By now everyone on the planet with an internet connection has heard about the OpenSSL bug known as "heartbleed" that can compromise secure (https:) websites (or really, any "secure" communications on any device that uses OpenSSL, including possibly your smartphone.)

So, is it time to panic? Close all your accounts? Log off and retreat to a desert island?

Probably not. Unless you are really paranoid. Which is not necessarily a bad thing.

Personally, I have not done anything. Because, what are you going to do? Anything you type (or say or record) into a computer or any other device connected to the internet is potentially vulnerable. It's a fact of modern life. Deal with it.

Basically, what this bug allows a criminal to do is see 64K chunks of the server's random access memory (RAM) in the clear. Sloppy programming allowed this. The fix is basically one line of code. The exploit is one of the oldest tricks in the book, that is, tricking a program into returning data from out of bounds memory space.

(The inverse is tricking a program into injecting code into out of bounds memory space and executing it. That's how some viruses work. This is not a virus.)

If a big online service has thousands of servers with terabytes or more of RAM, a 64K chunk is like one grain of sand on the beach, right? Plus, it's "random" as in "random" access memory. A random 64K chunk couldn't possibly contain much useful information, right? And the odds of anyone catching a random 64K chunk of data containing something interesting about me are astronomical, right?

Well, yes and no.

The problem is that the 64K chunk of RAM is most likely allocated in the same general vicinity of your browsing session and/or the OpenSSL cryptography functions. This means that stuff like your (or some other unlucky person's) login and password could be hanging around in that space in the clear. Or, a "session key," which would allow a criminal to impersonate you and your browser. Or worse yet, the server's private SSL certificate key (the keys to the kingdom), in which case all communications to and from that server are compromised.

The good news is that a lot of bad and somewhat unlikely things would have to happen for a criminal to be able to exploit this bug.

The bad news is that you could be the unlucky person to have your password or other information exposed. Or a site you visit could be compromised, and NSA (or Facebook) could be watching everything you type on it.

At any rate, I am not aware of any reported actual exploits of the "heartbleed" OpenSSL bug. But the extent of the problem is not yet fully known and we don't know what we don't know.

So, what should you do?

First, you have to wait for the online services you use that also use OpenSSL to apply the fix. (They will also likely have to install new SSL certificates). They should announce that they have done this. Most major sites have already done so. (If you're not sure, you can use one of the verification services that have popped such as this one.)

After you have confirmed that the sites you use have applied the fix, you should next change your passwords on those sites. (And don't use the same password on every site, OK?)

Beyond that, about all you can do is monitor your credit card accounts, bank statements, online merchant accounts, etc. for suspicious activity until this dies down (which may be never). But you should be doing that from time to time anyway.

And lastly, beware of phishing or other scams that try to trick you into disclosing your password and/or other credentials or any other sensitive personal information, either via email, telephone or fake websites. These creeps come out of the woodwork to "help" you whenever there's a widely reported security problem.

For more info:

Everything you need to know about the Heartbleed SSL bug

Anatomy of a data leakage bug - the OpenSSL "heartbleed" buffer overflow

Why Heartbleed is dangerous? Exploiting CVE-2014-0160

Codenomicon Heartbleed Bug page

DISCLAIMER: I am not an internet security expert. Your mileage may vary. Proceed at your own risk. May the odds forever be in your favor. Etc.