Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Heartbleed: why you should care

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
130
0

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
310
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
490
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
780
work-life balance at npm
Avatar for C J Silverio ceejbot
5
810
hash functions and you!
Avatar for C J Silverio ceejbot
2
380
The accidental noder
Avatar for C J Silverio ceejbot
2
180
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
210
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
310

Other Decks in Technology

See All in Technology
最適な自走を最小限の支援で — M&Aで拡大する組織で少人数SREが挑んだ1年 / SRE NEXT 2026
Avatar for GENDA genda
0
1.1k
インフラ寄りSREでも 開発に踏み出せる〜境界を越えてユーザー体験に向き合いたい〜
Avatar for SansanTech sansantech
PRO
2
3.8k
知らん間に、回ってる
Avatar for ming ming_ayami
0
570
誤解だらけの開発生産性 / Myths and Misconceptions about Developer Productivity
Avatar for Masato Ishigaki / 石垣雅人 i35_267
1
250
AI Agent SaaS を支える自社仮想化基盤への挑戦と実運用 / ai-agent-saas-virtualization
Avatar for GMO Flatt Security flatt_security
2
3.9k
公式ドキュメントの歩き方etc
Avatar for あべ coco_se
0
100
AICoEでAIネイティブ組織への進化
Avatar for YukiOgawa yukiogawa
0
170
ソニー銀行におけるビジネスアジリティ向上のためのクラウドシフト戦略
Avatar for srenext srenext
0
210
Databricks 生成AIガバナンス実践ワークショップ / LLMOps-workshop
Avatar for Databricks Japan databricksjapan
0
100
Devsumi 2026 Summer 人もAIも使える共通基盤を事業の加速装置にする～デザインシステム運用に学ぶ組織レバレッジ～ 渡辺 凌央
Avatar for LegalOn Technologies, Inc legalontechnologies
PRO
0
120
AI時代のエンジニアキャリアについて今一度考える
Avatar for Sakamoto sakamoto_582
2
1.5k
事業価値を⽣み出すSREへ SREが担うべき意思決定の5層
Avatar for kenta_hi kenta_hi
2
3.6k

Featured

See All Featured
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
333
25k
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.4k
Digital Ethics as a Driver of Design Innovation
Avatar for Per Axbom axbom
PRO
1
340
How to Align SEO within the Product Triangle To Get 
Buy-In & Support - #RIMC
Avatar for Aleyda Solis aleyda
2
1.6k
Build The Right Thing And Hit Your Dates
Avatar for Maggie C. maggiecrowley
39
3.3k
Heart Work Chapter 1 - Part 1
Avatar for Lake Fama lfama
PRO
8
36k
Building the Perfect Custom Keyboard
Avatar for Naoto Takai takai
2
810
Unsuck your backbone
Avatar for Amy Palamountain ammeep
672
58k
<Decoding/> the Language of Devs - We Love SEO 2024
Avatar for Nikki Halliwell nikkihalliwell
1
270
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
6.2k
Kristin Tynski - Automating Marketing Tasks With AI
Avatar for Tech SEO Connect techseoconnect
PRO
0
290
State of Search Keynote: SEO is Dead Long Live SEO
Avatar for Ryan Jones ryanjones
0
220

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords