Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Heartbleed Can Teach The OSS Community About Marketing

kalzumeus.com

Post reply on HN
Print view View original

11–20 of 119 posts

Re: What Heartbleed Can Teach The OSS Community About Marketing

#11

Post by jmathai »

nodata wrote: post #8

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewhere. Edit: "masterful communication" this is not, since the reader doesn't know who the page is aimed at. Even a line at the top saying "Technical people go _here_", and then something aimed at technical people would be better.

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it.

That's an enormous win.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#12

Post by jdubs »

nodata wrote: post #8

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewhere. Edit: "masterful communication" this is not, since the reader doesn't know who the page is aimed at. Even a line at the top saying "Technical people go _here_", and then something aimed at technical people would be better.

"I know this is bad... but what exactly is broken... oh."

I think this is a case where the message could have been more concise.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#13

Post by phillmv »

Yes entirely on name, visual identity and first three paragraphs. More like this for serious vulns, please.

Also, what a great name.

The remaining of the page is a loud reminder of the gap between the sec and dev communities, at least as practiced in lolstartupland. Or at least between offence and defence. The second paragraph tells you the sky is falling, and then it takes them 13 questions to tell you which openssl versions are vulnerable.

(Also, I wish the behind the scenes action was less messy; why not coordinate with Debian and RedHat patches? Why did Cloudflare get advance notice?)

Re: What Heartbleed Can Teach The OSS Community About Marketing

#15

Post by valarauca1 »

nodata wrote: post #8

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewhere. Edit: "masterful communication" this is not, since the reader doesn't know who the page is aimed at. Even a line at the top saying "Technical people go _here_", and then something aimed at technical people would be better.

The announcement isn't for technical folks. If you want to know the in depth details then you likely have no issue referring to bugs as numbers, or reading up on the technical details of the exploit. When you announce something you give the information in a form that the public can understand.

For example if I announce a new processor, I'll announce its clock speed, number of cores. If I feel like getting in depth cache levels, and bus speed. A technical person will still have a million questions. But my announcement isn't for them, its for the lowest common denominator of people who care. Often times who have no clue of every technical aspect. Only the most simplistic understanding of the topic, if any at all.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#16

Post by mschuster91 »

phillmv wrote: post #13

Yes entirely on name, visual identity and first three paragraphs. More like this for serious vulns, please. Also, what a great name. The remaining of the page is a loud reminder of the gap between the sec and dev communities, at least as practiced in lolstartupland. Or at least between offence and defence. The second paragraph tells you the sky is falling, and then it takes them 13 questions to tell you which openssl…

Because Cloudflare is possibly the biggest and most vulnerable target due to the enormous number of websites and businesses relying on it. I would not be surprised if at least FB and Twitter also had early access.

It was clear from the beginning that as soon as the details became public, a race would begin for the script-kiddy-friendliest tool to own sites/users. And the most likely targets of script kiddies should be warned in advance.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#18

Post by rubiquity »

I can't disagree with this post enough. Security exploitations shouldn't be about marketing. Security exploits should be handled first and then communicated to the public after the fact. The way Heartbleed was handled lead to a media firestorm. Other than Codenomic, who else benefitted from this?

> Marketing Helps Accomplish Legitimate Goals

Are you kidding me? The only goal of a security issue should be fixing it and getting everyone else to update to the fix. Heartbleed will be remembered forever because of the BS marketing.

OpenSSL isn't a startup, it's a security library that is used by over half of the internet.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#19

Post by rubiquity »

bhousel wrote: post #9

Maybe MITRE should assign proper names to serious CVEs, kind of like hurricanes?

Oh, great. Then in a few years we can have minor security issues given names, too. Like how winter storms this past winter were called "Polar Vortexes." This world needs less media sensationalism, not more.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#20

Post by larrys »

Excellent writeup but as long as the subject is marketing and memorability in names (and in particular domain names) kalzeumus (or is it kalzumeus) isn't the easiest name to remember for a blog or business.

And it lends itself to many typos which is one of my areas of expertise along with branding. I can't easily tell someone "just go to kal zum e us dot com" like I can "heart bleed" (which by the way has a typo that would leak in high volume traffic to "blead" a bit).

Other than that I agree with what Patrick is saying, although I did find the use of "heartbleed" with something also referred to as "heartbeat" (which of course wouldn't be available as a domain name) a bit confusing at first.

Post reply on HN