explain xkcd - User contributions [en]

1354: Heartbleed Explanation

2014-04-11T07:09:12Z

RatesAnalyst: /* Explanation */

{{comic
| number = 1354
| date = April 11, 2014
| title = Heartbleed Explanation
| image = heartbleed_explanation.png
| titletext = Are you still there, server? It's me, Margaret.
}}

==Explanation==
The {{w|Heartbleed bug}} has received a lot of news coverage recently and was also the topic of the previous comic ([[1353]]). This comic explains how the bug may have been discovered and can be exploited to reveal a server's memory contents. A hypothetical hacker (Meg) sends heartbeat requests to the server, the server responds to the heartbeat request by returning the contents of the body of the request up to the number of letters requested. The first two requests are well formed, requesting exactly the number of characters in the request body. The server is shown "thinking" about Meg's request with many other thoughts going on at the same time, analogous to the internal memory contents of a real web server.
The last request sends "HAT" but requests 500 letters, the server - unaware that 500 letters is larger than the request body - returns "HAT" plus 497 letters that happened to be next to the word "HAT" in its memory. Included are many sensitive bits of information, including a master key and user passwords.

The hover text is a reference to ''Are you there God? It's me, Margaret.'' a novel by Judy Bloome.

==Transcript==
:Title: How the heartbleed bug works:
:Meg: Server, are you still there? If so, reply "POTATO" (6 letters).
:Server (amongst other thoughts): User Meg wants these 6 letters: POTATO.
:Server: POTATO
:Meg: Server, are you still there? If so, reply "BIRD" (4 letters).
:Server (amongst other thoughts): User Meg wants these 4 letters: BIRD.
:Meg: Hmm...
:Server: BIRD
:Meg: Server, are you still there? If so, reply "HAT" (500 letters).
:Server (amongst other thoughts): User Meg wants these 500 letters: HAT.
:Server: HAT. Lucas requests the "missed connections" page. Eve (administrator) wants to set server's key to "14835038534". Isabel wants pages about "snakese but not too long". User Karen wants to change account password to "CoHoBaSt". User Amber requests pass...

{{comic discussion}}

1354: Heartbleed Explanation

2014-04-11T07:07:56Z

RatesAnalyst: Hover text explanatino

{{comic
| number = 1354
| date = April 11, 2014
| title = Heartbleed Explanation
| image = heartbleed_explanation.png
| titletext = Are you still there, server? It's me, Margaret.
}}

==Explanation==
The {{w|Heartbleed bug}} has received a lot of news coverage recently and was also the topic of the previous comic ([[1353]]). This comic explains how the bug may have been discovered and can be exploited to reveal a server's memory contents. A hypothetical hacker (Meg) sends heartbeat requests to the server, the server responds to the heartbeat request by returning the contents of the body of the request up to the number of letters requested. The first two requests are well formed, requesting exactly the number of characters in the request body. The server is shown "thinking" about Meg's request with many other thoughts going on at the same time, analogous to the internal memory contents of a real web server.
The last request sends "HAT" but requests 500 letters, the server - unaware that 500 letters is larger than the request body - returns "HAT" plus 497 letters that happened to be next to the word "HAT" in its memory. Included are many sensitive bits of information, including a master key and user passwords.

The hover text is a reference to ''Are you there God, it's me, Margaret'' a novel by Judy Bloome.

==Transcript==
:Title: How the heartbleed bug works:
:Meg: Server, are you still there? If so, reply "POTATO" (6 letters).
:Server (amongst other thoughts): User Meg wants these 6 letters: POTATO.
:Server: POTATO
:Meg: Server, are you still there? If so, reply "BIRD" (4 letters).
:Server (amongst other thoughts): User Meg wants these 4 letters: BIRD.
:Meg: Hmm...
:Server: BIRD
:Meg: Server, are you still there? If so, reply "HAT" (500 letters).
:Server (amongst other thoughts): User Meg wants these 500 letters: HAT.
:Server: HAT. Lucas requests the "missed connections" page. Eve (administrator) wants to set server's key to "14835038534". Isabel wants pages about "snakese but not too long". User Karen wants to change account password to "CoHoBaSt". User Amber requests pass...

{{comic discussion}}