Dawnrazor.co.uk

Due to recent event I ran a check on the https version of the forum - the site seems pretty well configured, thanks Mark

No, it's not. It's just old. OpenSSL 0.9.8.

Schneier's comments on this are also great: https://www.schneier.com/blog/archives/ ... bleed.html

Plus those quotes:

"Has anyone looked at all the low-margin non-upgradable embedded systems that use OpenSSL? An upgrade path that involves the trash, a visit to Best Buy, and a credit card isn't going to be fun for anyone."

"I'm hearing that the CAs are completely clogged, trying to reissue so many new certificates. And I'm not sure we have anything close to the infrastructure necessary to revoke half a million certificates."

And all by adding a feature to OpenSSL which makes no sense at all. Brilliant!

Well, it was about time I change my own zillion passwords anyway.

markandre13 wrote:No, it's not. It's just old. OpenSSL 0.9.8.

But still scores good on ssllabs feature test

And all by adding a feature to OpenSSL which makes no sense at all. Brilliant!

Yes, that was really great, bug due to an unnecessary/useless? extension of a feature that, as far as its primary function is concerened, is redundant anyway

Now the https connection is really hit: http://www.openssl.org/news/secadv_20140605.txt
It's also bad timing because I'm off to the WGT.