Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28185

Re: new JDK versions - OT

From Andreas Leitgeb <avl@auth.logic.tuwien.ac.at>
Newsgroups comp.lang.java.programmer
Subject Re: new JDK versions - OT
Date 2014-04-22 18:34 +0000
Organization A noiseless patient Spider
Message-ID <slrnllddie.bi9.avl@login.logic.tuwien.ac.at> (permalink)
References (5 earlier) <5351b6ca$0$294$14726298@news.sunsite.dk> <NuSdnWEnwrnRC87OnZ2dnUVZ7tSdnZ2d@bt.com> <22i7l993as7r9uhcpk8java7os9uib1bkm@4ax.com> <lj3v3r$kj$1@Gaia.teknon.de> <uul5v.119993$nm4.114034@fx27.iad>

Show all headers | View raw

Wayne <nospam@all.invalid> wrote:
> On 4/21/2014 4:29 PM, Volker Borchert wrote:
>> They'd just pay some software vendor or freeware programmer to introduce
>> another backdoor. I'm not yet fully convinced that Heartbleed really was
>> an accident... Besides, They [TM] are, by definition, The Good Guys [TM]
> I am convinced it was an accident.

What would be even the point of having the server echo back a
specific string, rather than just e.g. a counter value, if it
wasn't as a stage for retrieving extra "data"?

Even if that buffer overflow is now fixed, the very feature 
of having the server say (and encrypt) a given string, independent
of the actual protocol, may be a helper for future attacks.

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-16 05:29 -0700
  Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-16 23:15 -0400
    Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-17 17:12 -0700
      Re: new JDK versions Wayne <nospam@all.invalid> - 2014-04-18 00:12 -0400
        Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-18 03:21 -0700
          Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-18 17:27 -0400
          Re: new JDK versions Arne Vajhøj <arne@vajhoej.dk> - 2014-04-18 19:35 -0400
            Re: new JDK versions "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-20 10:40 +0100
              Re: new JDK versions Roedy Green <see_website@mindprod.com.invalid> - 2014-04-20 06:22 -0700
                Re: new JDK versions Simon Lewis <simonlewis2001@gmail.com> - 2014-04-20 14:38 +0100
                Re: new JDK versions Jan Burse <janburse@fastmail.fm> - 2014-04-20 15:46 +0200
                Re: new JDK versions Jukka Lahtinen <jtfjdehf@hotmail.com.invalid> - 2014-04-20 20:55 +0300
                Re: new JDK versions v_borchert@despammed.com (Volker Borchert) - 2014-04-21 20:29 +0000
                Re: new JDK versions - OT Wayne <nospam@all.invalid> - 2014-04-21 23:38 -0400
                Re: new JDK versions - OT Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-04-22 18:34 +0000
                Re: new JDK versions - OT Martin Gregorie <martin@address-in-sig.invalid> - 2014-04-22 23:28 +0000

csiph-web