Evolution or e-volution?
Shortly after the World Trade Center 9/11 disaster in New York City, I found myself reflecting on friendships and people I have lost along the way.
I turned inside myself and began journaling on a daily basis to help myself overcome the horror and isolation that comes with such an event.
Friends I had gone to school with; productive members of the community... people who had accomplished so many things I had yet to do myself. So different from the I was living at the time.
The feelings were overwhelming and went far beyond fear, solitude, and I began to question my purpose in this life.
Had I been just a few miles closer, heading west that day instead of east, I would have driven right into Ground Zero.
Friends circulated e-mails about form,er classmates that were presumed dead. They had families: pregnant wives, children, and all of the things that I believed I would have by the time I reached my 30's.
I quickly realized how many of my peers had achieved at least some of the goals they set out to accomplish years earlier— and I felt pangs of guilt and sadness seeing how much they were loved, how fondly they were remembered, and how many of them were on their way to achieving great things.
By that time, I was nearing my thirtieth birthday and the list of goals I set for myself seemed hopelessly beyond my reach.
Not just beyond my grasp— the future seemed ominous, scary, and it took everything I had to keep myself alive.
In the months after the assault, I became increasingly aware of just how disconnected I was from my past.
Before FaceBook, there was classmates.com…. One day I got one of those e-mails that makes you feel as though someone from my past was trying to contact me. I thought long and hard before I responded.
I had a mix of emotions.
I had done everything I possibly could to quietly erase any ties or connections I had to the past.
Filling out the online registration for FaceBook; responding to my 20th reunion invitations; afraid to be exposed for being poor.... but then it came time....
I am not poor, I am merely a rich person without any money.
Because I had never lived with one parent, one house, or one school any longer than a year or two at best, it was not that hard to fade away into a distant memory.
I wanted to be forgotten.
The last few weeks of my life have been anything short of living moment to moment... confronted with all the crises I wanted so badly to leave behind.... yet those experiences; my fight or flight instinct carried me through.
Thank you to all who tweeted and chatted... I made it through the storm, and I am glad to know you were there with me.
I am glad to be alive today, and I look forward to attending at least one of the three possible reunions. I hope you are glad to have me.
Cheers to you all, can't wait to see y'all at the Freak Parade!
Just me,
e
DailyDDoSe
Critical crypto bug in OpenSSL opens two-thirds of the Web to eavesdropping
Aurich Lawson / Thinkstock
For a more detailed analysis of this catastrophic bug, see this update, which went live about 18 hours after Ars published this initial post.
Researchers have discovered an extremely critical defect in the cryptographic software library an estimated two-thirds of Web servers use to identify themselves to end users and prevent the eavesdropping of passwords, banking credentials, and other sensitive data.
The warning about the bug in OpenSSL coincided with the release of version 1.0.1g of the open-source program, which is the default cryptographic library used in the Apache and nginx Web server applications, as well as a wide variety of operating systems and e-mail and instant-messaging clients. The bug, which has resided in production versions of OpenSSL for more than two years, could make it possible for people to recover the private encryption key at the heart of the digital certificates used to authenticate Internet servers and to encrypt data traveling between them and end users. Attacks leave no traces in server logs, so there's no way of knowing if the bug has been actively exploited. Still, the risk is extraordinary, given the ability to disclose keys, passwords, and other credentials that could be used in future compromises.
"Bugs in single software or library come and go and are fixed by new versions," the researchers who discovered the vulnerability wrote in a blog post published Monday. "However this bug has left a large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitations and attacks leaving no trace this exposure should be taken seriously."
The researchers, who work at Google and software security firm Codenomicon, said even after vulnerable websites install the OpenSSL patch, they may still remain vulnerable to attacks. The risk stems from the possibility that attackers already exploited the vulnerability to recover the private key of the digital certificate, passwords used to administer the sites, or authentication cookies and similar credentials used to validate users to restricted parts of a website. Fully recovering from the two-year-long vulnerability may also require revoking any exposed keys, reissuing new keys, and invalidating all session keys and session cookies. Members of the Tor anonymity project have a brief write-up of the bug here, and a this analysis provides useful technical details.
OpenSSL is by far the Internet's most popular open-source cryptographic library and TLS implementation. It is the default encryption engine for Apache, nginx, which according to Netcraft runs 66 percent of websites. OpenSSL also ships in a wide variety of operating systems and applications, including the Debian Wheezy, Ubuntu, CENTOS, Fedora, OpenBSD, FreeBSD, and OpenSUSE distributions of Linux. The missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension affects OpenSSL 1.0.1 through 1.0.1f.
The bug, which is officially referenced as CVE-2014-0160, makes it possible for attackers to recover up to 64 kilobytes of memory from the server or client computer running a vulnerable OpenSSL version. Nick Sullivan, a systems engineer at CloudFlare, a content delivery network that patched the OpenSSL vulnerability last week, said his company is still evaluating the likelihood that private keys appeared in memory and were recovered by attackers who knew how to exploit the flaw before the disclosure. Based on the results of the assessment, the company may decide to replace its underlying TLS certificate or take other actions, he said.
Attacking from the outside
The researchers who discovered the vulnerability, however, were less optimistic about the risks, saying the bug makes it possible for attackers to surreptitiously bypass virtually all TLS protections and to retrieve sensitive data residing in the memory of computers or servers running OpenSSL-powered software.
"We attacked ourselves from outside, without leaving a trace," they wrote. "Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication."
They called on white-hat hackers to set up "honeypots" of vulnerable TLS servers designed to entrap attackers in an attempt to see if the bug is being actively exploited in the wild. The researchers have dubbed the vulnerability Heartbleed because the underlying bug resides in the OpenSSL implementation of the TLS heartbeat extension as described in RFC 6520 of the Internet Engineering Task Force.
The OpenSSL vulnerability is the latest to threaten the HTTPS scheme that's the default and often only method for cryptographically protecting websites, e-mail, an other Internet communications from attacks that allow hackers to eavesdrop on end users or impersonate trusted websites. Last month, developers of the GnuTLS library disclosed an equally catastrophic bug that left hundreds of open-source applications open to similar attacks. And in February, Apple fixed an extremely critical vulnerability in the iOS and OS X operating systems that also made it possible for hackers to bypass HTTPS protections.
This post has been updated throughout to add newly available links and details.
