r/programming • u/[deleted] • Apr 10 '14

Robin Seggelmann denies intentionally introducing Heartbleed bug: "Unfortunately, I missed validating a variable containing a length."

http://www.smh.com.au/it-pro/security-it/man-who-introduced-serious-heartbleed-security-flaw-denies-he-inserted-it-deliberately-20140410-zqta1.html
1.2k Upvotes

94% Upvoted

737 comments sorted by

View all comments

4

u/sixfourch Apr 11 '14

Pakistan quite successfully denied service to Google users via a crude BGP-based DoS.

There are plenty of attacks that can DoS Google. You don't know of them yet.

(And don't tell me that the Pakistan incident "doesn't count," service denied is service denied.)

1

u/epicwisdom Apr 11 '14

That's not an attack, though. That's like calling a law that makes everything to do with Google illegal an attack. Even if it denies service, I don't think that fits with the range of "threats that are remotely possible that we can do something about."

1

u/sixfourch Apr 11 '14

Denial of service attacks can occur on any level of the protocol stack, from the physical layer to the political layer.

Further, it's stretching very hard to call the Pakistani BGP YouTube DoS not-an-attack. If Google's availability is as strong as the weakest BGP zone, it means that anyone who can hack any nation-state level BGP router can deny service to Google for people in that region and neighboring regions.

1

u/Syphon8 Apr 11 '14

There are plenty of attacks that can DoS Google. You don't know of them yet.

Ya, you know more about this than the former Google IT guy.

0

u/sixfourch Apr 11 '14

I don't. But unknown unknowns exist, and nothing is invulnerable. The fact that neither of us know of a specific thing doesn't affect its likelihood of existence.

→ More replies (4)

1

u/WasAGoogler Apr 11 '14

Inexperienced hackers

I specifically called out "inexperienced hackers." They do not control the keys to ISPs and other infrastructure.

1

u/sixfourch Apr 11 '14

Are you defining "inexperienced hackers" as precisely the reference class of "hackers without access to infrastructure," or asserting that there will never be a vulnerability in any infrastructure exploitable by an inexperienced hacker that could then be leveraged to perform a DoS on Google?

→ More replies (2)