I find this comment at Wonkette plausible.

http://wonkette.com/...DComment816885653

szielins 1 day ago

Heartbleed was too weak an exploit for NSA to BOTHER to keep to itself. It's impossible to target against an individual, difficult to get anything out of in the first place, and at ~100K - 2.6M requests per private SSL key retrieved (against NGINX on Linux), the attempt to exploit it would stand out like a sore thumb. More importantly, as of 2008, NSA had a laundry list of exploits that don't have these flaws-- and there's no reason to believe they haven't added to the list since. For NSA, going public with Heartbleed would have been a fine propaganda move to make them look more like white hats, while reducing the effectiveness of their surveillance efforts not at all.

Cites to Bruce Schneier, who combines knowing what he's talking about with being a good explainer: Heartbleed's low exploitability demonstrated: More on Heartbleed. NSA had lots of good exploits, and is likely to have better now: Postmortem: NSA Exploits of the Day.

Someone at the NSA may have known about it, but they may not have been in a position to do anything about it. Or they may have known about it and decided to let sleeping dogs lie. Who knows. We all know there are likely similar coding errors out there...

The NSA isn't all powerful. They have limited time and resources, too.

I've been wondering why the IETF or similar group hasn't been more involved in this - e.g. http://www.ietf.org/...asive-monitoring/

FWIW.

Cheers,
Scott.

Post #388,545 by Another Scott 4/14/14 8:04:31 AM Reply	I find this comment at Wonkette plausible. http://wonkette.com/...DComment816885653 szielins 1 day ago Heartbleed was too weak an exploit for NSA to BOTHER to keep to itself. It's impossible to target against an individual, difficult to get anything out of in the first place, and at ~100K - 2.6M requests per private SSL key retrieved (against NGINX on Linux), the attempt to exploit it would stand out like a sore thumb. More importantly, as of 2008, NSA had a laundry list of exploits that don't have these flaws-- and there's no reason to believe they haven't added to the list since. For NSA, going public with Heartbleed would have been a fine propaganda move to make them look more like white hats, while reducing the effectiveness of their surveillance efforts not at all. Cites to Bruce Schneier, who combines knowing what he's talking about with being a good explainer: Heartbleed's low exploitability demonstrated: More on Heartbleed. NSA had lots of good exploits, and is likely to have better now: Postmortem: NSA Exploits of the Day. Someone at the NSA may have known about it, but they may not have been in a position to do anything about it. Or they may have known about it and decided to let sleeping dogs lie. Who knows. We all know there are likely similar coding errors out there... The NSA isn't all powerful. They have limited time and resources, too. I've been wondering why the IETF or similar group hasn't been more involved in this - e.g. http://www.ietf.org/...asive-monitoring/ FWIW. Cheers, Scott.
Post #388,546 by Another Scott 4/14/14 8:56:04 AM Reply	Note the followup if you use Chrome. http://wonkette.com/...DComment817171897 (Tangentially related: I just found out Chrome, by default, doesn't handle certificate revocations correctly. Anyone using Chrome: if you haven't already, go into the advanced preferences and tick "Check for server certificate revocation". See Certificate Revocation and Heartbleed for more information.) <sigh> Cheers, Scott.
Post #388,549 by a6l6e6x 4/14/14 12:18:46 PM Reply	So Google doesn't understand the implications of... its own discovery? Sigh, indeed. Alex ÂThere is a cult of ignorance in the United States, and there has always been. The strain of anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that "my ignorance is just as good as your knowledge.Â -- Isaac Asimov
Post #388,592 by scoenye 4/15/14 6:44:12 PM Reply	Deliberately turned off as of 2012 https://www.imperial...2/05/crlsets.html AFAIK, Firefox does not check anymore either. The basic problem is that current infrastructure can't handle the volume to respond in a timely fashion, but there are other problems as well. Some alternatives are being batted around, but so far, they're also full of holes.
Post #388,595 by Another Scott 4/15/14 7:19:35 PM Reply	I wonder if "Lifelock" is getting a spike in business... :-(

Welcome to IWETHEY!