41–50 of 88 posts
If your site is protected by CloudFlare (like HN is), you are automatically protected from this vulnerability (see: http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab... ).
An Ubuntu update would be nice right about now. Outside of disabling everything that uses openssl or compiling a new one manually, there's not much I can do to secure my servers at this moment. Meanwhile, I'm guessing a lot of not so nice people are racing to scan IP ranges for this bug.
Earlier quoted context omitted.
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
A lot of people are doing spiped-like things using stunnel.
So the strawmen arguments about it not replacing TLS is not the point.
stud, nginx, stunnel, f5 load balancers and cloudflare will still be needed for now, until 'moxie0 or someone comes up with a viable CA alternative AND something way, way simpler than TLS (brain-hurt ASN1, even with Wireshark).
Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory?
The number of installed openssl clients across all devices and computers must be quite large.
In case anyone was wondering why I wrote spiped...
But isn't spiped mostly irrelevant here? I mean, it's not a TLS replacement, as it's based on PSK (thus only useable between two mutually trusting peers like me and myself), not PKI.
( export CONFIGURE_OPTS='no-hw no-rdrand \
no-sctp no-md4 no-mdc2 no-rc4 no-fips no-engine'; \
brew install https://gist.github.com/steakknife/8228264/raw/openssl.rb )
Are Android or iOS affected? Android seems to ship openssl 1.0. Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory? The number of installed openssl clients across all devices and computers must be quite large.
Are Android or iOS affected? Android seems to ship openssl 1.0. Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory? The number of installed openssl clients across all devices and computers must be quite large.