Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
120
0

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
310
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
480
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
780
work-life balance at npm
Avatar for C J Silverio ceejbot
5
800
hash functions and you!
Avatar for C J Silverio ceejbot
2
370
The accidental noder
Avatar for C J Silverio ceejbot
2
170
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
200
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
300

Other Decks in Technology

See All in Technology
Vision Banana: Image Generators are Generalist Vision Learners
Avatar for Kazuyuki Miyazawa kzykmyzw
0
350
ボトムアップの改善の火を灯し続けろ！〜支援現場で学んだ、消えないための3つの打ち手〜 / 20260509 Kazuki Mori
Avatar for SHIFT EVOLVE shift_evolve
PRO
2
640
Every Conversation Counts
Avatar for Yasunobu Kawaguchi kawaguti
PRO
0
210
Shiny New Tools Won't Fix Your Problem
Avatar for Trisha Gee trishagee
1
120
QAエンジニアはどうやって プロダクト議論の場に入れるのか？
Avatar for Sammy(MoritaMasami) moritamasami
2
410
「QA＝テスト」「シフトレフト＝スクラムイベントの参加者の一員」の呪縛を解く。アジャイルな開発を止めないために、10Xで挑んだ「右側のしわ寄せ」解消記 #scrumniigata
Avatar for nihonbuson nihonbuson
PRO
5
1k
Forget technical debt
Avatar for Uwe Friedrichsen ufried
0
180
知ってた？JavaScriptの"正しさ"を検証するテストが5万以上もあること(Test262)
Avatar for Riya Amemiya riyaamemiya
1
190
ハーネスエンジニアリング入門
Avatar for hatyibei hatyibei
0
120
ボトムアップ限界を越える - 20チームを束る "Drive Map" / Beyond Bottom-Up: A 'Drive Map' for 20 Teams
Avatar for 株式会社カオナビ kaonavi
0
180
2026-05-14 要件定義からソース管理まで！IBM Bob基礎ハンズオン
Avatar for YutaNonaka yutanonaka
0
140
「強制アップデート」か「チームの自律」か？エンタープライズが辿り着いたプラットフォームのハイブリッド運用/cloudnative-kaigi-hybrid-platform-operations
Avatar for みずほリサーチ&テクノロジーズ株式会社 先端技術研究部 mhrtech
0
180

Featured

See All Featured
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
1.6k
It's Worth the Effort
Avatar for 3n 3n
188
29k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
40k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
59
6.6k
Agile Actions for Facilitating Distributed Teams - ADO2019
Avatar for Mark Kilby mkilby
0
180
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.8k
Leveraging LLMs for student feedback in introductory data science courses - posit::conf(2025)
Avatar for Mine Cetinkaya-Rundel minecr
1
250
Winning Ecommerce Organic Search in an AI Era - #searchnstuff2025
Avatar for Aleyda Solis aleyda
1
2k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
528
40k
How to Talk to Developers About Accessibility
Avatar for Jason CranfordTeague jct
2
190
The AI Revolution Will Not Be Monopolized: How open-source beats economies of scale, even for LLMs
Avatar for Ines Montani inesmontani
PRO
3
3.4k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
10
1.2k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords