Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Heartbleed: why you should care

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for C J Silverio C J Silverio
April 15, 2014
Technology
130
0

Heartbleed: why you should care

A discussion of the Heartbleed bug for a non-programming but computer-using audience.

Avatar for C J Silverio

C J Silverio

April 15, 2014

More Decks by C J Silverio

See All by C J Silverio
The economics of package management
Avatar for C J Silverio ceejbot
4
1.6k
The future of (javascript) modules (in node)
Avatar for C J Silverio ceejbot
1
340
Keeping JavaScript safe
Avatar for C J Silverio ceejbot
3
500
ceej's how to solve it
Avatar for C J Silverio ceejbot
6
790
work-life balance at npm
Avatar for C J Silverio ceejbot
5
810
hash functions and you!
Avatar for C J Silverio ceejbot
2
390
The accidental noder
Avatar for C J Silverio ceejbot
2
190
Design Patterns & Modularity in the npm Registry
Avatar for C J Silverio ceejbot
3
220
Monitoring on a budget
Avatar for C J Silverio ceejbot
2
310

Other Decks in Technology

See All in Technology
AIで社員の自主発信に広報目線を組み込む
Avatar for もっさん _mossann_t
0
140
Antigravity SDK for the Java Developer
Avatar for Guillaume Laforge glaforge
0
180
AIによるクリエイティブ生成を行う上での試行錯誤
Avatar for PLAID Tech plaidtech
PRO
0
180
30座EKS, 180次升級淬煉的EKS Upgrade Skill 的歷程
Avatar for Eric eric8230
0
210
Railsのように考える: See through the Master
Avatar for Koji SHIMADA snoozer05
PRO
5
1.3k
なぜ「決定性」が 決定的に重要なのか？ Durable Execution 基盤の数理的理解 #serverlessjp / ServerlessDays Tokyo 2026
Avatar for y_taka_23 ytaka23
3
1.2k
GoのInterface内部構造から学ぶ！最高パフォーマンスを出すコード設計
Avatar for Yappli Developers yappli_developers
1
260
JSONataとAWS Step Functionsで目指すRuntimelessな世界
Avatar for mu7889yoon / Yuta Nakamura mu7889yoon
0
440
株式会社シーエーシー　エンジニア向け会社紹介資料
Avatar for 株式会社シーエーシー cac
0
57k
C#未経験の僕がAIに読めるコードを書かせるまで
Avatar for マグロ隊長kinTV maguroalternative
0
250
What the customer really needed
Avatar for Yasunobu Kawaguchi kawaguti
PRO
3
220
Azure Serverless 2026：Production-ready な AI エージェント基盤 / Azure Serverless 2026: Production-Ready AI Agent Platform
Avatar for miyake miyake
2
540

Featured

See All Featured
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
46
8.3k
The innovator’s Mindset - 
Leading Through an Era of Exponential Change - McGill University 2025
Avatar for Jean-Marc De Jonghe jdejongh
PRO
1
340
SEO for Brand Visibility & Recognition
Avatar for Aleyda Solis aleyda
0
4.7k
A better future with KSS
Avatar for Kyle Neath kneath
240
18k
Abbi's Birthday
Avatar for Violet Bock coloredviolet
4
10k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
10
1.3k
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.9k
Reality Check: Gamification 10 Years Later
Avatar for Sebastian Deterding codingconduct
0
2.3k
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
510
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
61
10k
Marketing to machines
Avatar for Jono Alderson jonoalderson
1
5.8k

Transcript

  1. Heartbleed why you should care

  2. C J Silverio devops at npm @ceejbot

  3. what's heartbleed?

  4. security vulnerability disclosed April 7 2/3rds of all secure servers

  5. OpenSSL the secure 's' in https://

  6. heartbeat a pulse from a client to a server &

    back

  7. Alice ⇢ ping ⇢ Bob Alice ⇠ pong ⇠ Bob

  8. Alice lies: “pong is 64K letters.”

  9. Bob trusts her. He sends Alice too much data.

  10. that data is the bleed in heartbleed

  11. what leaked?

  12. Everything. » your passwords » your cookies » server's passwords

    » server's identifying certificates

  13. Everything leaked. From 2/3rds of the servers on the internet.

  14. How long did this leak exist?

  15. Two years.

  16. Everything leaked from 2/3rds of the servers on the internet

    for two years.
  17. None

  18. How did this happen?

  19. Rogue agency: the NSA? incompetence?

  20. now what?

  21. change your passwords

  22. change your passwords for everything

  23. yes, everything

  24. Use a password manager 1Password https://getvau.lt

  25. Toss your cookies

  26. Turn on 2-factor auth

  27. Recap

  28. Heartbleed is as bad as it gets.

  29. change passwords delete cookies 2-factor auth

  30. donate to important open-source projects

  31. Buy your operations staff a drink

  32. change your passwords