It provided good motivation to change every password I have.
I came across a really good comment on this in the programming subreddit that detailed what had to happen for this to occur: A custom allocator that is written in a way so that it won't crash or show any unusual behavior when allocation bounds are overrun even after many requests. A custom allocator that favours re-using recently used areas of memory. Which as we've seen, tends to lead it to it expose recently decoded https requests. Avoidance of third party memory testing measures that test against such flaws under the guise of speed on some platforms. A Heartbeat feature that actually responds to users that haven't got any sort of authorization. A Heartbeat feature that has no logging mechanism at all. A Heartbeat feature that isn't part of the TLS standard and isn't implemented by any other project. A Heartbeat feature that was submitted in a patch on 2011-12-31 which is before the RFC 6520 it's based on was created. By the same author as the RFC. Code that is extremely obfuscated without reason.Fucking hell. The things that had to come together to make this do what it does and stay hidden for so long blows my mind.