I spent about two hours last night doing something I've been putting off for approximately forever: going through my password manager and changing basically everything. Not because I wanted to. Because of Heartbleed.
If you haven't heard about this by now you're probably not reading a tech blog, but the short version is there was a bug sitting in OpenSSL, the library that handles encryption for something like two thirds of the web, for two years before anyone caught it. Two years. It got a name (Heartbleed), a logo (a little bleeding heart, very dramatic for a buffer over-read), and its own explainer website within about a day of going public on Monday, which tells you a lot about how security disclosures work now.
I'm not going to explain the technical details since half the internet already has, and honestly the xkcd comic from Wednesday explained it better in four panels than most articles managed in eight hundred words. Guy asks a server for a jar of beans and specifies how many beans he wants, server just hands over way more beans than it should, including stuff that isn't beans at all, just random other memory sitting nearby. Thats it. Thats the bug, more or less. I sent that comic to three different people yesterday instead of trying to explain it myself.
What I actually want to talk about is how tedious the aftermath is. I use a password manager, been on LastPass since sometime in 2012, and I still burned two hours on this, because even with something doing the typing for you, you have to go site by site and check whether they've actually patched their servers before you bother changing anything. Changing your password before a site patches is basically pointless, you're just handing the new one to the same broken lock. Mashable had a running list yesterday of who'd fixed things and who hadn't. Yahoo Mail was on there and apparently slow to patch, which tracks with my experience of Yahoo Mail generally. OkCupid too. Imgur. GoDaddy, which is extra annoying because thats where two of my domains live and their support queue was a disaster all week.
The dumb part is I dont even feel meaningfully safer now. I changed something like thirty passwords and I have no real way of knowing whether any of my old ones got scooped up by someone exploiting this before Monday, since the bug doesnt leave much of a trace in normal server logs. So the whole exercise is closer to insurance than an actual fix. You do it because not doing it is worse, not because doing it guarantees anything.
Separate but related complaint: my office still runs Windows XP on four machines in the back room, including the one hooked up to our ancient label printer, and Tuesday was the official end of support date for that OS. Thirteen years it's been out. Microsoft is done patching it now for anyone not paying for the special extended deal, and we are definitely not paying for that. Nobody here has a plan to touch those four machines because "it still works" seems to be a complete argument as far as everyone else is concerned. I brought it up at lunch and got exactly the reaction I expected: silence, then someone changing the subject to what we were ordering from the sandwich place downstairs. I give it until 2016 before anything actually changes, and thats me being generous.
If you havent changed your passwords yet, do the annoying two hour version, but check whether the site's actually patched first or you're just wasting an evening for nothing. And if your company is running XP anywhere near a live network connection, thats its own separate mess that doesnt go away just because everyone's exhausted from hearing about the other one this week.
One thing I did genuinely like out of all this: the Heartbleed explainer site the Codenomicon researchers put up (the same team that flagged this alongside a Google engineer) is one of the more readable "serious vulnerability" pages a security team has put out in a while. No wall of jargon, a clear explanation near the top, and a logo that's honestly kind of a good logo as these things go. If more disclosures looked like that one, I bet fewer people would just tune the whole topic out by Wednesday.