explain xkcd - User contributions [en]

Talk:2119: Video Orientation

2019-03-04T14:32:27Z

141.101.96.221:

[IMG]http://i64.tinypic.com/2co1zio.png[/IMG]
More readable:I think this could be done with text too.
[[Special:Contributions/172.68.154.64|172.68.154.64]] 13:41, 4 March 2019 (UTC)

Obligatory prior art in this commentary space: [https://vimeo.com/313458699 Glove and Boots: Vertical Video Syndrome] (apparently they decamped from Youtube to Vimeo last month, the original c. 2013 video was Bt9zSfinwFA). [[User:JohnHawkinson|JohnHawkinson]] ([[User talk:JohnHawkinson|talk]]) 14:21, 4 March 2019 (UTC)

The title text seems to be a reference to AL, the A.I in ''2001 : A Space Odyssey'' which cause a few problems to the crew and mainly communicate through a round lens. [[Special:Contributions/172.69.226.171|172.69.226.171]] 14:27, 4 March 2019 (UTC)
::Or 2002 movie The Ring [[Special:Contributions/141.101.96.221|141.101.96.221]] 14:32, 4 March 2019 (UTC)

Talk:2096: Mattresses

2019-01-09T13:52:22Z

141.101.96.221: added comment

I wonder if the fact that it's unclear is in intentional, or if it was somehow a mistake [[User:Zachweix|Zachweix]] ([[User talk:Zachweix|talk]]) 13:46, 9 January 2019 (UTC)

Is it just me, or has the image got some graphical artefacts?[[User:Cyclic3|Cyclic3]] ([[User talk:Cyclic3|talk]])

It's not just you! [[Special:Contributions/141.101.96.221|141.101.96.221]] 13:52, 9 January 2019 (UTC)

2092: Consensus New Year

2019-01-06T00:59:06Z

141.101.96.221: /* Time zones */ added rest of Indonesia

{{comic
| number = 2092
| date = December 31, 2018
| title = Consensus New Year
| image = consensus_new_year.png
| titletext = The biggest jump is at 11:00am EST (4:00pm UTC) when midnight reaches the UTC+8 time zone. That time zone, which includes China, is home to a quarter of the world's population. India and Sri Lanka (UTC+5:30) put us over the 50% mark soon after.
}}

==Explanation==
{{incomplete|Created by a BOT. Please complete this explanation once everyone has entered the new year. Do NOT delete this tag too soon.}}

In this [[:Category:New Year|New Year comic]], [[Randall]] is proposing a compromise for when to celebrate, or recognize, {{w|New Year's Day}}. These celebrations traditionally take place at the stroke of midnight between Dec. 31st and Jan. 1st, at the local time of the event's location. With "Consensus New Year", these celebrations would happen at the same time, world over, and would be at exactly 1:30 pm {{w|Eastern Time Zone|EST}} (6:30 pm {{w|Coordinated Universal Time|UTC}}). At this time, about half the world's population would be in 2018 local time and the other half would be in 2019. This is due to the various time zones throughout the world, and the graph is based on the proportion of the population in these zones.

This is based on the assumption that the entire world uses the same calendar system. Randall's graph shows the year starting on the same day for the entire world. While the Gregorian calendar is used as the civil calendar in most countries of the world, the Eastern Orthodox churches uses the Julian calendar, on which the year will begin 13 days later, and the year (as of December 2018-January 2019) is 1440 on the Muslim calendar and 5779 on the Hebrew calendar. Other countries have the same New Year as the Gregorian calendar but count years differently; for example, 2019 is the year 108 in Taiwan and 2562 in Thailand.

The Wiktionary entry for "{{Wiktionary|consensus}}" includes multiple definitions, including these two meanings:

* (attributive) Average projected value
* General agreement among the members of a given group or community

In an attributive grammar structure, a noun is placed before another noun to assign an attribute to it. When "consensus" is used this way, it's a statistical term which means the average projected value of the modified noun.

Randall properly uses this first definition for both the title of the comic and the graph itself, where the graph represents the average projected value of the percentage of the world population reaching the new year at any given time.

Randall may be purposefully misusing the second definition of the word "consensus" to reflect the common misuse of the term {{Wikipedia|consensus}} for the practice of {{Wikipedia|majority vote}}.

In scenarios involving group decision-making, consensus means that all or almost all members of the group will accept the decision. Depending on how it is done, this generally results in a slower decision-making process due to discussion, but decisions that many more people are happy with. Consensus can scale to large groups of people using approaches such as the [https://seedsforchange.org.uk/spokescouncil spokescouncil model] to speed dialogue. By this definition, Consensus New Year happens at one of the last four time zones as the last to "agree" enter 2019, so (nearly full consensus definition) 4:00 am, 5:00 am, 6:00 am, or (full consensus definition) 7:00 am EST on January 1, 2019.

Consensus lies in contrast to majority vote, where a decision passes when over 50% of the people desire it. Majority vote is used in most current large democracies and is what most people are familiar with. It is quick to describe and implement, but can result in polarized political parties and a stark lack of minority rights, unless enough people develop concern for the issues that they are tempered with constitutions and [https://en.wikipedia.org/wiki/Logrolling logrolling].

The leftmost horizontal axis label (10am EST Dec 31st) was an error. The point marked as 0% should be 5am EST (see table below).

Additionally, some of the lines are shown with a slope, which is inaccurate. Since sun time is not used anywhere, a correct graph line would only consist of horizontal and vertical lines.

===Time zones===

{| class="wikitable sortable"
|-
! Time EST !! Time UTC !! %Population in 2019 !! Regions entering 2019
|-
| 5:00 AM || 10:00 || 0 || Pacific Islands
|-
| 6:00 AM || 11:00 || 0 || Pacific Islands, New Zealand (NZDT)
|-
| 7:00 AM || 12:00 || 0 || Kamchatka (Russia), Fiji
|-
| 8:00 AM || 13:00 || 0 || Magadan (Russia), Pacific Islands, Eastern Australia (Excluding Queensland)
|-
| 8:30 AM || 13:30 || 0 || South Australia
|-
| 9:00 AM || 14:00 || 0 || Vladivostok (Russia), Queensland (Australia)
|-
| 9:30 AM || 14:30 || 0 || Northern Territory (Australia)
|-
| 10:00 AM || 15:00 || 5 || Yakutsk (Russia), Japan, Korea, Eastern Indonesia
|-
| 11:00 AM || 16:00 || 25 || China, Irkutsk (Russia), Taiwan, Western Australia, Malaysia, Central Indonesia
|-
| 12:00 PM || 17:00 || 30 || Krasnoyarsk (Russia), Vietnam, Thailand, Western Indonesia
|-
| 1:00 PM || 18:00 || 35 || Omsk (Russia), Kazakhstan, Bangladesh
|-
| 1:30 PM || 18:30 || 55 || India, Sri Lanka
|-
| 2:00 PM || 19:00 || 60 || Yekaterinburg (Russia), Pakistan
|-
| 3:00 PM || 20:00 || 60 || Samara (Russia), Georgia, Oman, UAE
|-
| 4:00 PM || 21:00 || 70 || Moscow (Russia), Turkey, Saudi Arabia, East Africa
|-
| 5:00 PM || 22:00 || 75 || Eastern Europe, Egypt, Central & Southern Africa
|-
| 6:00 PM || 23:00 || 85 || Central Europe, Africa
|-
| 7:00 PM || 00:00 || 90 || (GMT) UK, Portugal, Ireland, Western Africa
|-
| 8:00 PM || 01:00 || 90 || Azores (Portugal), parts of Greenland
|-
| 9:00 PM || 02:00 || 90 || Parts of Greenland, Southern Brazil
|-
| 10:00 PM || 03:00 || 90 || Northeastern and Central Brazil, Argentina, Chile
|-
| 11:00 PM || 04:00 || 90 || Atlantic Canada, Venezuela
|-
| 12:00 AM || 05:00 || 95 || (EST) Eastern USA, Peru
|-
| 1:00 AM || 06:00 || 100 || (CT) Central USA, Mexico, Central America
|-
| 2:00 AM || 07:00 || 100 || (MT) Central USA, Western Mexico
|-
| 3:00 AM || 08:00 || 100 || (PST) Western USA
|-
| 4:00 AM || 09:00 || 100 || Alaska
|-
| 5:00 AM || 10:00 || 100 || Pacific Islands
|-
| 6:00 AM || 11:00 || 100 || Pacific Islands
|-
| 7:00 AM || 12:00 || 100 || Pacific Islands
|}

==Transcript==
{{incomplete transcript|Do NOT delete this tag too soon.}}
:[A graph labeled “Percentage of the world's population living in 2019” with Y-axis markers at 0%, 50%, and 100%, and X-axis markers at 10:00 AM EST Dec 31st, 1:30 PM EST, 7:00 PM EST, Midnight EST, 3:00 AM EST Jan 1st, and 7:00 AM EST.]
:[The line graph shows the percentage increasing from 0 to 100% in several steps, with 50% reached at 1:30 PM EST.]

:[Caption below the panel:]
:Consensus New Year: as of 1:30PM Eastern Time (6:30PM UTC) a majority of the world's population will be living in 2019.

==Trivia==
Randall has mislabeled the leftmost point of the graph: the Earth's earliest time zone ({{w|UTC+14:00}}) should have the midnight at 5:00 AM EST rather than 10:00 AM EST. The number of one-hour increments on the x-axis does not match Randall's label.

{{comic discussion}}

[[Category:New Year]]
[[Category:Time]]

2087: Rocket Launch

2018-12-23T05:49:41Z

141.101.96.221: Carebears is likely a reference to Eve Online

{{comic
| number = 2087
| date = December 19, 2018
| title = Rocket Launch
| image = rocket_launch.png
| titletext = NASA tries to coordinate launch timing with the Care Bears' cloud castle, but unfortunately sometimes collisions with stray Care Bears are unavoidable, so they just try to make the fairings sturdy and hope for a glancing impact.
}}

==Explanation==
{{incomplete|Created by a CARE BEAR STARE. Please mention here why this explanation isn't complete. Do NOT delete this tag too soon.}}

This comic was posted on a week with a notably high number of {{w|rocket launch}}es. Originally, there were to be four {{w|Orbital spaceflight|orbital rocket}} launches from the United States on December 19, 2018 (the publish date for the comic), which would have tied with the prior record for number of orbital rocket launches in one day. While these launches were ultimately delayed, breaking the event, the comic was doubtless under production by then.

Only some of the steps listed are actually typical.

; Liftoff
: The traditional start of a launch, when the rocket leaves the ground. The engines will typically have been ignited a short time before, often one-by-one in a specifically engineered sequence to reduce shock stress on the rocket, but need to throttle up to produce enough thrust to overcome the rocket's weight. Some launch pad configurations physically restrain the rocket (at least to some degree) until the engines are known to produce the required thrust then the rocket is released (e.g. by pyrotechnically crushing restraining bolts such as in NASA Space Shuttle configuration, or by hydraulic actuators opening a sturdy "clamp", such as in SpaceX Falcon 9 configuration). "Liftoff" refers to the moment this happens, making the rocket lift off the ground.
; {{w|Max q|Max-Q}}<nowiki>:</nowiki> Peak aerodynamic stress.
: A rocket accelerates from the moment it leaves the ground. The faster a rocket goes, the bigger volume of air it pushes through per second - but the higher a rocket goes, the thinner the air. (Before liftoff, the rocket is not moving, and thus is not pushing through air. Once in orbit, there is essentially no air to push through, so the rocket is not pushing through air. Between those two times, the rocket is pushing through some amount of air, the exact amount increasing before Max Q and decreasing after Max Q.) "Max Q" is the moment where these two factors produce a maximum, and is the point where the rocket's structure must withstand the most air pushing back against it.
; Booster separation
: Rockets are designed in {{w|Multistage rocket|stages}}, so they do not have to carry the empty fuel tanks all the way to orbit. (Carrying any mass to orbit is expensive, so the more that can be dropped off earlier, the better.) Three stages is typical. "Booster separation" marks the point where the first of these stages (the "{{w|Booster (rocketry)|booster}}"), its fuel expended, is typically ejected.
; Max-CB<nowiki>:</nowiki> Highest chance of collision with {{w|Care Bears}}.
: This is entirely fictitious. Care Bears are fictitious characters, which have a toy line, television series, and movies. The existence of a basketball sneaker named the "Nike Air Force Max CB" may or may not be relevant. Alternatively, in a space-based MMORPG {{w|Eve Online}}, "Carebears" is a derogatory term used for characters who avoid pvp combat, stay mostly in Concord (police) controlled high-security space (usually mining asteroids in their spaceships), and never venture to low security or zero security space, where pvp is freely enabled
; Main stage separation
: See "booster separation" above. This marks the point where the second stage (the "main stage") is ejected.
; {{w|GPS}} silenced so it will stop saying "Make a U-turn"
: Again, this is fictional. While some rockets do make use of signals from the Global Positioning System ("GPS"), no rockets are known to use the navigational devices that incorporate GPS readers and street maps, providing directions - often with optional text-to-speech - along the Earth's surface. Some such devices are notorious for getting confused in extreme situations (such as the high Mach numbers that rockets achieve); constantly uttering "make a U-turn" would be one such confusion, and any device in such a confused state might well be silenced for being more annoying than helpful. Navigation of this nature is neither necessary nor useful on a rocket, which will have its entire route from ground to orbit computed before launch, and piloting typically left entirely to computers given the precise timing required.
; Reunification (of boosters)
: Another fictional step. Discarded stages fall back into the Earth's atmosphere, either hitting the ground (or, more often, water) or burning up because of the heat-up resulting from high compression of air in front of them while re-entering thick layers of atmosphere at extreme speed. The booster and main stage would not be on a course to come anywhere near each other, and would not have enough fuel to change their course (running out of fuel being why they were discarded in the first place). Even if they did, landing for reuse (as {{w|SpaceX reusable launch system development program|SpaceX has attempted}}, often successfully) would be far more likely than a mid-air reunion.
; Pilot panics, copilot takes command after struggle
: Another fictional step. Astronauts are not the sort of people who panic easily, nor struggle with their crewmates. More importantly, in any modern rocket the "pilot" is not a human being, but a computer incapable of panic (as in the human emotion). It is possible that part of the flight computer could fail, causing redundant failsafes to take over, but the process could not correctly be described as a "struggle", and in any case this sort of failure is uncommon enough that it is not part of a "typical" rocket launch.
; Pursuit phase
: Fictional. This assumes the (nonexistent) reunified booster would have enough fuel to pursue the top stage of the rocket, and a reason to do so. See "Reunification". This might be a reference to the Pursuit Phase of the [http://www.climbtherainbow.com/domestic-violence-information/the-domestic-violence-cycle/ Domestic Violence Cycle]. The phase is characterized by the abuser attempting to convince the abused to reunite after a separation. This phase of the relationship cycle is when [https://www.nwalsafeplace.org/about-abuse/cycle-of-violence-2/ most domestic violence murders occur]. Sadly, the comic indicates that a fight ensues with only one of the pair continuing to orbit.
; Inter-stage {{w|dogfight}}
: Fictional. See "Pursuit phase". A dogfight is an aerial battle between fighter aircraft, conducted at close range. This step claims that the rocket booster and the top stage of the rocket engage in a battle. In the domestic violence analogy, the boosters would probably have been better off finding their own, separate path.
; Winner proceeds to space
: Fictional. As noted above, in a real rocket launch there is no dogfight for there to be a "winner" of. A kind reading would note that the top stage "wins" by default, and it is certainly the case that in a real (orbital) rocket launch, the top stage typically does proceed to space.

The title text refers once again to the Care Bears franchise. The Care Bears live in a castle made of clouds, called [https://carebears.fandom.com/wiki/Care-a-Lot_Castle Care-a-Lot Castle], so the comic claims that NASA aims to avoid launching into their castle, but sometimes cannot avoid hitting "stray" Care Bears.

==Transcript==
{{incomplete transcript|Do NOT delete this tag too soon.}}

[The major stages of a rocket launch are shown, with the rocket trajectory indicated by dotted lines. Each stage is annotated with a description and an arrow. A title above the image reads 'Outline of a typical rocket launch'.]

:[A rocket with two boosters is shown at the bottom left hand corner of the image taking off from a launch pad on the ground, surrounded by clouds of smoke.]
::Liftoff

:[The rocket ascends vertically]
::Max-Q: Peak aerodynamic stress

:[Separation of the two external booster rockets is shown, with the main rocket continuing to ascend vertically with a slight rightward tilt and the two boosters curving off to the right.]
::Booster separation

:[The main rocket stage starts to curve over to the right.]
::Max-CB: Highest chance of collision with care bears

:[Separation of the second rocket stage. Main rocket heads right, whilst second booster stage curves downward to meet trajectory of first booster stages.]
::Main stage separation

:[Main rocket continues towards the right.]
::GPS silenced so it will stop saying "make a U-turn"

:[First and second stage booster rocket trajectories meet and become a single trajectory heading upwards and right.]
::Reunification

:[Trajectory of main rocket wobbles slightly.]
::Pilot panics, copilot takes command after struggle

:[Booster stage rockets continue to head upwards and right towards the main rocket trajectory.]
::Pursuit phase

:[Main rocket and booster stage trajectories meet and cross three times.]
::Inter-stage dogfight

:[The trajectory for one of the stages ends in an explosion.]

:[The remaining trajectory, indicated with dashed-lines and question marks, continues towards the right and off the edge of the page.]
:: Winner proceeds to space

{{comic discussion}}

Talk:1931: Virtual Assistant

2017-12-21T09:27:32Z

141.101.96.221:

I just set up Siri to do this: https://youtu.be/B32YLUa6bUg [[User:DPS2004|DPS2004'); DROP TABLE users;--]] ([[User talk:DPS2004|talk]]) 15:54, 20 December 2017 (UTC)

The transcript has to follow the common layout as used in nearly all former comics. --[[User:Dgbrt|Dgbrt]] ([[User talk:Dgbrt|talk]]) 16:22, 20 December 2017 (UTC)

I feel like the explanation for this one missed the masturbation reference - the sounds of the sink and the zipper? [[Special:Contributions/172.68.189.181|172.68.189.181]] 22:36, 20 December 2017 (UTC)

Someone should hang a warning sign on that TvTropes link, you are playing with fire here! --Pax

Talk:78: Garfield

2014-12-02T16:50:08Z

141.101.96.221:

I disagree with the original author of the article, I don't think Garfield is poorly written. However, to avoid any greater conflict, I decided to keep it as it is. Does everyone else think it is "poorly written"? --[[User:Pnariyoshi|Pnariyoshi]] ([[User talk:Pnariyoshi|talk]]) 21:56, 28 January 2013 (UTC)
:There was certainly controversy sparked within the comic writing community when Bill Watterson, the creator of Calvin and Hobbes, quit early because he felt that cartoonists targeted their comics at too wide a market to be meaningful and funny. This was at the gestation of the internet, when the only funding that a cartoonist could find was from newspapers looking for something to fill the back page, and had to follow the newspaper's guidelines for neutrality to avoid offending anyone. Watterson called other cartoonists "sell-outs" for dumbing down their work for the mass-market, and he quit in disgust at his own newspaper's attempts to cull the philosophical speeches that were ever-so-common in Calvin and Hobbes. Since then, widespread corporate culture has made Dilbert a hit, and we ourselves are discussing XKCD here. Watterson would be smiling right now. '''[[User:Davidy22|Davidy22]]'''[[User talk:Davidy22|<tt>[talk]</tt>]] 00:44, 29 January 2013 (UTC)
::Wow, that was incredibly instructive. I'm actually very excited about this discussion. While I do agree "dumbing down" something that was originally intended for a specific niche is what ruins a lot of media (besides comic strips, I feel it commonly ruins TV shows, Movie adaptations etc), I think it would be unfair to call it "poorly written". I think a better word would be "unexciting", "lacking passion" or "having lost it's first love". Making a strip appeal to a wide range of people is not always as easy as it seems, especially without making it come down to bathroom/sexual jokes. While I do feel that Randall sometimes gets very close to the border of "distasteful", I think xkcd still maintains its roots and it is pretty funny and smart. --[[User:Pnariyoshi|Pnariyoshi]] ([[User talk:Pnariyoshi|talk]]) 02:25, 29 January 2013 (UTC)
:::Hi there, I'm the original author of the page in question. I do not mind if it is changed or even removed. [[Special:Contributions/98.162.150.124|98.162.150.124]] 02:08, 20 April 2013 (UTC)

I definitely agree that Garfield isn't poorly written, but it is basically lacking in creativity at this point. The underlying point remains however, and that is that the 'mainstream' all suffers from that same mass appeal sickness, which is rather outmoded in the modern era.{{unsigned|Crazedhatter}}

I don't have a particular opinion on whether this page says Garfield is "poorly written" or not, but I do think that most of the people arguing against it are undermining their own points. Pnariyoshi: If a piece of writing is unexciting and passionless, is this not grounds on which one could say it is "poor?" Crazedhatter: If a piece of writing lacks creativity and is outmoded for its own era, is that not also grounds on which one could say it is "poor?" If we all agree that there are serious artistic flaws with Garfield's writing, then why are we quibbling about synonyms? Call it "poor." [[Special:Contributions/71.201.53.130|71.201.53.130]] 15:13, 9 October 2013 (UTC)

Is this appeal possibly made with the 'Death of Garfield' plot-arc in mind (which, while not a great series of strips, was moderately interesting for its as Garfield not written for mass appeal)? I only ask because it would seem a relatively futile challenge were it not for the fact that Jim has actually strayed this way before; also, both xkcd's parody Garfield and the Death of Garfield series are horror-themed. [[Special:Contributions/143.92.1.32|143.92.1.32]] 01:14, 21 October 2013 (UTC)

What is happening in the last picture of Garfield? I mean the line across its face. As if there were two different photos on top of eah other, where the upper one was half removed. Maybe a suggestion from Randall that it is time to reveal the true Garfield...
[[Special:Contributions/141.101.96.221|141.101.96.221]] 16:50, 2 December 2014 (UTC)

1353: Heartbleed

2014-04-10T10:41:42Z

141.101.96.221: Corrected 64Kb (Kilo bits) to KiB (kilo bytes)

{{comic
| number = 1353
| date = April 9, 2014
| title = Heartbleed
| image = heartbleed.png
| titletext = I looked at some of the data dumps from vulnerable sites, and it was ... bad. I saw emails, passwords, password hints. SSL keys and session cookies. Important servers brimming with visitor IPs. Attack ships on fire off the shoulder of Orion, c-beams glittering in the dark near the Tannhäuser Gate. I should probably patch OpenSSL.
}}

==Explanation==
The {{w|Heartbleed bug}} refers to a critical bug in the {{w|OpenSSL}} cryptographic library. This bug was publicly revealed on Monday, April 7th, 2014. Due to a programming error in OpenSSL versions 1.0.1 through 1.0.1f — meaning the bug had existed for two years — attackers could read random server memory by sending specially prepared HeartbeatRequest messages to an affected server.

OpenSSL is a very commonly used library to implement {{w|SSL/TLS}}, a cryptographic protocol not only used to secure web traffic but also for mail clients and much more. Only the user and the server can read the communication. On the the web the protocol is ''https://'' (HTTP Secure), instead of the open ''http://'' standard. SSL is often used to protect sensitive web traffic, such as login requests, which contains the user names and passwords in the requests. The server sends a certificate to the browser before the secure connection is established. If the certificate is registered the browser accepts it automatically, otherwise the the user gets a popup to accept or reject this insecure certificate.

A vulnerability that lets an attacker read random clumps of memory on the server would possibly let an attacker find recent username/password requests, allowing them to gain unauthorized access to user accounts. Even worse, this vulnerability could read the server's private key, enabling anyone to impersonate the server and/or decrypt any future traffic that relies on that key, and any previously-obtained prior traffic also, unless a "perfect forward secrecy" ciphers is used, which is currently rare. Furthermore, the hearbleed exploit occurs during the handshake phase of setting up a connection, so no traces of it are logged, i.e. you can be attacked and never be the wiser.

More information is available at [http://heartbleed.com heartbleed.com] or under CVE-2014-0160, [https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160 CVE-2014-0160 at nvd.nist.gov]

The title text cites the {{w|Tears in rain soliloquy}}, the dying words of the replicant and main antagonist Roy Batty (played by {{w|Rutger Hauer}}) in the 1982 film ''{{w|Blade Runner}}'', implying that the 64KiB HeartBleed buffer is so complete it includes memories from replicant brains. This is ironic as in the soliloquy, Roy Batty stated "All those moments will be lost in time".

The title text also suggests to patch OpenSSL oneself, which might refer to the patched version of OpenSSL by Debian, which turned out to be vulnerable in 2008, and was the topic of [[424: Security Holes]].

===Heartbleed===

[http://en.wikipedia.org/wiki/Transport_Layer_Security Transport Layer Security] (TLS), the successor to [http://en.wikipedia.org/wiki/Secure_Sockets_Layer SSL] is a protocol that provides end-to-end encryption for data transmitted over the internet (described in [http://tools.ietf.org/html/rfc5246 RFC 5246]). The Heartbeat extension to TLS introduced in 2012 (described in [https://tools.ietf.org/html/rfc6520 RFC 6520]) provides a protocol for keeping an encrypted TLS session alive between the client and the server, so you do not have to do a costly TLS handshake with the server for subsequent transfer of information.

The Heartbeat protocol involves the client sending a packet with an arbitrary payload (often a random 16 to 32 byte number) that the server periodically sends back to the client to tell the client that the TLS session is still alive. When the client sends the packet to a vulnerable version of OpenSSL, the OpenSSL server reads a payload_size from the header sent by the client. This is a 2-byte number (0 to 0xffff=65535) that is supposed to describe the size of the payload. The OpenSSL library writes the payload to memory, but it does not check that the size of the payload written to memory matches the payload_size taken from the client's header. When the vulnerable server sends back the Heartbeat KeepAlive response to the client, it will readout payload_size number of bytes and send them back to the server. If you send a payload that is actually 16 bytes, but claims it is 0xffff bytes you will read the next 64KiB of memory of the vulnerable process starting from whereever the payload was written. An attacker can repeat this attack many times and can do this attack early in the TLS handshake, so the attack will not in any way be logged (unless they are logging every incoming packet which is not typical and would result in many passwords being logged). As private keys often have a specific form, it is often possible for an attacker to find the private TLS key, so if they eavesdrop on network traffic they can decrypt and/or alter it. For more detailed information see: [http://blog.cryptographyengineering.com/2014/04/attack-of-week-openssl-heartbleed.html 1], [http://security.stackexchange.com/a/55117/2568 2], [https://news.ycombinator.com/item?id=7549943 3].

It is worth noting that modern operating systems use a [http://en.wikipedia.org/wiki/Virtual_Memory#Usage virtual memory] abstraction above physical memory. This means every process can only access memory assigned to it, so it would be impossible for a vulnerable web server to read memory assigned to another process (like a text editor that has erotic fan fiction stored to memory) on the same computer. For more info, see: [http://security.stackexchange.com/a/55271/2568 4].

It also should be noted that this heartbleed bug only affects TLS, and does not affect OpenSSH which does not use the TLS protocol, but uses the SSH-2 protocol (described in [http://tools.ietf.org/html/rfc4251 RFC 4251] a distinct protocol. SSH is used for remote logins on unix and linux computers.

Vulnerable sysadmins need to update to a patched version of OpenSSL or one with the Heartbeats disabled, revoke their old TLS keys, and generate new TLS keys (as their old key may have been compromised).

Users of vulnerable systems should change their passwords after the sysadmins have revoked their old key and issued new ones (as their passwords may have been compromised).

The [https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f8661cb98227a5cbcc0f9f3 vulnerable commit] was introduced Dec 31st, 2011 by Robin Seggelmann, the first co-author of the heartbeats RFC and went live when OpenSSL version 1.0.1 was released on 2012-03-14 and the vulnerability was widely announced 2014-04-07.

==Transcript==
:Megan: Heartbleed must be the worst web security lapse ever.
:Cueball: Worst so far. Give us time.

:Megan: I mean, this bug isn't just broken encryption.
:Megan: It lets website visitors make a server dispense random memory contents.

:Megan: It's not just keys. It's traffic data. Emails. Passwords. Erotic fanfiction.
:Cueball: Is '''''everything''''' compromised?

:Megan: Well, the attack is limited to data stored in computer memory.
:Cueball: So paper is safe. And clay tablets.
:Megan: Our imaginations, too.
:Cueball: See, we'll be fine.

{{comic discussion}}

Talk:1334: Second

2014-02-24T22:43:30Z

141.101.96.221:

Reference to how much Google knows about us and the 'Filter Bubble'?
OTOH could just be a straight-forward observation of the search habits of most people - if I don't find what you're looking for on the first page , I try to refine my search terms rather than goto page 2 .
[[Special:Contributions/108.162.225.132|108.162.225.132]] 05:52, 24 February 2014 (UTC)
:But you can remember a time when you ''did'' go to the second or third page with some frequency, back when the Gooooooooooogle at the bottom of each page was rendered in text and your mom thought it was just so cool that the red 'o' showed her which page she was on. [[User:Jameslucas|jameslucas]] ([[User talk:Jameslucas|" "]] / [[Special:Contributions/Jameslucas|+]]) 14:32, 24 February 2014 (UTC)
::What do you mean, “back when”? The Gooooooooooogle still behaves the way you described. --[[Special:Contributions/108.162.254.64|108.162.254.64]] 16:58, 24 February 2014 (UTC)
:::Not quite. If you look at it, it's actually showing bits of an image, which happens to contain text. (The sprite sheet is http://www.google.com/images/nav_logo170_hr.png ) [[Special:Contributions/108.162.219.5|108.162.219.5]] 18:27, 24 February 2014 (UTC)
Interestingly, some research <citation missing> shows that Google's results are oriented more towards commercial results than other vendors, meaning that if you are looking for a non-commercial answer you might need to look at the second page (or switch search providers). [[User:Randymack|Randymack]] ([[User talk:Randymack|talk]]) 12:45, 24 February 2014 (UTC)
:I really want to see that citation. --[[User:NeatNit|NeatNit]] ([[User talk:NeatNit|talk]]) 15:09, 24 February 2014 (UTC)
::You could probably Google for it... :) [[Special:Contributions/199.27.128.84|199.27.128.84]] 17:16, 24 February 2014 (UTC)

The dictionary definition of "desperation" looks a bit out of place. What's the point in it? Also, is there an explanation for the talking rock? A mention to the symbolic over dramatization of the incident? [[User:Dulcis|Dulcis]] ([[User talk:Dulcis|talk]]) 15:43, 24 February 2014 (UTC)

Are we sure it's a desert? I know it mentions "desolate wastes", but it looks an awful lot like a seashore to me, not a desert. —[[User:Scs|Scs]] ([[User talk:Scs|talk]]) 17:09, 24 February 2014 (UTC)
:I can see that, but fairly certain it's a desert. His footprints linger to the right. If he were wading in water they'd not last. And the rock on the left has several smaller pebbles around it, which would be covered if the rock were in water. [[Special:Contributions/199.27.128.84|199.27.128.84]] 17:21, 24 February 2014 (UTC)

I think the title text is referring to the results from searching for a number like "19". Instead of information about nineteen, you get lots of pages which tangentially refer to it, such as "President correcting discrimination against 19 Jewish, Hispanic and African American soldiers" or pages with a copyright year of 19xx. -[[Special:Contributions/108.162.219.7|108.162.219.7]] 17:10, 24 February 2014 (UTC)
:The title text actually says "page copyright year starts with '19'." I don't know how that can be interpreted as anything other than a reference to a year. [[Special:Contributions/199.27.128.84|199.27.128.84]] 17:21, 24 February 2014 (UTC)

I think the rock is a reference to World of Warcraft, where some quests lead you to a rock or pile of mud. [[Special:Contributions/141.101.96.221|141.101.96.221]] 22:43, 24 February 2014 (UTC)