Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
0
100

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.
Avatar for C J Silverio

C J Silverio

April 15, 2014
Tweet

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.5k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
290
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
440
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
760
work-life balance at npm
Avatar for C J Silverio ceejbot
5
790
hash functions and you!
Avatar for C J Silverio ceejbot
2
350
The accidental noder
Avatar for C J Silverio ceejbot
2
140
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
180
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
290

Other Decks in Technology

See All in Technology
Eight Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
0
3.2k
超簡単！RAGアプリケーション構築術
Avatar for oracle4engineer oracle4engineer
PRO
0
120
セキュリティSaaS企業が実践するCursor運用ルールと知見 / How a Security SaaS Company Runs Cursor: Rules & Insights
Avatar for tetsuzawa tetsuzawa
0
160
JNation 2025 - Quarkus for Spring Developers
Avatar for Eric Deandrea edeandrea
PRO
0
110
AIオンボーディングとAIプロセスマイニング
Avatar for Ryuya Nakamura nrryuya
5
1.3k
それでもぼくらは貢献をつづけるのだ(たぶん) @FOSS4GLT会#002
Avatar for YFurukawa furukawayasuto
1
270
エンジニア幼年期の終わり
Avatar for 株式会社Rebase_エンジニアリング rebase_engineering
1
110
ProductZine Day 2025 Assuredのプロダクトディスカバリー
Avatar for Kazuyuki Suzuki kechol
0
110
KMP導⼊において、マネジャーとして考えた事
Avatar for SansanTech sansantech
PRO
1
210
ソフトウェアテストのAI活用_ver1.10
Avatar for fumisuke fumisuke
0
220
GoogleのAI Agent
Avatar for Shu Kobuchi shukob
0
120
継続戦闘能⼒
Avatar for SansanTech sansantech
PRO
0
220

Featured

See All Featured
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
220k
The MySQL Ecosystem @ GitHub 2015
Avatar for Sam Lambert samlambert
251
12k
Documentation Writing (for coders)
Avatar for Carmen Chung carmenintech
71
4.8k
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
81
9k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
51
3.2k
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
269
20k
A better future with KSS
Avatar for Kyle Neath kneath
239
17k
ピンチをチャンスに：未来をつくるプロダクトロードマップ #pmconf2020
Avatar for Aki / @LoveIdahoBurger aki_iinuma
123
52k
Embracing the Ebb and Flow
Avatar for Simon Collison colly
85
4.7k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
126
17k
Six Lessons from altMBA
Avatar for Skipper Chong Warson skipperchong
28
3.8k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
228
22k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords