Re: Serious vulnerability in OpenSSL

From: Adam Constabaris <adam_constabaris_at_nyob>
Date: Tue, 8 Apr 2014 12:01:58 -0400
To: CODE4LIB_at_LISTSERV.ND.EDU
There are other options  for testing you can run locally, e.g.

http://pastebin.com/WmxzjkXJ

I'm pretty sure it doesn't send anything it finds anywhere else, but more
folks on this list (a) understand python to verify that for themselves and
(b) can run it right now than with Go =)

AC


On Tue, Apr 8, 2014 at 11:10 AM, Tod Olson <tod_at_uchicago.edu> wrote:

> There’s a nice “fork me on github” banner on the test site, so someone
> motivated could at least check the (purported) code and set up their
> own checker. So at least they have an implicit “you don’t need to trust
> us” sign.
>
> -Tod
>
> On Apr 8, 2014, at 10:00 AM, Francis Kayiwa <fkayiwa_at_COLGATE.EDU> wrote:
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 4/8/2014 10:27 AM, Chad Nelson wrote:
> >> Francis,
> >>
> >> Are you asking us to register our servers into a great big list of
> >> vulnerable machines?
> >
> > Assumption here was.
> >
> > Machine == vulnerable
> >
> > Patch on confirmation but your point is well received.
> >
> > ./fxk
> >
> >
> > - --
> > QOTD:
> >       "A child of 5 could understand this!  Fetch me a child of 5."
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v2.0.22 (MingW32)
> > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
> >
> > iQEcBAEBAgAGBQJTRA8AAAoJEOptrq/fXk6MgQkH/2iKSVs7MkCghRRqv+RvaI/l
> > Ul4lSQjIUDik0ofxlr7fywxP6CqbEkBAVCOGcVArrVTitpPe7w6/HAv6Q5uEZvDe
> > QPR2k2oXpjXn7Kbm9dZAs/FVhgArQxYLcHXjbfy6bd3vCuo65KyCIc1zd4C9ICkN
> > I1cUKgddwavuWszmjgI751bwLijtAEenWs6wW30iGpl7wyYMJV8+vkxkySxOb8rd
> > vA5tVkZTWaIT9FDR9+j08tOajFlrh9Ole9ypSPwVRj/zNDZwigzDi9Dwv8W2nNnX
> > 9ZNSkIUttIuUWL3+EXwLNdOKJa6Kgz9ztydjc0K2hskoS4YG9LyUX6i8JVJ95no=
> > =4zbB
> > -----END PGP SIGNATURE-----
>
Received on Tue Apr 08 2014 - 12:02:31 EDT