Hacker News Reader

Is there a way to tell if a third-party site has patched the bug? (Upgraded to 1.0.1g) Not much point in changing your password on that site before the vulnerability is fixed.

View on HN

Someone wrote this: http://filippo.io/Heartbleed/

echo -e "quit\n" | openssl s_client -connect <HOSTNAME>:443 -tlsextdebug 2>&1| [ "` grep -c 'TLS server extension \"heartbeat\" (id=15), len=1'`" -gt 0 ] && echo 'Vulnerable'

That can false-positive, for what it's worth, in servers with fixed TLS heartbeats (instead of removing them).

Reply on news.ycombinator.com