1354: Heartbleed Explanation - Revision history

Onestay: I know, I know. Let a man whom a who.

2025-04-25T03:51:30Z

I know, I know. Let a man whom a who.

172.68.55.12 at 23:04, 7 October 2024

2024-10-07T23:04:45Z

172.70.130.201: /* Transcript */ That is a notepad, not a notebook. There is little to no bookishness to it.

2023-02-14T19:23:47Z

‎Transcript: That is a notepad, not a notebook. There is little to no bookishness to it.

172.70.201.26: /* Explanation */

2023-01-31T21:10:11Z

‎Explanation

Sumwun at 16:26, 30 October 2022

2022-10-30T16:26:55Z

Graham87: /* Explanation */ copyedit

2022-10-16T16:35:31Z

‎Explanation: copyedit

172.70.86.34: /* Transcript */ Presuming "and a pen" avoids confusion with a laptop-type "notebook" (considered "notepad", but similar concerns, and given 'notepad'+stylus use is a thing it might be even more of a confusion)

2022-08-18T08:44:00Z

‎Transcript: Presuming "and a pen" avoids confusion with a laptop-type "notebook" (considered "notepad", but similar concerns, and given 'notepad'+stylus use is a thing it might be even more of a confusion)

IJustWantToEditStuff: /* Transcript */

2022-08-18T04:37:15Z

‎Transcript

Davidy22: Reverted edits by Explain xkcd server admin (talk) to last revision by Mushrooms

2022-05-21T02:55:18Z

Reverted edits by Explain xkcd server admin (talk) to last revision by Mushrooms

Show changes

Explain xkcd server admin at 21:42, 20 May 2022

2022-05-20T21:42:55Z

Show changes

@@ Line 18: / Line 18: @@
 Although Randall shows Meg recording the data by hand, on paper, it is more likely that a person exploiting the bug would have a computer record the data, perhaps on its hard drive or on a flash drive. However one could argue that such a person would not communicate to the server by speaking out loud either.
-The title text is a reference to ''{{w|Are You There God? It's Me, Margaret.}}'', a novel by {{w|Judy Blume}}, and plays off of the "server, are you still there?" line in every panel where she did start a request. The novel is the theme of another comic [[1544: Margaret]] too. ''Meg'' can be a nickname for ''Margaret'' as well as ''[[Megan]]'' who Margaret resembles.
+The title text is a reference to ''{{w|Are You There God? It's Me, Margaret.}}'', a novel by {{w|Judy Blume}}, and plays off of the "server, are you still there?" line in every panel where she did start a request. The novel is the theme of another comic [[1544: Margaret]] too. ''Meg'' can be a nickname for ''Margaret'' as well as ''[[Megan]]'' whom Margaret resembles.
 ==Transcript==

@@ Line 8: / Line 8: @@
 ==Explanation==
-The {{w|Heartbleed bug}} has received a lot of news coverage recently and was also the topic of the previous comic [[1353: Heartbleed]]. This comic explains how the bug may have been discovered and can be exploited to reveal a server's memory contents.
+The {{w|Heartbleed bug}} was, at the time of publication of this comic, receiving a lot of news coverage recently and was also the topic of the previous comic [[1353: Heartbleed]]. This comic explains how the bug may have been discovered and can be exploited to reveal a server's memory contents.
 A [[Megan]]-like character named Margaret (or "Meg") sends heartbeat requests to the server, the server responds to the heartbeat request by returning the contents of the body of the request up to the number of letters requested. The first two requests are well formed, requesting exactly the number of characters in the request body. The server's memory is showing Meg's request with many other requests going on at the same time.

@@ Line 49: / Line 49: @@
 :Server memory: <tt>a connection. Jake requested pictures of deer. '''User Meg wants these 500 letters: HAT.''' Lucas requests the "missed connections" page. Eve (administrator) wants to set server's master key to "14835038534". Isabel wants pages about "snakes but not too long". User Karen wants to change account password to "CoHoBaSt". User</tt>
-:[Server thinks, the same as above, although cut a little different at the edges, with everything from (and including) "HAT" highlighted in yellow and it replies the highlighted part and even more in a rectangular speech bubble. Meg has taken a notebook and a pen and is writing something.:]
+:[Server thinks, the same as above, although cut a little different at the edges, with everything from (and including) "HAT" highlighted in yellow and it replies the highlighted part and even more in a rectangular speech bubble. Meg has taken a notepad and a pen and is writing something.:]
 :Server memory: <tt>a connection. Jake requested pictures of deer. '''User Meg wants these 500 letters: HAT.''' Lucas requests the "missed connections" page. Eve (administrator) wants to set server's master key to "14835038534". Isabel wants pages about "snakes but not too long". User Karen wants to change account password to "CoHoBaSt". User</tt>

@@ Line 16: / Line 16: @@
 Often popular explanations of security bugs require the issue to be simplified a lot and to leave out a lot of details. In this case [[Randall]] didn't have to do much simplifying; the bug is actually that simple. Also, any client that can connect to the server can typically exploit this bug in the underlying {{w|OpenSSL}} software — the use of the term "User Meg" does not imply that Meg had to authenticate first.
-Although Randall shows Meg recording the data by hand, on paper, it is more likely that a person exploiting the bug would have a computer record the data, perhaps on its hard drive or on a flash drive.
+Although Randall shows Meg recording the data by hand, on paper, it is more likely that a person exploiting the bug would have a computer record the data, perhaps on its hard drive or on a flash drive. However one could argue that such a person would not communicate to the server by speaking out loud either.
 The title text is a reference to ''{{w|Are You There God? It's Me, Margaret.}}'', a novel by {{w|Judy Blume}}, and plays off of the "server, are you still there?" line in every panel where she did start a request. The novel is the theme of another comic [[1544: Margaret]] too. ''Meg'' can be a nickname for ''Margaret'' as well as ''[[Megan]]'' who Margaret resembles.

← Older revision		Revision as of 16:26, 30 October 2022
Line 57:		Line 57:

	[[Category:Comics with color]]		[[Category:Comics with color]]
−	[[Category:~~Computers~~]]	+	[[Category:Computer security]]

@@ Line 12: / Line 12: @@
 A [[Megan]]-like character named Margaret (or "Meg") sends heartbeat requests to the server, the server responds to the heartbeat request by returning the contents of the body of the request up to the number of letters requested. The first two requests are well formed, requesting exactly the number of characters in the request body. The server's memory is showing Meg's request with many other requests going on at the same time.
-Meg then ponders this and tries to another request asking for "HAT" but requests that it be 500 letters long instead of only 3; the server —not checking it or simply unaware that 500 letters is larger than the request body— returns "HAT" plus 497 letters that happened to be next to the word "HAT" in its memory (more will follow than are shown in the server's speak bubble as there are only 251 letters/symbols in the shown reply). Included are many sensitive bits of information, including a master key and user passwords. One of the passwords shown is "CoHoBaSt", a reference to [[936: Password Strength]], which suggests using "<u>co</u>rrect <u>ho</u>rse <u>ba</u>ttery <u>st</u>aple" as a password.
+Meg then ponders this and tries to submit another request asking for "HAT" but requests that it be 500 letters long instead of only 3; the server —not checking it or simply unaware that 500 letters is larger than the request body— returns "HAT" plus 497 letters that happened to be next to the word "HAT" in its memory (more will follow than are shown in the server's speech bubble as there are only 251 letters/symbols in the shown reply). Included are many sensitive bits of information, including a master key and user passwords. One of the passwords shown is "CoHoBaSt", a reference to [[936: Password Strength]], which suggests using "<u>co</u>rrect <u>ho</u>rse <u>ba</u>ttery <u>st</u>aple" as a password.
-Often popular explanations of security bugs require the issue to be simplified a lot and to leave out a lot of details. In this case [[Randall]] didn't have to do much simplifying; the bug is actually that simple. Also, it should be noted that any client which can connect to the server typically can exploit this bug in the underlying {{w|OpenSSL}} software — the use of the term "User Meg" does not imply that Meg had to authenticate first.
+Often popular explanations of security bugs require the issue to be simplified a lot and to leave out a lot of details. In this case [[Randall]] didn't have to do much simplifying; the bug is actually that simple. Also, any client that can connect to the server can typically exploit this bug in the underlying {{w|OpenSSL}} software — the use of the term "User Meg" does not imply that Meg had to authenticate first.
 Although Randall shows Meg recording the data by hand, on paper, it is more likely that a person exploiting the bug would have a computer record the data, perhaps on its hard drive or on a flash drive.