Very good “Diagnosis of the OpenSSL Heartbleed Bug” by @ex509: blog.existentialize.com/diag… BTW: “Start writing alternatives in safer languages”
2
4
6
@stilkov actual lesson is don’t do your own memory management; this failure transcends language
1
@assaf If your language doesn’t allow you to do memory management, that seems like a plus
1
@stilkov except they all do. it's called array. reuse an array, copy data in/out, eventually data leaks out.
2
@assaf Of course you can do anything in any language. Doesn’t mean you actually would.
2
@stilkov reusing objects and buffers? We used to do that all the time in Java. J2EE designed APIs around that.
1