Comment Re:Not malicious but not honest? (Score 3, Interesting) 447
Why does the heartbeat request even contain the length of the heartbeat block? We know the length of the SSL record!
The record has two variable length fields, so you need a length field for either the payload or the padding. In this case the payload has the length field and the padding length is implicit.