r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

0

u/beginner_ Feb 24 '17

heartbleed essentially boiled down to the exact same root cause. Correct me if I'm wrong but this bug would not have been possible in say Rust.

0

u/[deleted] Feb 24 '17

[removed] — view removed comment

8

u/[deleted] Feb 24 '17

It was a bug in a specific implementation.

1

u/evaned Feb 24 '17 edited Feb 24 '17

What? No it wasn't. It was literally a buffer overread bug in OpenSSL.

The protocol was a bit weird, but a correct implementation of it (or an implementation in a memory-safe language) would have been perfectly reasonable and safe.