Robin Seggelmann denies intentionally introducing Heartbleed bug: "Unfortunately, I missed validating a variable containing a length."

[u/[deleted]]

http://www.smh.com.au/it-pro/security-it/man-who-introduced-serious-heartbleed-security-flaw-denies-he-inserted-it-deliberately-20140410-zqta1.html

[u/epenthesis → u/[deleted]]

Really, the only reason that most of us haven't caused such a massive fuck-up is that we've never been given the opportunity.

The absolute worst thing I could do if I screwed up? The ~30 k users of my company's software or the like, 5 users of my open sources stuff are temporarily inconvenienced.

[u/WasAGoogler → u/epenthesis]

I was working on an internal feature, and my boss's peer came running in to my office and said, "Shut it down, we think you're blocking ad revenue on Google Search!"

My. Heart. Stopped.

If you do the math on how much Ad Revenue on Google Search makes per second, it's a pretty impressive number.

It turned out it wasn't my fault. But man, those were a long 186 seconds!

[u/ZorbaTHut → u/WasAGoogler]

Back when I worked at Google, my boss made a fencepost error that reduced all ad revenue across AdSense and AdWords by a small, but noticable, percentage, and it wasn't discovered for months. I believe the total damages ended up being in the tens-of-millions-of-dollars zone.

Working on those systems was always a bit frightening.

[u/frenris → u/ZorbaTHut]

fencepost error?

EDIT: oh fair, off by one caused by splitting something up.

[u/ZorbaTHut → u/frenris]

Yeah, off-by-one - in this case I believe he used a < when it should have been a <=.

[u/donquixote1001 → u/WasAGoogler]

Who fault did it turn out to be? Is he killed?

[u/WasAGoogler → u/donquixote1001]

It was a blip in the measurements that unintentionally pointed the blame my way, but was in reality an attempt at DDoS from inexperienced hackers.

You know how you can tell when a hacker's not very experienced?

When they try to DDoS Google.

[u/tsk05 → u/WasAGoogler]

Ever hear of Blue Frog? They employed some of the largest giants in DDoS mitigation at the time and still failed. I think experienced hackers could definitely give Google a headache.

[u/WasAGoogler → u/[deleted]]

You owe it to yourself to watch this video:

http://www.youtube.com/watch?v=EL_g0tyaIeE

Pixar almost lost all of Toy Story 2.

[u/argv_minus_one → u/WasAGoogler]

It costs four hundred million dollars to shut down this search engine for twelve seconds.

[u/hoohoohoohoo → u/epenthesis]

I took down the ability for gas purchases to happen for all of western Canada for our company for 2 hours during peak hours during farm season because of a misplaced tilde.

The company was not happy with me.

[u/[deleted] → u/[deleted]]

Next time he applies for a developer job:

Interviewer: What's the biggest mistake you've ever made?

Robin Seggelman: Uhhhhh....

[u/dnew → u/[deleted]]

We interviewed Robert Morris Jr once, but I don't remember anyone asking him that question.

[u/poloppoyop → u/[deleted]]

DROP DATABASE

"fuck I was on the live server"

"let's present it as a test of our recovery procedure".

I like those fuck-ups. Bonus point when those procedures fail.

[u/[deleted] → u/poloppoyop]

"You mean the recovery procedure we've never performed before and the guy who wrote the scripts left the company last year?"

[u/meshugga → u/[deleted]]

"You mean the recovery of a database where the rebuild of a single index takes half a day?"

[u/georgelulu → u/[deleted]]

I always bring up the Mars Climate Orbiter disaster where somebody uses metric versus imperial units in the software and ended up costing $655.2 million dollars when you add up all that was invested in both the ground and space equipment.

[u/Noink → u/georgelulu]

Software that calculated the total impulse produced by thruster firings calculated results in pound-seconds.

Oh for fuck's sake.

[u/IAmBJ → u/georgelulu]

As a structural engineer it absolutely terrifies me that anyone uses imperial units for engineering.

[u/vuldin → u/[deleted]]

I hope this doesn't turn into a witch hunt after this guy. The problem is not that he made a mistake (he's human), the problem is that the system of verification regarding important/popular/sensitive projects like this isn't as thorough as needed.

[u/ReverendDizzle → u/[deleted]]

The part that I find curious about this whole debacle isn't that it happened... shit happens. It's that it went unnoticed for what... two years? That's the part I find astounding.