Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Heartbleed Can Teach The OSS Community About Marketing

kalzumeus.com

Post reply on HN
Print view View original

61–70 of 119 posts

Re: What Heartbleed Can Teach The OSS Community About Marketing

#61

Post by IgorPartola »

I don't have a problem with making fanfare around the bug, but I cannot help but feel that the Linux and BSD distro maintainers should have been notified before it went public so that the patches would be available at the same time as the site goes up. Instead, Codenomicon caused them to have roughly 16-24 hour delay in releasing patched versions, while doing a poor job of communicating which versions of libssl are vulnerable (1.0.1 a-f were vulnerable, yet most distros use 1.0.1e and they patched that version instead of upgrading to 1.0.1g, making things very confusing).

So while all the marketing has been great for Codenomicon, it caused most sysadmins and distro maintainers more headache than it should have.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#63

Post by jdubs »

ef4 wrote: post #27
jdubs wrote: post #14

I just worry next time when a major incident occurs the author will spend more time working on the design than just announcing the issue.

At that point, speed isn't really the issue yet. Heartbleed was in the wild for two years . Would a day or two have made much difference? Highly unlikely. Speed matters after the disclosure, when every petty criminal and script kiddy in the world is suddenly empowered.

I agree with you, but what about the people that knew about this before hand? The article references cloud flair, on their blog it says that they knew about this before the rest of us, who is to say those individuals are not bad guys??

Re: What Heartbleed Can Teach The OSS Community About Marketing

#64

Post by [deleted] »

phillmv wrote: post #13

Yes entirely on name, visual identity and first three paragraphs. More like this for serious vulns, please. Also, what a great name. The remaining of the page is a loud reminder of the gap between the sec and dev communities, at least as practiced in lolstartupland. Or at least between offence and defence. The second paragraph tells you the sky is falling, and then it takes them 13 questions to tell you which openssl…

[deleted]

Re: What Heartbleed Can Teach The OSS Community About Marketing

#65

Post by Crito »

rubiquity wrote: post #19
bhousel wrote: post #9

Maybe MITRE should assign proper names to serious CVEs, kind of like hurricanes?

Oh, great. Then in a few years we can have minor security issues given names, too. Like how winter storms this past winter were called "Polar Vortexes." This world needs less media sensationalism, not more.

"Polar vortex" is not a proper name. Complaining about that is like complaining that we have given names to things like "buffer overflow bug" or "double free".

http://en.wikipedia.org/wiki/Polar_vortex

Re: What Heartbleed Can Teach The OSS Community About Marketing

#66

Post by ForHackernews »

rabino wrote: post #25
rubiquity wrote: post #18

I can't disagree with this post enough. Security exploitations shouldn't be about marketing. Security exploits should be handled first and then communicated to the public after the fact. The way Heartbleed was handled lead to a media firestorm. Other than Codenomic, who else benefitted from this? > Marketing Helps Accomplish Legitimate Goals Are you kidding me? The only goal of a security issue should be fixing it an…

No, a thousand times no. It's pretty obvious big targets would be on top of this. But given the severity of this bug you need to get to the lazy sysadmin, to the small ecommerce owner that doesn't have an on site admin, etc.

Small e-commerce sites and lazy sysadmins are probably running such old, outdated versions of OpenSSL that they aren't vulnerable to this bug anyway.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#67

Post by computer »

jmathai wrote: post #11
nodata wrote: post #8

"The Heartbleed announcement ... is masterful communication." You have to be kidding me. It took so long to decipher what I wanted to know that I went elsewhere. Edit: "masterful communication" this is not, since the reader doesn't know who the page is aimed at. Even a line at the top saying "Technical people go _here_", and then something aimed at technical people would be better.

But you did. What the communication accomplished was getting others who otherwise might not have heard about or cared enough to do something to take measures in fixing it. That's an enormous win.

He did because this is the worst internet bug in the past 10 years, not because the page was so masterfully written. Private keys and user passwords/data being disclosed will be cared about by systems administrators even without such a fancy page.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#68

Post by aculver »

forgottenpass wrote: post #60
aculver wrote: post #49

Earlier quoted context omitted.

Who is "the public" here? Why should package maintainers be hearing about this any sooner than me? I may not help maintain a popular Linux distribution, but I may very well run a service that my customers' bodily safety depends on the encryption of the SSL connection. (Hypothetical.) After disclosure, my only option is not to wait for a fix from my vendors and service providers, but to shut down my service (and lock…

I may very well run a service that my customers' bodily safety depends on the encryption of the SSL connection If that is the case, your FMEA needs to include undisclosed vulnerabilities in your communication channel's encryption, and the mitigation can't be telling the internet your particular opinions on responsible disclosure.

Whew. Good thing I don't run such a service. :-) (Edited my comment to better emphasize that it was hypothetical.)

Re: What Heartbleed Can Teach The OSS Community About Marketing

#69

Post by throwaway7767 »

IgorPartola wrote: post #61

I don't have a problem with making fanfare around the bug, but I cannot help but feel that the Linux and BSD distro maintainers should have been notified before it went public so that the patches would be available at the same time as the site goes up. Instead, Codenomicon caused them to have roughly 16-24 hour delay in releasing patched versions, while doing a poor job of communicating which versions of libssl are v…

Yes, not notifying at least the big linux distros and BSD projects was quite irresponsible. Everyone except for a few chosen service providers like cloudflare was thrown under a bus here.

Re: What Heartbleed Can Teach The OSS Community About Marketing

#70

Post by lmm »

patio11 wrote: post #54
teacup50 wrote: post #47

Earlier quoted context omitted.

You're demonstrating no understanding of how these things work. For updates to be deployed, the patches need to be integrated, tested, packages/updates build, and the update mechanisms tested. For complex systems -- like, say, embedded hardware -- this might involve targeting quite a few different devices and testing matrixes. Even scrambling, this can take days, and leaves users blowing in the wind in the meantime.…

I'm the guy who had to do it at my company, and in a previous career I'd be the boots-on-the-ground dealing with it at a rather larger company. I understand that vendors want a few weeks. I have lived the reality of ponderous engineering processes which need weeks to approve the smallest imaginable change. The for loop does not care what we want and does not get slower at counting to big numbers just because we are s…

> I also think it is a radically borked threat model which suggests that attackers only find out about vulnerabilities when the man-on-the-street does rather than when really-savvy-vendor-folk do.

Do you have a study? I remember an article here that suggested most Windows attacks were created by reverse-engineering MS patches rather than by discovering the vulnerabilities or reading about them on mailing lists; if that's the threat model then co-ordinating so that most vendors release patches at the same time is safer even if it means waiting longer for a patch.

Post reply on HN