We need a “/heartbleed.txt” standard, and we need it ASAP
1–10 of 51 posts
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#2In theory, one could expand this standard to allow for arbitrary mass-hack information.
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#3One of the April Fool's RFCs this year seems to have considered this issue, roughly:
http://www.rfc-editor.org/rfc/rfc7169.txt
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#4Biggest ever hole? Really? Am I the only one that remembers Yahoo placing passwords in the URL of unencrypted pages? I remember having to erase the URL line when people were around for fear of leaking my password.
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#5Biggest ever hole? Really? Am I the only one that remembers Yahoo placing passwords in the URL of unencrypted pages? I remember having to erase the URL line when people were around for fear of leaking my password.
...WHAT?! Did they use for their login forms?
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#6Well, it didn't take HN/Reddit long to hug that site to death...
Google's cache link doesn't seem to be working. Anyone else got a cache?
Edit: Ah, no, this seems to work now: http://webcache.googleusercontent.com/search?q=cache:blog.ka...
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#7Biggest ever hole? Really? Am I the only one that remembers Yahoo placing passwords in the URL of unencrypted pages? I remember having to erase the URL line when people were around for fear of leaking my password.
I hardly think that a security hole, no matter how large, at a single web site, is on the same magnitude as one security hole that probably impacts the majority of web sites on the internet and could have been taken advantage of completely invisibly for years.
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#8In theory, one could expand this standard to allow for arbitrary mass-hack information.
Yeah, I added an update to the bottom of the posting mentioning the possibility of generalizing it.
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#9Well, it didn't take HN/Reddit long to hug that site to death... Google's cache link doesn't seem to be working. Anyone else got a cache? Edit: Ah, no, this seems to work now: http://webcache.googleusercontent.com/search?q=cache:blog.ka...
Sorry. My blog doesn't usually get this much traffic. ;-)
Trying to increase the number of servers but httpd isn't cooperating.
Re: We need a “/heartbleed.txt” standard, and we need it ASAP
#10So sites ought to list their unpatched vulnerabilities? Erm?