Hacker News Reader

Comment by jgrahamc | Hacker News Reader

Are you asking why CloudFlare published their (our) blog post when we did? We did because the OpenSSL project had issued their advisory on the vulnerability already.

I personally observed the OpenSSL disclosure on this on the New page of Hacker News prior to our blog post being made live (and prior to submitting it to HN). You can also verify this yourself by following the New page backwards.

View on HN

I think that the question was, how come CF knew about this while other providers did not? I would assume that AWS would be on the short list...

Given that the OpenSSL team has slacked massively on setting up an advanced notification list, would you consider notifying distributions privately the next time you received word of something of this magnitude?

Not if they agreed not to disclose it, there is a lot of trust involved here.

True, although if nothing a discrete “You want full staffing ready for something bad next week” would have been polite.

The bigger question, though, is how much trust you can have with the kind of people who would zero-day most of the internet for a marketing exercise. Discrete notifications would have closed the vulnerability window for a lot of people (think e.g. stealthy AWS, Rackspace, etc. upgrades) and it's not clear to me that Codenomicon is likely to produce future tips of such value as to outweigh that.

This comment is better than 99% of the media coverage I've seen so far. Who announces a crucial SSL vulnerability that affects Twitter, AWS, Steam, Yahoo and Dropbox without notifying them first? They are making a name for themselves by exposing private information of millions of internet users. Also, I find it interesting that the vulnerability was discovered by Google's researcher and some of their main competitors weren't notified about it.

Reply on news.ycombinator.com