Groups > comp.lang.java.programmer > #28188

Re: new JDK versions - OT

From	Martin Gregorie <martin@address-in-sig.invalid>
Newsgroups	comp.lang.java.programmer
Subject	Re: new JDK versions - OT
Date	2014-04-22 23:28 +0000
Organization	A noiseless patient Spider
Message-ID	<lj6tvn$a7t$3@dont-email.me> (permalink)
References	(6 earlier) <NuSdnWEnwrnRC87OnZ2dnUVZ7tSdnZ2d@bt.com> <22i7l993as7r9uhcpk8java7os9uib1bkm@4ax.com> <lj3v3r$kj$1@Gaia.teknon.de> <uul5v.119993$nm4.114034@fx27.iad> <slrnllddie.bi9.avl@login.logic.tuwien.ac.at>

Show all headers | View raw

On Tue, 22 Apr 2014 18:34:54 +0000, Andreas Leitgeb wrote:

> Wayne <nospam@all.invalid> wrote:
>> On 4/21/2014 4:29 PM, Volker Borchert wrote:
>>> They'd just pay some software vendor or freeware programmer to
>>> introduce another backdoor. I'm not yet fully convinced that
>>> Heartbleed really was an accident... Besides, They [TM] are, by
>>> definition, The Good Guys [TM]
>> I am convinced it was an accident.
> 
> What would be even the point of having the server echo back a specific
> string, rather than just e.g. a counter value, if it wasn't as a stage
> for retrieving extra "data"?
> 
> Even if that buffer overflow is now fixed, the very feature of having
> the server say (and encrypt) a given string, independent of the actual
> protocol, may be a helper for future attacks.

I see on El Reg that the BSD gang have just forked the Open SSL library 
and are now promising a completely rewritten/refactored version with all 
cruft and support for obsolete OSen removed. They say the first published 
version of Libre SSL will be BSD only and released with v 5.6 but that 
they anticipate it will be ported to other OSen after that:

http://www.theregister.co.uk/2014/04/22/openssl_fork_libressl/


-- 
martin@   | Martin Gregorie
gregorie. | Essex, UK
org       |

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-16 05:29 -0700
  Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-16 23:15 -0400
    Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-17 17:12 -0700
      Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-18 00:12 -0400
        Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-18 03:21 -0700
          Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-18 17:27 -0400
          Re: new JDK versions Arne Vajhøj <arne@vajhoej.dk> - 2014-04-18 19:35 -0400
            Re: new JDK versions "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-20 10:40 +0100
              Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-20 06:22 -0700
                Re: new JDK versions Simon Lewis <simonlewis2001@gmail.com> - 2014-04-20 14:38 +0100
                Re: new JDK versions Jan Burse <janburse@fastmail.fm> - 2014-04-20 15:46 +0200
                Re: new JDK versions Jukka Lahtinen <jtfjdehf@hotmail.com.invalid> - 2014-04-20 20:55 +0300
                Re: new JDK versions v_borchert@despammed.com (Volker Borchert) - 2014-04-21 20:29 +0000
                Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-21 23:38 -0400
                Re: new JDK versions - OT Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-04-22 18:34 +0000
                Re: new JDK versions - OT Martin Gregorie <martin@address-in-sig.invalid> - 2014-04-22 23:28 +0000

csiph-web