Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
0
110

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014
Tweet

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
290
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
450
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
760
work-life balance at npm
Avatar for C J Silverio ceejbot
5
790
hash functions and you!
Avatar for C J Silverio ceejbot
2
350
The accidental noder
Avatar for C J Silverio ceejbot
2
150
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
190
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
290

Other Decks in Technology

See All in Technology
5年間のFintech × Rails実践に学ぶ - 基本に忠実な運用で築く高信頼性システム / 5 Years Fintech Rails Retrospective
Avatar for Masato Ohba ohbarye
9
3.6k
Railsアプリケーション開発者のためのブックガイド
Avatar for Masayoshi Takahashi takahashim
13
5.4k
SOC2取得の全体像
Avatar for shonansurvivors shonansurvivors
1
350
空間を設計する力を考える / 20251004 Naoki Takahashi
Avatar for SHIFT EVOLVE shift_evolve
PRO
3
110
VCC 2025 Write-up
Avatar for bata_24 bata_24
0
140
タスクって今どうなってるの？3.14の新機能 asyncio ps と pstree でasyncioのデバッグを (PyCon JP 2025)
Avatar for Junya Fukuda jrfk
1
160
PyCon JP 2025 DAY1 「Hello, satellite data! ～Pythonではじめる衛星データ解析～」
Avatar for ぴっかりん ra0kley
0
840
全てGoで作るP2P対戦ゲーム入門
Avatar for ponyo877 ponyo877
3
1.2k
北海道の人に知ってもらいたいGISスポット / gis-spot-in-hokkaido-2025
Avatar for sakaik sakaik
0
190
OCI Network Firewall 概要
Avatar for oracle4engineer oracle4engineer
PRO
1
7.7k
KMP の Swift export
Avatar for Koki Hirokawa kokihirokawa
0
200
“2件同時配達”の開発舞台裏 〜出前館PMが挑んだ ダブルピック実現に向けた体験設計〜
Avatar for 株式会社出前館 demaecan
0
160

Featured

See All Featured
Scaling GitHub
Avatar for Zach Holman holman
463
140k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
57
5.9k
Practical Orchestrator
Avatar for Shlomi Noach shlominoach
190
11k
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
208
24k
A better future with KSS
Avatar for Kyle Neath kneath
239
17k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
30
2.9k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
339
57k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
188
55k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
274
40k
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
180
9.9k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
229
22k
Designing Experiences People Love
Avatar for Jonathan Moore moore
142
24k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords