When you first heard about Heartbleed, did you fail to react? (Normalcy bias)
[pollid:668]
When you first learned about the risk, what probability did you assign to being affected by it? (enter 0.0 if not affected)
[pollid:669]
What probability do you assign now? (Optimism bias) (enter 0.0 if not affected)
[pollid:670]
Were you surprised to find out that someone in your life did not know about Heartbleed, and regret not telling them when it had occurred to you to tell them? (Bystander effect)
[pollid:671]
EDIT: The second option should read “I did tell other people delayed” (poll options cannot be altered later)
What did you think it was going to take to address Heartbleed? Did you underestimate what it would take to address it competently? (Dunning-Kruger effect)
[pollid:672]
After reading news sources on Heartbleed instructions, were you surprised later that some of them were wrong?
[pollid:673]
How much time did you think it would take to address the issue? Enter the time in days, enter 0.0 to see results.
[pollid:674]
Did it take longer? (Planning fallacy) Enter the ″factor″ it took longer than expected (e.g. if it took double as long enter 2.0; to see results enter 1.0).
[pollid:675]
Did you ignore Heartbleed? (Ostrich effect)
[pollid:676]
I would have posted this in Main because it is totally applicable to practical rationality and real risks and it is well written and sourced.
That it is somewhat specialized and contains (very good!) technical advice shouldn’t matter (this is still much better and more applicable that relaying purely personal experiences which were also OK earlier).
But my judgement on this issue cannot be trusted.
For #1, “I reacted immediately” and “I reacted when the urgency became evident” are probably the same thing for most people. I heard about the bug 20 minutes after it was announced, from the Cloudflare blog of all places. Not even USN had posted about it. I patched my servers within an hour, and spent the next 5 hours waiting for my CA to respond to my revocation and re-key requests. Apparently they were inundated.
On the bright side, I prepared for security issues like this. I used multi-factor auth for our admin tools and perfect forward secrecy cipher suites for our TLS. Even with our private key, previously recorded traffic cannot be decrypted. And if an attacker got ahold of our passwords, they would still need to steal our YubiKeys to get access to our admin tools.
Note that a sysadmin might e.g. react immediately to patch their company’s servers, revoke keys, etc., but be far more lax about changing their own passwords.
Meanwhile, and possibly distorting the poll, I still have not reacted despite wanting to do so because my internet connection is currently a wet piece of string (slow GPRS). Perhaps there should be an option for “I couldn’t react”?
Not offered answer 1: I acted immediately by not logging in to anything, but not really doing anything else
Not offered answer 2: I thought I told someone, but she didn’t remember later so maybe I didn’t?
How long questions: The quickest folks would have it taken care of in hours, the slowest in years. When is it really taken care of?
The questions raised cry for a poll:
When you first heard about Heartbleed, did you fail to react? (Normalcy bias)
[pollid:668]
When you first learned about the risk, what probability did you assign to being affected by it? (enter 0.0 if not affected)
[pollid:669]
What probability do you assign now? (Optimism bias) (enter 0.0 if not affected)
[pollid:670]
Were you surprised to find out that someone in your life did not know about Heartbleed, and regret not telling them when it had occurred to you to tell them? (Bystander effect)
[pollid:671]
EDIT: The second option should read “I did tell other people delayed” (poll options cannot be altered later)
What did you think it was going to take to address Heartbleed? Did you underestimate what it would take to address it competently? (Dunning-Kruger effect)
[pollid:672]
After reading news sources on Heartbleed instructions, were you surprised later that some of them were wrong?
[pollid:673]
How much time did you think it would take to address the issue? Enter the time in days, enter 0.0 to see results.
[pollid:674]
Did it take longer? (Planning fallacy) Enter the ″factor″ it took longer than expected (e.g. if it took double as long enter 2.0; to see results enter 1.0).
[pollid:675]
Did you ignore Heartbleed? (Ostrich effect)
[pollid:676]
I would have posted this in Main because it is totally applicable to practical rationality and real risks and it is well written and sourced. That it is somewhat specialized and contains (very good!) technical advice shouldn’t matter (this is still much better and more applicable that relaying purely personal experiences which were also OK earlier). But my judgement on this issue cannot be trusted.
For #1, “I reacted immediately” and “I reacted when the urgency became evident” are probably the same thing for most people. I heard about the bug 20 minutes after it was announced, from the Cloudflare blog of all places. Not even USN had posted about it. I patched my servers within an hour, and spent the next 5 hours waiting for my CA to respond to my revocation and re-key requests. Apparently they were inundated.
On the bright side, I prepared for security issues like this. I used multi-factor auth for our admin tools and perfect forward secrecy cipher suites for our TLS. Even with our private key, previously recorded traffic cannot be decrypted. And if an attacker got ahold of our passwords, they would still need to steal our YubiKeys to get access to our admin tools.
Hooray for being paranoid about security.
Note that a sysadmin might e.g. react immediately to patch their company’s servers, revoke keys, etc., but be far more lax about changing their own passwords.
Meanwhile, and possibly distorting the poll, I still have not reacted despite wanting to do so because my internet connection is currently a wet piece of string (slow GPRS). Perhaps there should be an option for “I couldn’t react”?
Not offered answer 1: I acted immediately by not logging in to anything, but not really doing anything else Not offered answer 2: I thought I told someone, but she didn’t remember later so maybe I didn’t?
How long questions: The quickest folks would have it taken care of in hours, the slowest in years. When is it really taken care of?