Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
0
110

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014
Tweet

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
290
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
460
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
760
work-life balance at npm
Avatar for C J Silverio ceejbot
5
790
hash functions and you!
Avatar for C J Silverio ceejbot
2
350
The accidental noder
Avatar for C J Silverio ceejbot
2
160
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
190
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
290

Other Decks in Technology

See All in Technology
Claude Code 10連ガチャ
Avatar for uhyo uhyo
3
680
JAWS-UG SRE支部 #14 LT
Avatar for Kaoru okaru
0
100
Redux → Recoil → Zustand → useSyncExternalStore： 状態管理の10年とReact本来の姿
Avatar for ZOZO Developers zozotech
PRO
14
7.7k
「データ無い！ 腹立つ！ 推論する！」から 「データ無い！ 腹立つ！ データを作る」へ チームでデータを作り、育てられるようにするまで / How can we create, use, and maintain data ourselves?
Avatar for moznion moznion
7
4.2k
re:Invent完全攻略ガイド
Avatar for JunjiKoide junjikoide
1
330
Moto: Latent Motion Token as the Bridging Language for Learning Robot Manipulation from Videos
Avatar for peisuke peisuke
0
140
X-Ray SDKとDaemonのサポート終了と移⾏ガイド
Avatar for o11yfes o11yfes2023
0
100
自己的售票系統自己做！
Avatar for 高見龍 eddie
0
450
エンタープライズ企業における開発効率化のためのコンテキスト設計とその活用
Avatar for sergicalsix sergicalsix
1
390
Design and implementation of "Markdown to Google Slides" / phpconfuk 2025
Avatar for Ken’ichiro Oyama k1low
1
400
お試しで oxlint を導入してみる #vuefes_aftertalk
Avatar for 弁護士ドットコム bengo4com
2
1.5k
Datadog On-Call と Cloud SIEM で作る SOC 基盤
Avatar for Yoshiki Kurihara kuriyosh
0
180

Featured

See All Featured
Fashionably flexible responsive web design (full day workshop)
Avatar for Andy Clarke malarkey
407
66k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
333
24k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
9.6k
Distributed Sagas: A Protocol for Coordinating Microservices
Avatar for Caitie McCaffrey caitiem20
333
22k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
Avatar for Eileen M. Uchitelle eileencodes
26
3.2k
Fight the Zombie Pattern Library - RWD Summit 2016
Avatar for Marcelo Somers marcelosomers
234
17k
Building a Modern Day 
E-commerce SEO Strategy
Avatar for Aleyda Solis aleyda
45
8k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
57k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
95
14k
Designing for Performance
Avatar for Lara Hogan lara
610
69k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
Avatar for Tammy Everts tammyeverts
55
3.1k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords