M
Maynard A. Philbrook Jr.
Guest
In article <ooahk91t47mi7a99g5pnjf2b9njusfbnh7@4ax.com>,
jjlarkin@highNOTlandTHIStechnologyPART.com says...
After what I've seen happening with the security agencies that we are
suppose to trust, I don't discount foul play.
I too, do C/C++ programming and that sort of bug to me is not
accidental.
I can think of only one reason to have an additional buffer length in
the message package and have the software ignore the primary buffer
length.
The problem here is, the OpenSSL should of tested for that from day one
or totally ignore any data in the buffer for size parameters.
Sorry, sounds a little fishy to me.
Jamie
jjlarkin@highNOTlandTHIStechnologyPART.com says...
On Fri, 11 Apr 2014 20:24:01 -0700, josephkk <joseph_barrett@sbcglobal.net
wrote:
See Link:
http://arstechnica.com/security/2014/04/critical-crypto-bug-exposes-yahoo-mail-passwords-russian-roulette-style/
?;..((
Here is the technical analysis:
http://xkcd.com/1354/
And some details:
http://www.theregister.co.uk/2014/04/09/heartbleed_explained
which reinforces what an astonishingly bad programming language c is.
After what I've seen happening with the security agencies that we are
suppose to trust, I don't discount foul play.
I too, do C/C++ programming and that sort of bug to me is not
accidental.
I can think of only one reason to have an additional buffer length in
the message package and have the software ignore the primary buffer
length.
The problem here is, the OpenSSL should of tested for that from day one
or totally ignore any data in the buffer for size parameters.
Sorry, sounds a little fishy to me.
Jamie