Security Burnout And Other Whining

from here

People are part of the system. That means they are sometimes part of the problem. Quit your belly aching and start working on solutions that acknowledge that fact.

(Inspiration)

And the Heartbleed jokes keep coming...

tweeted by Graham Cluley

Thanks to Graham Cluley for tweeting this joke. Also, we now know for certain that private keys do get leaked, so if you're patching systems against this bug you're probably going to want to replace your certificate too.

Hard To Believe The Security Of So Many Rests On The Shoulders Of So Few

from here

Perhaps if OpenSSL had enough financial resources to support more than a measly 4 core developers (only 1 of whom is full time) problems like the Heartbleed bug could be avoided.

Fake Taylor Swift On Heartbleed

tweet link

Thanks to whoever runs that fake Taylor Swift account for making this joke. There is some concern that Heartbleed leaks private keys, necessitating the replacement of SSL certificates, hence the joke.

Narrow Fences

from here (source image)

Some preventative measures are wholly inadequate for their intended purpose and should probably be put out of their misery.

Booth Babes? No Thank You

tweeted by Mike Rothman

Thanks to Mike Rothman for tweeting his and every other security person i've ever met's opinion of using booth babes at security conferences. I wonder when we're going to stop focusing on the babes and start holding the booth pimps accountable, though.

Time To Change All The Passwords

from here

It may seem alarmist to suggest changing all passwords, but since vulnerable webservers could have their entire memory contents dumped remotely, and since we have no idea which sites were vulnerable over the 2 years this bug has existed, the safest course of action is to assume all passwords are compromised. At the very least you should be changing passwords for the sites that are known to have been vulnerable when the news broke.

As this article points out, though, you shouldn't bother changing the password for a site while that site is still vulnerable (and if it is still vulnerable, you should probably not use it until it's fixed). When the dust has finally settled, though, your passwords should definitely all be changed.

Gary Warner: Why Do We Call It Cyber CRIME?

Everyone chipping in and doing their part is certainly something to think about. It might be the only way to get cyber crime to be treated like actual crime.

Windows: Finally Secure After All These Years

from here (source image)

You can make things arbitrarily secure, but you're likely to make them useless in the process.

(Happy Windows XP End-Of-Life, by the way)

So Long XP

tweeted by Ben Ten (really?)

Today's the day Microsoft stops supporting Windows XP. It's end-of-life for an old friend, but not death. In all likelihood it will continue as the undead for quite some time.