Hacker News Reader

Interestingly, your tool claims our website (SSL-terminated at our ELB instance) is still vulnerable; while this other tool (http://possible.lv/tools/hb) claims we are unaffected.

Another, known unpatched, app is reported to be affected by both tools.

Is it possible that FiloSottile/Hearbleed may report false positives?

View on HN

From what I've learned, it reports back if it gets something, when it should get nothing.

How vulnerable a specific site is depends on luck. Yahoo must have broken a whole bunch of mirrors because total amateurs can send mail.yahoo.com a certain blob of code and it has a good chance of returning a stranger's password.

Reply on news.ycombinator.com