16,255 reputation
12583
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 4 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Apr
13
revised Who proposed adding heartbeat to SSL? And who proposed it's form?
added 328 characters in body
Apr
13
comment Heartbleed: hackers have already used the vulnerability?
@Clockwork-Muse - Fixed.
Apr
13
revised Heartbleed: hackers have already used the vulnerability?
added 106 characters in body
Apr
13
revised Who proposed adding heartbeat to SSL? And who proposed it's form?
added 1098 characters in body
Apr
13
answered Who proposed adding heartbeat to SSL? And who proposed it's form?
Apr
13
awarded  Great Answer
Apr
13
revised Heartbleed: hackers have already used the vulnerability?
added 59 characters in body
Apr
13
answered Heartbleed: hackers have already used the vulnerability?
Apr
12
accepted Does xkcd.com/1353 overstate heartbleed's capability?
Apr
11
awarded  Announcer
Apr
11
comment Ethicality of websites that test other sites for Heartbleed
It is easy to test for heartbleed vulnerability without the risk of getting any valuable data; e.g., you have payload length of 20, but only send 16 bytes (minimum size). Does it fail as it should or does it return 4 extra bytes? Those four bytes of exposed memory will not in anyway be useful to attack the system. However, it does indicate the system is likely vulnerable.
Apr
11
comment How to explain Heartbleed without technical terms?
@MichaelBorgwardt - I tried giving a thorough answer without resorting to just technical jargon or giving silly analogies. I believe some found it helpful. It's not obviously not an "Explain it like I'm a five" or explain it in under a minute, but take the time to explain and related concepts like you are an intelligent adult, even if you aren't a computer/security expert.
Apr
11
comment Does xkcd.com/1353 overstate heartbleed's capability?
@AviD - I think Mr Munroe takes heartbleed very seriously as today's comic also discusses heartbleed in depth (and gives a great summary of it). So I don't see it dripping in sarcasm (besides the obvious comic parts referring to imaginations/paper/clay tablets being safe and the Blade Runner quote).
Apr
11
comment HeartBleed - How to detect compromised websites
There's also this list of Alexa sites that potentially were claimed to be compromised at some point: gist.github.com/dberkholz/10169691
Apr
11
awarded  cryptography
Apr
11
revised How would you know a certificate/private key if you extracted it from RAM? Or would you?
added 256 characters in body
Apr
11
answered How would you know a certificate/private key if you extracted it from RAM? Or would you?
Apr
11
comment How to explain Heartbleed without technical terms?
@Celeritas - Those of the sort of things I expect, (though a sane password manager would only load passwords into memory as necessary and free them quickly). Again, if you patched your OpenSSL on your system to 1.0.1g or used a version before 1.0.1, you are safe from this attack. If you use linux and are familiar with python and have root access, you can explore the contents of memory. Simply find the PID of your web browser (e.g., with top) and then use the python2 script given here, and remember the client attack will only get random chunks.
Apr
10
reviewed Edit suggested edit on How to explain Heartbleed without technical terms?
Apr
10
revised How to explain Heartbleed without technical terms?
unpacked ssh