I think what the grandparents is wondering is if Hacking Team have a 0day in Ope... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		qrmn on July 6, 2015 \| parent \| context \| favorite \| on: Forthcoming OpenSSL releases I think what the grandparents is wondering is if Hacking Team have a 0day in OpenSSL which this will fix, or is the timing coincidental? (I don't know the answer, but if they did, it's probably in that 400GB dump.) I'm mostly just wondering what they mean by HIGH. Something as bad as code execution or Heartbleed, or "just" something like bad DHE checking?

tedunangst on July 6, 2015 [–]

https://www.openssl.org/about/secpolicy.html

qrmn on July 6, 2015 | [–]

A policy which unfortunately lumps DoS in with remote code execution as both "high". They're both significant, but one's clearly going to give us all a much worse day than the other, so we're all still left to wonder - how bad is this one?

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact