I think thats other peoples wives

Id say your wifes pics are ok. There aint no one that deviant

Bit innocent?

XD So True up with bingo wings down with the rest XD

I didnt red thumb it but if a site doesn’t update their protocols then they are effected by loss in traffic and revenue. It doesnt cost us anything.

Ok the bug can be fixed with no cost agreed however most companies will do an immediate security review of their perimeter and intrusion detection systems. Along comes IT security vendor and goes you need this and this and this .

I disagree most sites will lose no traffic as most users will not have a clue of the site is vulnerable or not.

Of course most decent companies will do a security review. That would be the most sensible thing to do. I don’t see how this relates to the IT Security sector drumming up money though. And most large companies would (or should) have in-house security staff on their payroll anyway

The review is nearly always done in conjunction with a security company.

The update is virtually free and there is no way of finding out what data was leaked because of the nature of the bug.

Sure the NSA was using it very happily I bet.

There is an associated cost in fact and a benefit to security companies. Any site that was affected could have had encryption keys for SSL leaked (the bit that gives secure traffic over https) which means that, even after fixing, future traffic is still vulnerable. Hence companies will need to purchase and install new security certificates regardless of whether they know if they have been compromised as this vulnerability leaves no logs or trace.

Apologies for the nerd overload this early in the morning.

Declan, you are seriously underestimating the consequences of this bug. Security companies are as affected by this as are other companies, and security companies don’t stand to make profit from this. In fact, it will cost security companies money to fix vulnerabilities that may exist in the their own security solutions.

Brian… “It doesnt cost us anything.” It does if it’s your data being stolen from the provider.

David, any reputable CA will revoke certs and sign new ones for free. Otherwise the trust model would be broken. The only vendor I know of that is refusing to do this is StartSSL, who wouldn’t be the most reputable anyway.

Yes, in some case the security may involve assistance from security consultants but as has been said below, there is virtually no cause to be charged for new certificates, since it is a flaw in the certificate infrastructure. My (prolonged) point here is that this isn’t a conspiracy by the security sector. They took the time, and probably money to identify this bug. They should be praised for finding it, not accused of looking for extra money. The researchers involved are ridiculously intelligent people, I could only hope to have a fraction of their technical ability someday.

@ Declan – you should quit while you only look like a partial idiot, and not a full blown moron.

Barry I understand the potential consequences but the overall risk is not high. Even the sans dont have it as red in their threat level.

When you have worked as long as me in some of the worlds biggest companies in IT security then you can call me an idiot.

Some day you may work for me :-) in security.

Wow – you work in IT. How exciting. zzzzzzzzz

Overall risk is not high? Are you on drugs? Any application using the vulnerable version of OpenSSL (which is a lot of applications) can have their memory scraped. I seriously doubt you work in IT Security if you don’t understand the significant risk in that.

And of course SANS don’t list it as red. Have you ever actually looked at what the ISC classifications actually mean? https://isc.sans.edu/infocon.html

Careful, Barry – you may end up working for ‘Declan the IT security bigshot’ some day!

“worked as long as me in some of the worlds biggest companies in IT security”
“Some day you may work for me :-) in security.”

Declan, what job did you actually have in the “security” companies? Because I don’t believe you for a second. The level of incompetence you have shown in this thread is astounding for someone who claims to work in IT security.

Where in the Square? ;)

I’d tend to agree with you Declan, most users would not be aware so why should they be cautious. How many people have stopped using ATM machines because their card can be cloned and pin discovered and this is a very well publicised and much understood issue for years.

I was thinking the very same Declan

Re: sites loosing traffic. In the most part they won’t.

Oh really?

someonethinksweareallfools999!!

@Emilio

That password is obviously fake.

The are no uppercase characters and 2 exclamation marks together!!
Do you think we are all fools?

But I got me numbers in it!

Thanks Barry,
Good tip for PFS…

There will be a problem with routers as well as most routers have OpenSSL. So get on to your ISP to update software or if there is a software patch needed for them.

I first learned about Heartbleed from reading thejournal.ie – now I find out that routers are vulnerable.
Thanks 1 Human Being…

The Millennium Bug was a myth that was converted into a money-making scam by certain people in the IT industry.

Absolutely, Barry. The media whipped up a huge fear campaign and when the problem didn’t arise the people who fixed it got all the opprobrium. Should have been the messenger that got shot in that instance!

The millenium bug was real. Systems that had the bug would have presented a whole rosary of issues from minor malfunctions to total breakdowns. They had to be replaced or patched and they were.

You don’t have a clue about IT, do you? Thousands of developers in thousands of companies spent huge amounts of time and effort making sure the Millennium Bug was patched, before it became an issue.

The only reason there were no major systems crashes was because they were so good at their jobs.

By messenger I mean the media.