Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
120
0

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
310
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
480
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
780
work-life balance at npm
Avatar for C J Silverio ceejbot
5
800
hash functions and you!
Avatar for C J Silverio ceejbot
2
370
The accidental noder
Avatar for C J Silverio ceejbot
2
170
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
200
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
300

Other Decks in Technology

See All in Technology
AI와 협업하는 조직으로의 여정
Avatar for Arawn Park arawn
0
510
ハーネスエンジニアリングをやりすぎた話 ~そのハーネスは解体された~
Avatar for Gota gotalab555
5
1.8k
Practical TypeProf: Lessons from Analyzing Optcarrot
Avatar for Yusuke Endoh mame
0
1k
データ定義の混乱と戦う 〜 管理会計と財務会計 〜
Avatar for wonohe wonohe
0
140
[OAWTT26][THR1028] Oracle AI Database 26ai へのアップグレード：ベストプラクティスと最新情報
Avatar for oracle4engineer oracle4engineer
PRO
1
110
Hacobu Tech Deck
Avatar for Hacobu hacobu
PRO
0
120
Good Enough Types: Heuristic Type Inference for Ruby
Avatar for Shia riseshia
1
300
ネットワーク運用を楽にするAWS DevOps Agent活用法！！ / 20260421 Masaki Okuda
Avatar for SHIFT EVOLVE shift_evolve
PRO
2
220
AIが書いたコードを信じられない問題 〜レビュー負荷を下げるために変えたこと〜 / The AI Code Trust Gap: Reducing the Review Burden
Avatar for 株式会社ビットキー / Bitkey Inc. bitkey
PRO
8
1.4k
Keeping Ruby Running on Cygwin
Avatar for fd0 fd0
0
180
レビューしきれない？それは「全て人力でのレビュー」だからではないでしょうか
Avatar for amixedcolor amixedcolor
0
350
生成AIが変える SaaS の競争原理と弁護士ドットコムのプロダクト戦略
Avatar for 弁護士ドットコム bengo4com
1
2.2k

Featured

See All Featured
AI in Enterprises - Java and Open Source to the Rescue
Avatar for ivargrimstad ivargrimstad
0
1.2k
XXLCSS - How to scale CSS and keep your sanity
Avatar for Zaharenia Atzitzikaki sugarenia
250
1.3M
30 Presentation Tips
Avatar for Ian Lurie portentint
PRO
1
280
Public Speaking Without Barfing On Your Shoes - THAT 2023
Avatar for David Neal reverentgeek
1
380
It's Worth the Effort
Avatar for 3n 3n
188
29k
Tips & Tricks on How to Get Your First Job In Tech
Avatar for Honza Javorek honzajavorek
1
490
Future Trends and Review - Lecture 12 - Web Technologies (1019888BNR)
Avatar for Beat Signer signer
PRO
0
3.5k
Mind Mapping
Avatar for Hélio Medeiros helmedeiros
PRO
1
160
Docker and Python
Avatar for Tania Allard trallard
47
3.8k
Become a Pro
Avatar for Speaker Deck speakerdeck
PRO
31
5.9k
Marketing Yourself as an Engineer | Alaka | Gurzu
Avatar for Gurzu gurzu
0
180
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
275
41k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords