Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
0
110

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014
Tweet

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
290
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
450
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
760
work-life balance at npm
Avatar for C J Silverio ceejbot
5
790
hash functions and you!
Avatar for C J Silverio ceejbot
2
350
The accidental noder
Avatar for C J Silverio ceejbot
2
150
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
190
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
290

Other Decks in Technology

See All in Technology
Turn Your Community into a Fundraising Catalyst for Black Philanthropy Month
Avatar for Auctria auctria
PRO
0
140
Snowflake のアーキテクチャは本当に筋がよかったのか / Data Engineering Study #30
Avatar for Yoshi Matsuzaki indigo13love
0
260
M365アカウント侵害時の初動対応
Avatar for LHazy lhazy
7
4.6k
機械学習を「社会実装」するということ 2025年夏版 / Social Implementation of Machine Learning July 2025 Version
Avatar for Moe Uchiike（内池 もえ） moepy_stats
1
750
20150719_Amazon Nova Canvas Virtual try-onアプリ 作成裏話
Avatar for Rika.I riz3f7
0
140
Data Engineering Study#30 LT資料
Avatar for tetsuroito tetsuroito
1
590
MCPに潜むセキュリティリスクを考えてみる
Avatar for Milix-M milix_m
1
760
TypeScript 上達の道
Avatar for Kanon ysknsid25
18
3.3k
ObsidianをLLM時代のナレッジベースに！ クリッピング→Markdown→CLI連携の実践
Avatar for Reiki Hattori srvhat09
7
9.2k
Bliki (ja), and the Cathedral, and the Bazaar
Avatar for Koichi ITO koic
8
1.4k
手動からの解放！！Strands Agents で実現する総合テスト自動化
Avatar for 井手亮太 ideaws
2
320
Webの技術とガジェットで那須の子ども達にワクワクを！ / IoTLT_20250720
Avatar for you（@youtoy） you
PRO
0
130

Featured

See All Featured
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
47
9.6k
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.2k
Distributed Sagas: A Protocol for Coordinating Microservices
Avatar for Caitie McCaffrey caitiem20
331
22k
Navigating Team Friction
Avatar for Lara Hogan lara
187
15k
Building a Scalable Design System with Sketch
Avatar for Laura Van Doore lauravandoore
462
33k
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
71
11k
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
367
19k
It's Worth the Effort
Avatar for 3n 3n
185
28k
Making Projects Easy
Avatar for Brett Harned brettharned
116
6.3k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
411
22k
Gamification - CAS2011
Avatar for David Bonilla davidbonilla
81
5.4k
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
220k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords