I found a pretty nice explanation of Heartbleed for the layman in this XKCD comic. Heartbleed is a recent and alarming vulnerability found in the OpenSSL toolkit that serves most of the application/websites today. To quote Schneier:
"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.
Here's the comic:
And if you want to dig a bit more into it, you can read some more explanations on security.stackexchange.
..We're proud to welcome Dr. Condoleezza Rice to our Board of Directors. When looking to grow our board, we sought out a leader who could help us expand our global footprint. Dr. Rice has had an illustrious career as Provost of Stanford University, board member of companies like Hewlett Packard and Charles Schwab, and former United States Secretary of State. We’re honored to be adding someone as brilliant and accomplished as Dr. Rice to our team.
People are not happy with that news.
When I knew you at Stanford I had the greatest admiration for your abilities and good sense. But now I cannot help but express to you my chagrin that the warm feelings I once had have basically evaporated. I hope you can pause to try to understand why this might be the case.
Don Knuth's open letter to Condoleezza Rice
A message some users of Virwox received:
Hello,
here is what has happened:
Similar to other exchanges, our servers are protected from DDOS-attacks by an external service provider. While our own servers themselves were not vulnerable to the "Heartbleed" attack, the proxy servers of the DDOS provider were. They have fixed the problem already and we have turned on the service again.
The good news is that our own server was NOT hacked, and none of our secrets or bitcoins were stolen. However, the attacker was able to get to the session cookies of in total 20 users who were logged in yesterday (between about 8am and 11am), and used this to try to withdraw the money they had in their account in the form of bitcoins.
They don't say how much loss they have suffered, but they have reimbursed the victims.
There's a few reasons for this. First, the Tarsnap client-server protocol does not use TLS
I was also lucky: The Tarsnap webserver happens to be running an older version of OpenSSL which never had the vulnerable code
http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html
For those who are curious about the protocol that Tarsnap uses : it's explained here
I remember reading about how the newly facebook chat was made using long pollings, years ago. Now with HTML5 with have sockets and webhooks made easy. I wonder if they're still using long polling now...
Anyway, Zapier. A start up that is making APIs easy, is writing a lot of interesting tutorials these last few months. Their new Chapter 7 was released and it's about polling and web hooks. And as usual it's great!
https://zapier.com/learn/apis/chapter-7-real-time-communication
After messing around with this code for about a month I decided to write this up for the tubes in the hope that I can save some souls. I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall. It is, bar none, the worst library I have ever worked with. I can not believe that the internet is running on such a ridiculous complex and gratuitously stupid piece of code. Since circa 1998 the whole world has been trusting their secure communications to this impenetrable morass that calls itself the "OpenSSL" project. I bet that the doctors that work on that shitshow can not prescribe anything useful either!
worrying essay, read it here: https://www.peereboom.us/assl/assl/html/openssl.html
We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
A pretty bad bug has been found in open SSL during the Codenomicon. more info here: http://heartbleed.com/
List of vulnerable websites from the Alexa top 10,000 websites: https://gist.github.com/dberkholz/10169691
You can test a website here: http://filippo.io/Heartbleed/
And also, if you have a lot of time to waste, this random dude seems to know a lot about it :D
Some people from Stanford are planning to build an anonymous market place. As Silk Road as shown, such a project can only fall with time unless it is decentralized. With all the new ideas and technologies coming into place (in protocols such as bitcoins, namecoins (for dns)), they are thinking of applying them for a decentralized market place as well.
More info here: https://mailman.stanford.edu/pipermail/liberationtech/2014-March/013304.html
And a new github repo to watch out for!
https://github.com/goshakkk/decentralized-anonymous-marketplace-concept
