So this was supposed to be the week I finally got around to migrating this blog's old comment database off that creaky little MySQL instance and onto something less embarrassing. Instead I spent most of Saturday regenerating SSL keys on three different boxes and muttering at my terminal, because of course the internet picked this week to catch fire.
If you haven't heard about Heartbleed yet by the time you're reading this, I'm honestly a little jealous. Short version: there's a bug in OpenSSL, the software that handles encryption for a huge chunk of the web, that's been sitting there since around 2012. It lets an attacker ask a server for a "heartbeat" (basically a keepalive ping) and, with a malformed request, trick it into handing back a chunk of its own memory instead of just echoing the ping back. That memory can contain private keys, session cookies, passwords, whatever happened to be sitting there at the time. And it leaves no trace. No error log entry, nothing. You could've been bled dry for two years and never know it.
The name comes from that heartbeat extension, and whoever at Codenomicon decided to register heartbleed.com and slap a little bleeding red heart logo on it deserves a raise, because I have never seen a CVE get its own branding before. It's kind of unsettling how effective that was. My mother, who does not know what OpenSSL is and does not want to know, texted me a link to a news story about "the heart bug" on Monday night.
Anyway. I run this blog and a couple of small side projects on a VPS I've had since 2012, and Tuesday morning I did the thing every sysadmin, hobbyist and professional alike, did this week: checked openssl version and felt my stomach drop a little when it came back 1.0.1f. That's the exact vulnerable build. So the day went: patch OpenSSL, restart nginx, revoke the old cert, generate a new private key, buy a new cert (which, small annoyance, my CA wanted me to pay for again even though the old one still had eight months left on it), and then go around changing passwords on anything I'd logged into over SSL in the last two years. Which is basically everything. I gave up counting after forty accounts.
The part that actually bugs me isn't the bug itself, bugs happen, it's that by Wednesday there were still major sites telling people "we've patched, you're safe now" without mentioning that patching doesn't retroactively un-leak whatever already got scraped out of memory before the fix went in. Rotating your password is the right move, but it's not because the site suddenly became secure Tuesday afternoon, it's because for who knows how long before that it maybe wasn't. That distinction got flattened into "everything's fine now" in a lot of the coverage and I think that's actively unhelpful.
LastPass pushed out a checker tool pretty fast that tells you whether a given site was vulnerable and, more usefully, whether it's safe to change your password yet (no point rotating a password on a site that hasn't patched, you're just handing the attacker your new one too). I used it on maybe sixty sites over the course of the week. Genuinely tedious. Tumblr's official blog post about it was, to their credit, the most honest thing I read all week, basically telling people to go change their passwords everywhere and treat it like a fire drill.
And this is on top of Windows XP hitting end of support this same week, April 8th, thirteen years after it shipped. My uncle still runs XP on the machine he does his taxes on and has zero plans to change that, security patches be damned. I didn't have the heart (sorry) to bring up Heartbleed on top of that conversation at dinner Sunday.
I don't have a tidy lesson here. Rotate your passwords, use a password manager if you don't already, and if you run a server, go check your OpenSSL version right now if you somehow haven't yet. The comment database migration can wait another week. It's waited two years already, one more won't kill it.