Dropping the usual format. This week is Heartbleed.
A bug in OpenSSL, the library that encrypts basically the whole internet, lets anyone read random chunks of a server’s memory. Passwords, keys, anything. It’s been there for two years. It has a name, a logo, and a website, which is apparently how vulnerabilities work now. Two-thirds of the web runs the affected versions.
My week: we patched within hours (my first all-hands incident), rotated our certs, forced password resets, then spent three days finding every other place TLS terminates that nobody remembered: a load balancer, an old admin panel, a staging box with a real cert. The patch took an hour. The inventory took days. Nobody had a list. Everyone’s action item, everywhere, is “have a list.”
The wildest part: OpenSSL, guarding trillions of dollars of commerce, was maintained by like two underfunded people. The entire internet is load-bearing volunteers.
TIL (bonus): the Masters got won by Bubba Watson again while I was grepping for libssl. Sports happened. I was busy. First time this blog has a fortnight where my job was the news.