Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
0
110

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014
Tweet

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
290
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
450
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
760
work-life balance at npm
Avatar for C J Silverio ceejbot
5
790
hash functions and you!
Avatar for C J Silverio ceejbot
2
350
The accidental noder
Avatar for C J Silverio ceejbot
2
150
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
190
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
290

Other Decks in Technology

See All in Technology
新規案件の立ち上げ専門チームから見たAI駆動開発の始め方
Avatar for ShuyaKinjo shuyakinjo
0
630
AIエージェントの活用に重要な「MCP （Model Context Protocol）」とは何か
Avatar for Masaya Mori (森正弥) / CAIO (Chief AI Officer) masayamoriofficial
0
240
AIとTDDによるNext.js「隙間ツール」開発の実践
Avatar for Makoto Tateno makotot
6
800
7月のガバクラ利用料が高かったので調べてみた
Avatar for 高橋広和 techniczna
3
800
AWS環境のリソース調査を Claude Code で効率化 / aws investigate with cc devio2025
Avatar for MasahiroKawahara masahirokawahara
2
960
トヨタ生産方式(TPS)入門
Avatar for Recruit recruitengineers
PRO
5
1.4k
絶対に失敗できないキャンペーンページの高速かつ安全な開発、WINTICKET × microCMS の開発事例
Avatar for microCMS microcms
0
350
kubellが考える戦略と実行を繋ぐ活用ファーストのデータ分析基盤
Avatar for kubell kubell_hr
0
120
見てわかるテスト駆動開発
Avatar for Recruit recruitengineers
PRO
6
2.3k
コスト削減の基本の「キ」～ コスト消費3大リソースへの対策 ～
Avatar for Makky12 smt7174
2
310
PRDの正しい使い方 ～AI時代にも効く思考・対話・成長ツールとして～
Avatar for PERSOL CAREER Dev | techtekt techtekt
PRO
0
220
ヘブンバーンズレッドにおける、世界観を活かしたミニゲーム企画の作り方
Avatar for gree_tech gree_tech
PRO
0
410

Featured

See All Featured
Practical Orchestrator
Avatar for Shlomi Noach shlominoach
190
11k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
34
6k
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
184
22k
Designing Dashboards & Data Visualisations in Web Apps
Avatar for Des Traynor destraynor
231
53k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
Avatar for Vitaly Friedman smashingmag
252
21k
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
332
24k
Faster Mobile Websites
Avatar for Dean Hume deanohume
309
31k
Product Roadmaps are Hard
Avatar for C. Todd Lombardo iamctodd
PRO
54
11k
The Psychology of Web Performance [Beyond Tellerrand 2023]
Avatar for Tammy Everts tammyeverts
49
3k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
70
11k
XXLCSS - How to scale CSS and keep your sanity
Avatar for Zaharenia Atzitzikaki sugarenia
248
1.3M
Optimising Largest Contentful Paint
Avatar for Harry Roberts csswizardry
37
3.4k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords