Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
130
0

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
340
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
500
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
790
work-life balance at npm
Avatar for C J Silverio ceejbot
5
810
hash functions and you!
Avatar for C J Silverio ceejbot
2
390
The accidental noder
Avatar for C J Silverio ceejbot
2
190
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
220
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
310

Other Decks in Technology

See All in Technology
AIによるクリエイティブ生成を行う上での試行錯誤
Avatar for PLAID Tech plaidtech
PRO
0
180
手を動かして実感する、Kiro が変える開発体験
Avatar for Riku INADA inariku
0
190
銀行勘定系システムにおける開発プロセス刷新×AIによる環境モダナイゼーション / Development Process Transformation and AI-Driven Environment Modernization
Avatar for 三菱UFJインフォメーションテクノロジー株式会社 muit
1
2.6k
AI時代の「技術的負債」の変質ー概念の終焉と再解釈、エージェントと共に向かう先
Avatar for nwiizo nwiizo
1
3.2k
積み重なった技術負債への挑戦 〜初手としての全社ゴト化〜
Avatar for PERSOL CAREER Dev | techtekt techtekt
PRO
0
1.6k
Genieを崇めよ
Avatar for camay kameitomohiro
0
170
エージェントはローカル、検証はMicroVM — Lambda MicroVMsでつくるServerless CI
Avatar for fujioka-a fujioka6789
3
710
Railsのように考える: See through the Master
Avatar for Koji SHIMADA snoozer05
PRO
5
1.3k
「どのログを見ればいい？」 から始めた サーバーレス障害解析
Avatar for y_waka1 y_waka1
1
130
10Xに技術的負債をもたらした「2つの境界の歪み」その構造と解消への営み
Avatar for 10xinc 10xinc
0
2.4k
GoのInterface内部構造から学ぶ！最高パフォーマンスを出すコード設計
Avatar for Yappli Developers yappli_developers
1
260
安心して変更できるWebフロントエンドの作り方
Avatar for Hiroyuki ANAI pirosikick
5
2.9k

Featured

See All Featured
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.5k
AI Search: Implications for SEO and How to Move Forward - #ShenzhenSEOConference
Avatar for Aleyda Solis aleyda
1
1.4k
Music & Morning Musume
Avatar for Bryan Veloso bryan
48
7.4k
Jess Joyce - The Pitfalls of Following Frameworks
Avatar for Tech SEO Connect techseoconnect
PRO
1
420
Believing is Seeing
Avatar for Spiro Bolos oripsolob
1
220
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.9k
Digital Ethics as a Driver of Design Innovation
Avatar for Per Axbom axbom
PRO
1
430
A Soul's Torment
Avatar for Nat Ma seathinner
8
3.6k
Leveraging Curiosity to Care for An Aging Population
Avatar for Cassini Nazir cassininazir
1
500
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
55
8.3k
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
510
Have SEOs Ruined the Internet? - User Awareness of SEO in 2025
Avatar for Akash Hashmi akashhashmi
0
500

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords