From what I know, the HeartBleed bug seems to occur around 15 hours ago. As per heartbleed.com, the HeartBleed bug was independently discovered by a team of security engineers at Codenomicon.

How did the public came to know about the news?

Where is the first online reference to the "HeartBleed" bug?

  • 1
    Is knowing the first online reference helping you solve a problem? Or is this just a trivia question?
    – House
    Apr 8, 2014 at 16:16
  • There is some ongoing debate on the Cloudflare blog about whether responsible disclosure was adhered to for this vulnerability. Maybe that is at the root of this question. Apr 8, 2014 at 16:22
  • 2
    @Byte56, Is how the vulnerability info disseminated not a security question?
    – Pacerier
    Apr 8, 2014 at 16:23

2 Answers 2


Hackernews user eastdakota (probably Matthew Prince) is the CEO and co-founder of CloudFlare (according to the HN bio) and has publicly stated that:

One of the individuals who discovered the [Heartbleed] bug contacted us as a large provider of SSL termination services. We were asked not to further disclose the details until it was officially patched and announced by OpenSSL. The official announcement occurred today after which we put up a post to let our customers know that they were protected.


...we held the post informing our customers that they were protected from the bug until after it was officially announced by the organizations that had discovered it as well as by OpenSSL

And also:

The bug was discovered by a researcher at Google and three engineers at Codenomicon.


The vulnerability was first reported to OpenSSL by Neel Mehta from Google Security. Matti Kamunen, Antti Karjalainen and Riku Hietamäki from Codenomicon Oy reported the vulnerability to NCSC-FI, who reported it in turn to OpenSSL. NCSC-FI would like to thank Codenomicon for reporting and analysing the vulnerability.

The heartbleed.com site is registered to Codenomicon

Registrar URL: http://www.godaddy.com
Registrant Name: Marko Laakso
Registrant Organization: Codenomicon Oy

So going from what Matthew has said, it appears that the first public disclosure was either the OpenSSL Security Advisory or heartbleed.com, and the rest is history.

The Cloudflare blog post is 21 hours old at the present time, with the Hackernews post now at 20 hours old, so the initial announcements from OpenSSL / heartbleed.com are probably not much older than that.

Edit: heartbleed.com now states:

OpenSSL Security Advisory (published 7th of April 2014, ~17:30 UTC)
Cloudflare Blog Entry (published 7th of April 2014, ~18:00 UTC)
heartbleed.com (published 7th of April 2014, ~19:00 UTC)


I was first alerted to this site Monday at 17:55 EST through a security discussion group. http://heartbleed.com/ The site has numerous references to info about the bug.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .