it *wasn't* introduced with intent, which is why I

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Michael Tuexen
On 12 Apr 2014, at 21:43, Michael Smith wrote: > > On Apr 12, 2014, at 3:08 PM, Michael Tuexen > wrote: >>> >> I have read the rumor. It is wrong. > > "Introduced with intent" vs. "known to the NSA" -- two > different things, right? My statement was referring to the "Introduced with inten

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Matthias Apitz
El día Saturday, April 12, 2014 a las 03:43:29PM -0400, Michael Smith escribió: > > On Apr 12, 2014, at 3:08 PM, Michael Tuexen > wrote: > >> > > I have read the rumor. It is wrong. > > "Introduced with intent" vs. "known to the NSA" -- two > different things, right? > > I don't have any

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Matthias Apitz
El día Saturday, April 12, 2014 a las 03:43:29PM -0400, Michael Smith escribió: > > On Apr 12, 2014, at 3:08 PM, Michael Tuexen > wrote: > >> > > I have read the rumor. It is wrong. > > "Introduced with intent" vs. "known to the NSA" -- two > different things, right? > > I don't have any

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Jan Danielsson
On 12/04/14 21:30, Matthias Apitz wrote: >> http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817504d069b4c5082161b02a22116ad75f822b1 > > Thanks for the git diff (and the other statements). Could you please be > so kind and point to the exact place of the offending statement (or > missing b

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Michael Smith
On Apr 12, 2014, at 3:08 PM, Michael Tuexen wrote: >> > I have read the rumor. It is wrong. "Introduced with intent" vs. "known to the NSA" -- two different things, right? I don't have any direct knowledge of what goes on in the NSA, but if they don't have a whole cubicle farm full of p

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Matthias Apitz
El día Saturday, April 12, 2014 a las 09:30:22PM +0200, Matthias Apitz escribió: > El día Saturday, April 12, 2014 a las 09:08:15PM +0200, Michael Tuexen > escribió: > > > > What is the exact bug, can someone show a svn/git diff of the first > > > source version having the bug? > > http://git.op

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Michael Tuexen
On 12 Apr 2014, at 21:30, Matthias Apitz wrote: > El día Saturday, April 12, 2014 a las 09:08:15PM +0200, Michael Tuexen > escribió: > >>> What is the exact bug, can someone show a svn/git diff of the first >>> source version having the bug? >> http://git.openssl.org/gitweb/?p=openssl.git;a=com

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Matthias Apitz
El día Saturday, April 12, 2014 a las 09:08:15PM +0200, Michael Tuexen escribió: > > What is the exact bug, can someone show a svn/git diff of the first > > source version having the bug? > http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817504d069b4c5082161b02a22116ad75f822b1 > > Hi,

Re: the nature of the heartbeat issue (was Re: OpenSSL Security Advisory)

2014-04-12 Thread Michael Tuexen
On 12 Apr 2014, at 17:43, Matthias Apitz wrote: > El día Wednesday, April 09, 2014 a las 01:05:22AM -0700, monloi perez > escribió: > >> True. Thanks for the quick reply. >> >> >> On Wednesday, April 9, 2014 3:33 PM, Alan Buxey >> wrote: >> >> https://www.openssl.org/news/changelog.html