Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
130
0

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
320
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
490
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
780
work-life balance at npm
Avatar for C J Silverio ceejbot
5
810
hash functions and you!
Avatar for C J Silverio ceejbot
2
380
The accidental noder
Avatar for C J Silverio ceejbot
2
180
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
210
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
310

Other Decks in Technology

See All in Technology
変化の早いClaude Codeを 書籍に落とし込む
Avatar for Oikon oikon48
7
1.3k
グローバル基準のSREは、運用現場でどう機能したか：成熟度アセスメントの実践 ／ SRE NEXT 2026
Avatar for sorawatanabe sorawatanabe
0
140
老害フォレンジッカーはAI羊の夢を見るか？
Avatar for tadmaddad tadmaddad
0
310
オートロックマンションなのに、各部屋は施錠なし！？ 攻撃者が組織内ネットワークで大暴れする理由 / The Front Door Is Locked, but the Rooms Are Wide Open: Why Attackers Move Freely Inside Enterprise Networks
Avatar for NTT docomo Business nttcom
1
1.6k
攻撃と防御で学ぶAI時代のプロダクトセキュリティ演習
Avatar for Recruit recruitengineers
PRO
7
2.2k
サイバー捜査員研修（後半）
Avatar for Nomizo Nomizo nomizone
1
810
toio・myCobotでフィジカルAIっぽいことを行うための検討（とりあえず調査） / フィジカルAI LT（IoTLTによる開催）
Avatar for you（@youtoy） you
PRO
0
300
TypeScript入門 2026
Avatar for Recruit recruitengineers
PRO
2
500
Contract One Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
0
19k
修正PRを食べてレビュースキルが賢くなる：Claude Codeによる自己改善サイクル
Avatar for um(うめ) yuyaumetsu
6
1.4k
Cursor Meetup Sapporo - Cursor物語 続編
Avatar for Hiroyuki Kaji cocacola917
0
140
ボトムアップ文化が強い組織で セキュリティをどう根付かせていくかの現在進行形の話 / Making Security Stick in a Bottom-Up Organization
Avatar for Takashi Yamaguchi yamaguchitk333
0
210

Featured

See All Featured
10 Git Anti Patterns You Should be Aware of
Avatar for Lemi Orhan Ergin lemiorhan
PRO
659
62k
Discover your Explorer Soul
Avatar for Emna emna__ayadi
2
1.2k
Visualization
Avatar for Eitan Lees eitanlees
152
17k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
270
14k
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.8k
Redefining SEO in the New Era of Traffic Generation
Avatar for Szymon Słowik szymonslowik
1
380
Max Prin - Stacking Signals: How International SEO Comes Together (And Falls Apart)
Avatar for Tech SEO Connect techseoconnect
PRO
0
360
HDC tutorial
Avatar for Michiel Stock michielstock
2
790
The Limits of Empathy - UXLibs8
Avatar for Cassini Nazir cassininazir
1
600
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
1
850

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords