anchor.diff:                  }
               }
           aside
  +          ul
  +            li Let's make it easier. It's in this bit, where we go find the record
  +            li Any idea?
  +            li Here we've got a request for a TKEY record with a certain name
  +            li We look in the ADDITIONAL section for record names, and search for those in all our TKEY data
  +            li If that fails, we look in the ANSWER section of the requestm because that's what Win2000 incorrectly does
  +
   
         section
           pre(style='font-size: 80%; width: 100%; margin: 0')
  
positive.code:           ul
              li We're recruiting!
              li Follow me on twitter for slides
              li C# stack: Windows!
              li DOS via a specific IPv6 packet
              li XMLDOM ActiveX control in every windows up to 8.1 is vulnerable to bil laughs
              li Mostly fairly stable otherwise, main attacks tend to be ActiveX component leftovers
              li Java: 35 remotely exploitable vulns fixed this month's Java SE release
              li 4 exploits rated 10/10, but no details, includes many in JAX-WS etc
          
  
      // build:js scripts/scripts.js
      script(src='bower_components/bespoke.js/dist/bespoke.js')
  
negative.code:             s2n(payload, bp);
              memcpy(bp, pl, payload);
          aside
            ul
              li Allocates memory for response
              li Payload and padding here are the lengths, not the data, confusingly
              li Makes bp, a pointer within buffer, initially at the start
              li Writes a header of response type and payload length into bp
              li Copies payload bytes into bp too from pl (request payload buffer). But never checks length
              li
              li Trusts user input
              li Not best practices: opensslrampage.org, malloc reimplemented because they could do it better, but made Heartbleed less detectable
              li Errors aren't the issue, but general lack of consideration of info exposure: no real need to send back data at all
              li Could be handled better through isolation of SSL termination. Have a proxy that terminates SSL, passes plain through, only proxy vulnerable
              li Generally complex, poor naming choices, and again a feature nobody uses: SSL heartbeat for keepalive. 2012 RFC. Most protocols that would use it provide higher level keep-alives anyway
              li Updating the only answer. Anybody not ready to update strongly advised to shut their servers down asap until they could.
  
        section(data-bespoke-state='topic-slide') 
          h2 The also-rans:
  