The DMZ

TildalWave

16:03

I do have to wonder though if everyone is so preoccupied with this bug, how vulnerable are they to a side attack? E.g. if North Korea launched some nukes towards the US, would anyone even notice?

Or only once the Twitter was down?

@Xander 14 so far myself, but there's been loads in other queueueueueues as well

FEichinger

16:17

@TildalWave Or it's a subtly softened blow to "innocent" new users with no idea.

TildalWave

@FEichinger Right,... it's not really a blow if they have no rep to lose. It's just a forced sorting order ;)

FEichinger

Meh, depends. A lot of people take great offense at seeing a negative number beside their post.

TildalWave

Then they probably didn't really have a question at all, they're just seeking attention. We're not fame.se :P

I get it that many people have questions about heartbleed, but that doesn't mean that dupes shouldn't be closed as dupes, unclear with a request for clarification, and so on. What I don't get is that there's often nearly identical questions at the top of the list, and they're still being asked as new ones. Or that there's a perfectly good answer in the page they link to in their question, and didn't bother to read it. It just makes even more writing about it pointless., they'd have to read it.

FEichinger

Sure they should be closed. Downvoting them into oblivion, however, is just adding insult to injury.

Mind you, I'm not saying it shouldn't be downvoted. But it shouldn't happen from the queue - if you feel strongly enough to open the question separately to downvote it, the downvote is probably justified; and if you don't, well there you have it.

Scott Pack

16:34

OHAI GUISE

TildalWave

@FEichinger the point is that questions with 3 downvotes or more don't clutter the front page, and perhaps if they didn't there would be less needless duplication

FEichinger

@TildalWave Meh, I'd argue you'd probably get more needless duplication, because people no longer see the existing dupes.

TildalWave

it doesn't remove any rep on 1 rep users, if they get an upvote those previous downvotes don't even count

@FEichinger they might see existing questions with answers then, not the ones without

Anyway, I don't even downvote on dupes, so I'm not sure why I'm even saying this. Dupes are not that bad, they can help you find answers to already existing and nearly identical questions if the wording adds to the search keywords. But I do downvote poor questions, and we had many of those today.

also many poor answers

FEichinger

Of course. But a question in the close queue isn't necessarily a bad question. :P

I suppose you could ask on MSO for votes to be re-enabled in the queue for questions with low-quality close votes.

(unclear/too broad/POB)

Then again, pile-on downvotes on SO are a problem.

They are part of what causes question bans. And as easy as it sounds in theory, "fixing" your past posts can be a problem when they've been rapidly deleted and flooded with downvotes for "being trivial".

Rоry McCune

This is nice, encrypt your heartbleed attack traffic with OpenSSL to foil IDS github.com/HackerFantastic/Public/blob/master/exploits/…

Scott Pack

16:46

@RоryMcCune I think my favs is finding Windows boxes that are vulnerable.

Fucking Tomcat.

4

TildalWave

16:58

@FEichinger OK, I get it that some SE sites have a different culture, but I don't really consider myself a serial downvoter, not when I have a fair amount more of upvotes at least. Votes should reflect quality (clarity, helpfulness, specificity,...) and that's what I try that mine reflect too. It's not my fault we got loads of crap today. Most of the days it's not like this at all. And yes, I even upvote some questions :P

I think I even upvoted some today actually

tylerl

17:33

@ScottPack That sounds... dangerous.

...but if that's your thing, then...

Iszi

So, my wife went and downloaded a "Flash Update" from a third-party website yesterday...

Anyone wanna guess what my weekend project is going to be?

David Freitag

@Iszi Teaching her how to use Linux?

Iszi

@DavidFreitag I haven't even convinced myself to convert yet.

tylerl

@Iszi So why do you spend your weekend clearing out yet another Windows disaster. Maybe that will convince you.

Iszi

@tylerl For this problem, Linux would be like using a sledgehammer to drive in a roofing nail.

tylerl

17:43

@Iszi huh?

Iszi

@tylerl Switching platforms, trying to find/learn new apps, trying to learn the platform myself so I can help her when things go wrong... all to prevent something that hasn't happened (and probably won't happen again) in years? It's a little much.

tylerl

@Iszi I would probably do something like ChromeOS. Chromebooks have worked wonders for my family-tech-support responsibilities.

It's a browser. It does browser things. All you wanted is a browser, and this one doesn't let you install viruses.

Ladadadada

I'm beginning to regret choosing a cut-price SSL reseller. I searched for "revoke" in their Knowledge base. I got back

Fatal error: Class 'pagination' not found in /var/www/vhosts/sslhelpdesk.com/httpdocs/__swift/cache/90674b1a2f26615bd06ab00cee‌fcffd1.php on line 55

Thomas Pornin

@Iszi You have to admit that using a sledgehammer to drive a roof nail 1. works well, and 2. looks awesome.

Iszi

@ThomasPornin I'll concede #2 on the principle that using a sledgehammer to do anything looks awesome. Point 1 is debatable and probably even implementation-dependent. Either way, I think point 2 only works for Linux in movies anyway.

tylerl

17:51

@Ladadadada From that file path, you can deduce that they're running Plesk. Which typically means they've got some RCE vuln somewhere. Maybe you can just log in and revoke it yourself.

2

Thomas Pornin

@Iszi I dunno, I generally look awesome in the real world too. But maybe that's just me.

2

Iszi

@ThomasPornin Oh, you using Linux (or anything else for that matter) most assuredly would look awesome. My wife, not so much.

Scott Pack

That's why I always download all my Flash updates from flash.com

Iszi

@Ladadadada Heartbleed cleanup I take?

Thomas Pornin

@Iszi Are you OK with writing on a public place that your wife does not have awesome looks ? You like to live dangerously.

3

Iszi

17:54

@ThomasPornin Oh, no. My wife has awesome looks in general, absolutely. I just don't think she'd look very awesome in the specific case where she is trying to use Linux.

Ladadadada

@tylerl Oh that's a scary thought.

@tylerl Why did you have to say that?

@Iszi Yep. Two more certs to go after this one.

At least re-keying has been easy so far.

Iszi

Someone should make a Firefox plugin that tells you if the site you're using is vulnerable to Heartbleed.

David Freitag

@Iszi Or a chrome extension

Though i don't know if anyone has (or can) implement the vuln in javascript

Iszi

@DavidFreitag Yeah, @tylerl's mom would love that.

Ladadadada

Something to tie it in to the last change in the relevant cert's fingerprint would be nice too.

Iszi

18:00

@DavidFreitag Aren't there other ways you can determine a site's OpenSSL version?

Ladadadada

Amazon ELBs are all upgraded now but I'll bet there are a lot of people who haven't updated their certs yet.

David Freitag

@Iszi Oh I suppose that would work too

Thomas Pornin

@Ladadadada Yes, including me.

I don't intend to update my cert, even.

Ladadadada

@ThomasPornin Your risk profile is different to mine I presume.

Thomas Pornin

My risk analysis concludes to the idea that the effort involved in obtaining a new certificate is not commensurate with the risk of using a key which might have been potentially viewed as perhaps subject to partial exposure.

Ladadadada

18:04

I have credit cards running through two of ours. Not very many credit cards but more than none.

tylerl

* Concerned about security enough to revoke certificate due to heartbleed risk
* Unconcerned about security enough to buy certificates from a reseller running Plesk

Did I sum that up correctly?

Iszi

@tylerl Remember this conversation? Kinda funny to look back on that in light of this week's events.

Feb 13 at 7:20, by tylerl

@Iszi the OpenSSL team never struck me as the brightest crew. The software is functionally reasonably solid, but pretty much EVERYTHING else about the entire operation looks like it's run by an ADD teenager.

tylerl

@Iszi Yeah.. maybe their one redeeming quality isn't so redeeming after all. What a shitshow.

FEichinger

18:20

Wheeee, I have the top answer on the MSO profile thingy.

Iszi

@NathanLucy Welcome, strange visitor.

For that matter, I just noticed this room is abnormally extra-crowded today. Guess everyone's interested to hear what we're saying about Heartbleed?

(Come to think of it, the past couple days have probably had the most on-topic discussions this room has seen in... well, ever.)

There. I feel better now.

David Freitag

@Iszi BOOBIES

4

Iszi

@DavidFreitag Yup, mission accomplished. Thanks for your support.

And auto-stars to boot? Awesome! Things are returning to normal!

Lucio

what the heck am I doing here? O_O

David Freitag

@Lucio Lurking in the shadows?

Lucio

18:27

haha

really, no idea how did I open this chat room

trojan is the most probably..

ciao!

David Freitag

I find it hard to believe that a condom mysteriously brought you here.

3

Iszi

@Lucio We've got a lot of non-regulars today. @Ajasja, @NathanLucy, @NathanC, @OliverSalzburg, @Jacob, @Braiam, @FalconMomot, @ColinCassidy, @BarryCarlyon, @Bob, and @Eric are all fairly unfamiliar to me.

Jacob

@Iszi I sometimes float in here, but yes I'm a non-regular.

Iszi

@DavidFreitag They forgot to check it for holes.

David Freitag

@Iszi Oh come on - everyone knows step one is to make a gigantic balloon animal with a condom before use.

Lucio

18:33

@Iszi common trojan explains it.

Or maybe you @Iszi are the one that is unfamiliar here :O

Iszi

@DavidFreitag Balloon animal, maybe. Gigantic is user-dependent. Yours, for example, wouldn't be so much gigantic as petite.

Nathan C

@Iszi I'm occasionally here...lurking.

Iszi

@Lucio Oh, come on. I know I haven't been that active lately, but I haven't been that much absent either.

David Freitag

@Iszi It's latex even the junior ones will grow to quite a large size

Lucio

@Iszi I was kidding, just kidding :D

anyway, nice to meet you!

Iszi

18:36

Someone nuke this please?

2

Q: Has Linux Mint updated the OpenSSL library for LMDE (Heartbleed bug)?

Background I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug. I have a different pure Debian server and Debian was quick to remedy the problem. However, after runni...

Oh, it looks like someone else already had the Heartbleed extension idea.

0

Q: browser extensions to show Heartbleed vulnerability?

Is there any way to use a browser extension on Firefox or Chrome that shows whether a TLS session is vulnerable to HeartBleed (server uses openssl) and whether the certificate was issued prior to the publication of the issue?

ssl certificates tools heartbleed browser-extensions

AviD

@ThomasPornin @TerryChia don't listen to him. Your choice of brace placement is the correct way, more readable, and more aesthetically pleasing.

@ThomasPornin like everything else they write is so perfect.

btw, I will be back later tonite, hope to sort out this heartbreak mess.... any flags or vtc's to help will be appreciated.

Iszi

@ThomasPornin Wow. Is Little Bear feeling a bit trollish today?

Thomas Pornin

18:51

@Iszi When in a madhouse, speaking the truth becomes allowed.

Rоry McCune

@DavidFreitag @Iszi It's been done (well I saw a tweet which indicated such...)

David Freitag

@RоryMcCune Doesn't seem like it would be too difficult to implement something like that so makes sense i guess.

Rоry McCune

@Iszi @ColinCassidy is an old hand, just more of a lurker than a chatter

Xander

19:21

@AviD Agreed. K&R braces were stylish in the 80s, along with stirrup pants and Members Only jackets.

AviD

@Xander Members Only is no longer fashionable???

Xander

@AviD Umm...Just forget I said that. Your members only jacket is fine. Really. No one is looking at you funny. I promise.

AviD

@Xander oh I'm sure they are. But I dont think it's because of my jacket... Perhaps because the jacket is the only thing I'm wearing...?

Xander

@AviD Eww.

AviD

isnt that what the "Only" stands for?

tylerl

19:25

@Xander I agree with the Linux kernel coding standard on this point -- keep the relevant code close together; don't use up whitespace unless you want to separate things.

AviD

and thats exactly what every single set of braces is doing. Seperating things.

Xander

@AviD LOL. That's a very...Interesting perspective.

tylerl

@AviD braces group things, not separate things.

Xander

@tylerl Yin/Yang.

tylerl

if (x)
{
then_y();

Your brace is *right there in the middle* of your thought.

if (x) {
then(y);
}

something_unrelated();

ah -- see now we know what belongs together.

AviD

19:31

no no no. You are thinking about your code all wrong.

tylerl

@AviD thinking about your code is all wrong?

AviD

if (x)
{
then_stuff();
}
else
{
then_other_stuff();
}

put the logic and control flow together. the specific actions - they need to be grouped together, but seperate from the control/logic.

tylerl

@AviD You can take your hipster coding standards over to the Node.JS team. They really dig your artistic use of whitespace.

Nathan C

if(x){then_stuff();}else{then_other_stuff();}

what's a spacebar?

AviD

huh? no, the other way around.

Jeff Ferland

19:33

Heartblead: pissing me off since April 3rd.

AviD

my way is engineered. your way is hacky.

TildalWave

5

A: Should I change all my passwords due to heartbleed

No. You do not have to change all your passwords due to heartbleed. You have to change all your passwords because everybody seems to have become a huge herd of panicking sheep; changing your passwords will give you a warm feeling of doing something useful while you are running to your ultimate de...

heh heh :)

tylerl

@TildalWave This should be the canonical heartbleed question.

TildalWave

@tylerl think wider :)

reminds me of the security monkeys one

only I can't think of a good story to go with the sheep one, like the other one had

tylerl

Security Logic. It leads to only one conclusion:

0

A: Should I change all my passwords due to heartbleed

Yes, you should always change all of your passwords. You never know when someone might have compromised your password. And really without any certainty that it the worst hasn't happened today, the only sensible action is to take any and all measures possible to protect yourself. The same goes f...

Thomas Pornin

19:57

@AviD I put opening braces on the end of the line because the scarce resource I am trying to save on is vertical eye movement: I can "see" about 30 to 35 lines; more is tiring.

Though if you are a giant squid, I can understand that your eyes are up to ranging over a much longer set of lines.

Xander

We got an answer from HD Moore.

1

A: What clients are proven to be vulnerable to Heartbleed?

I wrote a Metasploit module to test this, its currently being reviewed, but should hit the master branch relatively soon. https://github.com/rapid7/metasploit-framework/pull/3212 Unlike the server-side attack, you have to implement most of TLS as the heartbeat reply is encrypted against the SSL...

TildalWave

@Xander heh cute mr. metasploit himself :)

Xander

Out of close votes. :-(

Ladadadada

@tylerl Yeah, that's pretty much it. Although we have four different certs from four different companies and when it comes time to renew this particular certificate I think it will be time to consolidate somewhere else.

Rоry McCune

@ThomasPornin quality answer from the little bear on changing passwords due to heartbleed...

tylerl

20:22

So, speaking of that abominable topic; my examination suggests that it's far more likely that a server's certificate show up in a leak rather than the key.

People say that they've seen "ssl certificates" because of the HB attack. We assume that they meant "private keys", but perhaps they actually meant "public certificates".

the certificate actually gets loaded up in memory and delivered over the channel during handshaking. The key does not. It gets used, but that's slightly different.

You wouldn't expect to see -----BEGIN RSA PRIVATE KEY----- because that's not shuttled into ram for every connection.

What you see plenty of is HTTP request headers.

Nathan C

@tylerl The private key could still possibly be loaded into RAM. As shown, one could execute the exploit as fast as they want to and get all sorts of data

Given an infinite number of chances, there's still a chance of the key being revealed - a very, very low chance, but it's not 0%.

tylerl

@NathanC That's assuming that the key is ever at some point resident immediately following the response structure. Which may not actually happen. It's like saying that if you count the number of dogs in London an infinite number of times, you'll eventually get the answer pi.

Replication out to infinity doesn't automatically mean "I get whatever answer I choose".

Nathan C

True. I feel like the whole exploit is a little over-blown especially since this isn't the first remote execution exploit that's ever existed

tylerl

@NathanC It's not a remote execution exploit. That the absurd thing. It's information disclosure.

William Lawn Stewart

Having a relatively catchy name people can throw around has probably had a lot to do with it

tylerl

20:36

@WilliamLawnStewart And a logo. Don't forget the logo.

2

Anonymous

Xbox password flaw exposed by five-year-old boy

Anonymous

once again, I'm not suprised

tylerl

@PatoSáinz NO LOGO.

It's a completely logo-less exploit. Hardly worth reporting.

4

Come back when you have a landing page.

Anonymous

I call it Bleeding X-hole

Anonymous

3

tylerl

20:42

@PatoSáinz +1

It's perfect. Topical and yet subtly uncomfortable to say in a professional environment.

Anonymous

@tylerl thanks, I'm sure marketing it will be easy

Anonymous

"oh @tylerl did you already use the Bleeding X-hole patch I gave you in the server room?"

tylerl

"Excuse me Ms. Talbot, Can you please ask Andersen whether he has patched the bleeding X-hole? This could become a real problem if we let it sit overnight."

Braiam

@Iszi I'm regular in others rooms

kiBytes

21:04

Greetings from Berlin :)

tylerl

So the discoverer of the HB bug was offered a 15K bounty -- I think i'm going to make more than that this week off his discovery.

M'vy

heya

Anonymous

tylerl

@PatoSáinz You can tell when someone's spent too long in this industry when the first thing they think when they see that picture....

is that in the PEM standard, there should be 5 hyphens, not 3.

Anonymous

lol

Rory Alsop

21:13

Hahahahahahahaha

Xander

@tylerl That's awesome.

Already over 9000 keys checked at http://privatekeycheck.com

Tweeted by mikko on April 9, 2014 at 9:13 PM

Bob

21:51

@Iszi ohhai

@Xander Heh. Just like ismycreditcardstolen.com

TildalWave

thought it's suiting for this heart-bleeding occasion, plus it has a beatified security monkey on the cover:

►

tylerl

22:22

Have 6 old computers that I was going to throw away when I found a recycling center. But now I'm going to install XP on them and sell them to BestBuy:

Windows XP Trade-In Offer

Gilles

Hmmm, now should be the time to buy a second-hand Windows XP

tylerl

I'll have to remove the Windows Vista sticker on one of them....

Gilles

Occasionally I want to test stuff, but none of my computers were sold with Windows, and I don't care enough to buy a Windows license from MS

TildalWave

@tylerl wanna bet those coupons aren't cummulative?

tylerl

@TildalWave guessing not. But it does mean you can buy a chromebook for $100.

And those are my new favorite way to avoid doing tech support

TildalWave

22:32

@tylerl ah yes, I just wanted to ask ... why?? :)

tylerl

it also solves the "can I borrow your computer while I'm here" problem

Sure!!!

TildalWave

wait, ... hexus.net/tech/features/laptop/…

not much of a chance but you never know, maybe it's your lucky day :)

tylerl

power-on the computer... smell of smoke. nope, THAT one is going in the bin.

TildalWave

LOL I just downvoted and flagged H.D. Moore

-1

A: Does the heartbleed vulnerability affect clients as severely?

Take a look at this answer for technical PoCs and more details on what is exposed.

"not an answer" :))

Also, how many devices is he using on his vacation if he couldn't even bother to login to the same account he used before? He's into boat programming too? :D

Transcript for