Groups > comp.lang.java.programmer > #28188

Re: new JDK versions - OT

Path	csiph.com!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From	Martin Gregorie <martin@address-in-sig.invalid>
Newsgroups	comp.lang.java.programmer
Subject	Re: new JDK versions - OT
Date	Tue, 22 Apr 2014 23:28:55 +0000 (UTC)
Organization	A noiseless patient Spider
Lines	31
Message-ID	<lj6tvn$a7t$3@dont-email.me> (permalink)
References	<8qtsk9t7id2pv6dl56ugepkshhldq8a61t@4ax.com> <MGH3v.89100$dK.9728@fx07.iad> <2dr0l9hrcpei3nb2ii2h92ahgjntduev6p@4ax.com> <8C14v.219206$ZP3.145822@fx20.iad> <p0v1l91p9ndvvjr894k9275ss16agt1okg@4ax.com> <5351b6ca$0$294$14726298@news.sunsite.dk> <NuSdnWEnwrnRC87OnZ2dnUVZ7tSdnZ2d@bt.com> <22i7l993as7r9uhcpk8java7os9uib1bkm@4ax.com> <lj3v3r$kj$1@Gaia.teknon.de> <uul5v.119993$nm4.114034@fx27.iad> <slrnllddie.bi9.avl@login.logic.tuwien.ac.at>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8
Content-Transfer-Encoding	8bit
Injection-Date	Tue, 22 Apr 2014 23:28:55 +0000 (UTC)
Injection-Info	mx05.eternal-september.org; posting-host="e5160e2be48f1ea550cf61512446f525"; logging-data="10493"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/mEhM3MJDUqCePFqq+yrh/+3D8GTZtMlc="
User-Agent	Pan/0.139 (Sexual Chocolate; GIT bf56508 git://git.gnome.org/pan2)
Cancel-Lock	sha1:ZGsK1Vqf/aV5gWVDXc1ZiJF47zA=
Xref	csiph.com comp.lang.java.programmer:28188

Show key headers only | View raw

On Tue, 22 Apr 2014 18:34:54 +0000, Andreas Leitgeb wrote:

> Wayne <nospam@all.invalid> wrote:
>> On 4/21/2014 4:29 PM, Volker Borchert wrote:
>>> They'd just pay some software vendor or freeware programmer to
>>> introduce another backdoor. I'm not yet fully convinced that
>>> Heartbleed really was an accident... Besides, They [TM] are, by
>>> definition, The Good Guys [TM]
>> I am convinced it was an accident.
> 
> What would be even the point of having the server echo back a specific
> string, rather than just e.g. a counter value, if it wasn't as a stage
> for retrieving extra "data"?
> 
> Even if that buffer overflow is now fixed, the very feature of having
> the server say (and encrypt) a given string, independent of the actual
> protocol, may be a helper for future attacks.

I see on El Reg that the BSD gang have just forked the Open SSL library 
and are now promising a completely rewritten/refactored version with all 
cruft and support for obsolete OSen removed. They say the first published 
version of Libre SSL will be BSD only and released with v 5.6 but that 
they anticipate it will be ported to other OSen after that:

http://www.theregister.co.uk/2014/04/22/openssl_fork_libressl/


-- 
martin@   | Martin Gregorie
gregorie. | Essex, UK
org       |

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-16 05:29 -0700
  Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-16 23:15 -0400
    Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-17 17:12 -0700
      Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-18 00:12 -0400
        Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-18 03:21 -0700
          Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-18 17:27 -0400
          Re: new JDK versions Arne Vajhøj <arne@vajhoej.dk> - 2014-04-18 19:35 -0400
            Re: new JDK versions "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-20 10:40 +0100
              Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-20 06:22 -0700
                Re: new JDK versions Simon Lewis <simonlewis2001@gmail.com> - 2014-04-20 14:38 +0100
                Re: new JDK versions Jan Burse <janburse@fastmail.fm> - 2014-04-20 15:46 +0200
                Re: new JDK versions Jukka Lahtinen <jtfjdehf@hotmail.com.invalid> - 2014-04-20 20:55 +0300
                Re: new JDK versions v_borchert@despammed.com (Volker Borchert) - 2014-04-21 20:29 +0000
                Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-21 23:38 -0400
                Re: new JDK versions - OT Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-04-22 18:34 +0000
                Re: new JDK versions - OT Martin Gregorie <martin@address-in-sig.invalid> - 2014-04-22 23:28 +0000

csiph-web