https://security.stackexchange.com/questions/55076/what-should-one-do-about-the-heartbleed-openssl-exploit mainly talks about what people running websites should do about Heartbleed.

What should end-users of websites be doing?

Do they need to change their passwords?

If so, should they be logging into websites and changing passwords immediately? Or should they wait until their websites have changed their sites to be more secure, and then change their passwords?

(I'm http://security.stackexchange.com/users/8335/andrew-grimm , but posting as a guest, because I'm not already logged in, wordpress openID isn't working, and I don't want to use a password just after Heartbleed has been announced)