@PatoSáinz Ah, I forgot to give you my input. I really liked the author's perspective but I'm not sure if the fake hype that was built is the only reason why the track is popular. It is a dick move though.
Anonymous
@Simon ya sure the huge copycatism made it populer too
Anonymous
@Simon also, going to sleep now, see you, tomorrow I'm going to go to the cinema to watch the SHM documentary (leave the world behind)
@TerryChia Well well well, it says "This bug was independently discovered by a team of security engineers (Riku, Antti and Matti)". Those are all Finnish names.
> This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team.
The bug is known as Heartbleed.
Am I vulnerable?
Generally, you're affected if you run some server where you generated an SSL key at some point. Typical end-users are not (directly) affected. SSH is not affected.
You are vulnerable if you run any kind of server that uses OpenSSL versions 1.0–1...
I don't want to be too alarmist (the bug has only been in the wild for a few hours after all), but on the other hand the accepted answer said “upgrade and you're fine”
@Gilles Perhaps your answer should suggest taking servers offline but not shutting them down, so that you can take a process memory dump and use that to identify what could have been leaked
@CodesInChaos Sorry, the least you can do is regenerate the session regularly
Second, is pair with the IP
@CodesInChaos @TerryChia I disagree. Security (all security) is contextual. In the context of our application, it's perfectly fine to pair the session with the IP
Just because in theory something doesn't work in some cases, doesn't mean that you it wouldn't fit other cases.
Yes, I can see some situations where assuming a fixed IP is bad. However, in most cases, assuming a fixed IP for the short life of session is perfectly fine.
> So, hey. I tried to illegally trigger a vulnerability in your systems by using a 0-day exploit. Gimme a job?
@Scott I just found a LinkedIn URL in a Coursera profile for some random dude who answered one of my questions there. I clicked it, and guess what? He's a 3rd level link through that Jesper dude
@deed02392 ooh spook job. Would likely be interesting, but AFAIK they don't pay well, but that said if you get DV clearance via GCHQ work you can do very well in consultancy afterwards :)
@deed02392 It's difficult for me to swallow the idea that at 22 you can say you're in a dead end.
Of course, there are red flags that tells you'll be stuck here for a long time. That's true.
However, at 22, you still enjoy lots of flexibility
I'm not that old either, I still have flexibility, but I think you can't really say "I'm in a dead end" until you're beyond 30 and still have all the dead-end signs.
That's true, but then the point of me joining as an apprentice 3 years ago was that by now I would know
and I did sit and have coffee a few times with the managers here, talking about what I do with that competition and how my hobbies revolve around sysadmin with an interest in secops
@deed02392 Still, approaching your managers multiple times about the topic should at least motivate them to push you in the direction of your interest.
I do have some ongoing support from my development manager, but where I am every day, they have no interest in helping me in that direction since as far as it matters to them it just means they lose a 'software engineer'
@manishearth I have an idea for future features of you AnnoTabe extension. How hard is it to add an action to selected text context menu, so you could create a new annotation from the selected text, and then have an icon in the annotation to also find that text in the tab? Say, I have a long PDF open, but I'm only interested in a part of it. I could then close the tab and return where I was reading it. Doable?
I wrote “"Only the server side of SSL/TLS connections is affected”, but that's not true, is it?
security.stackexchange.com/questions/55083/… says that end-users should do nothing. But if an end-user connected to a malicious server, can't memory from the client process have leaked?
The bug is known as Heartbleed.
Am I vulnerable?
Generally, you're affected if you run some server where you generated an SSL key at some point. Typical end-users are not (directly) affected. SSH is not affected.
You are vulnerable if you run any kind of server that uses OpenSSL versions 1.0–1...
