[bradleyjg]

You first. What browser and OS are you posting from?

[speedgoose]

Not OS or browser but my SSH servers use Teleport and my HTTPS servers use Traefik or Caddy.

Caddy, Traefik, and Teleport are written in Golang and not using OpenSSL. It’s a start.

[timdoug]

I adore Go, but it seems to be impacted too: https://groups.google.com/g/golang-announce/c/dRtDK7WS78g

[komuW]

Filippo Valsorda(FiloSottile), who is the maintainer of Go's cryptography libraries said on Go's slack channel that the patch is unrelated.

See screenshot of the slack conversation: https://paste.pics/f5622033ae711b36e0bbcda393a67866

[woodruffw]

This is almost certainly a different bug. I don't believe Go's standard library uses OpenSSL.

[timdoug]

You’re right re: implementation —- I’m drawing a conclusion solely from the coordinated disclosure that it’s a similar crypto/TLS issue.

If the Go issues were distinct I’d imagine they’d choose a different day to disclose/release?

[woodruffw]

> If the Go issues were distinct I’d imagine they’d choose a different day to disclose/release?

I think it's just a funny coincidence. That's going based on what I know about the OpenSSL one; I don't know anything about the Go one. We'll find out!

[komuW]

it's unrelated; https://news.ycombinator.com/item?id=33382369

[speedgoose]

Indeed, it doesn’t sound like a coincidence.

[tester756]

>You first. What browser and OS are you posting from?

The ones that use Rust - Firefox and Windows

[bradleyjg]

Neither Firefox nor Windows are written wholly, or even substantially, in rust. I thought “we” were rejecting programs written in unsafe languages?

[pjmlp]

True, but outside the kernel Windows has enough infrastructure running in .NET code.

Additionally even if C++ is unsafe, it is still better than plain old C, which since Vista has been the migration path from kernel code. Nowadays there are even template libraries that can be used on kernel and drivers like WIL.

Finally the Microsoft Security Guidelines are:

1 - use managed languages if one can afford it

2 - use Rust

3 - use C++, alongside SAL and Core Guidelines checkers

[formerly_proven]

Firefox uses NSS for TLS, no?

[throwawaymaths]

If your server is in Erlang, it's probably dodged this (Erlang dodged heart bleed because it only uses ssl libs for cryptographic primitives)