5 ms·

This article made me change my[0] business' choice from Odoo to Tryton. Thanks to RMS for pointing me/us to this better option. http://medicalcannab.is http://

This article made me change my[0] business' choice from Odoo to Tryton. Thanks to RMS for pointing me/us to this better option. http://medicalcannab.is http://medicalcannab.is

icebraining 11y ago
Your site's tirade against "broken encryption" is weird. You do know that no major desktop browser uses OpenSSL, right?
- andreasvc 11y ago
  But most HTTP servers do use OpenSSL, so the tirade is not wrong.
  - icebraining 11y ago
    But that's up to them, to choose a server which doesn't. Whereas currently, people are being redirected to the safe site from a completely unprotected landing page, so they can get MITM'ed and sent to a honeypot instead.
    - anonbanker 11y ago
      please let me know how someone can be MITM'ed when connecting to medicalcannab.is over Tor. When you connect to the domain with torbrowser, the server detects your IP, then redirects to the appropriate .onion site if coming from an exit node. In order to be MITM'd, you'd have to either be using a Tor exit node that was compromised, or my server would have to be completely compromised beforehand. neither of these seem like likely scenarios, so I'm curious as to what you see that I don't.
      - detaro 11y ago
        You should assume Tor exit nodes to be hostile. There have been exit nodes that injected malicious code into binaries downloaded through them, and running an exit node is an obvious choice for an attacker, hoping for people running unencrypted traffic through them.
        anonbanker 11y ago
        Fair enough. someone could mirror my site's content, and we wouldn't have the ability to check where it's going. However, that's not too much an issue. we don't offer binaries (outside of two pdf files that may have a jpg embedded), and nothing on our Onion site requires a download. The most they could really do is make someone give bitcoins to the wrong wallet. That's a pretty easy customer service issue to solve ("We are not responsible for bitcoins sent to wrong wallets"). I guess I'm not seeing the vulnerability here.
- anonbanker 11y ago
  Your reply is kind of off-topic, don't you think? Nowhere on the site do I say that a desktop browser uses OpenSSL. I'm not sure where you got that from. If you'll notice, our website does not use broken encryption (because SSL delivered by OpenSSL is a joke anyway). And we currently require you to install Tor Browser in order to have dependable encryption before purchasing. Either way, thanks for looking at our website!
madeofpalk 11y ago
For someone so passionate about security of the internet, I was surprised to find that you're loading, trusting, and executing random 3rd party javascript from Google and others.
- anonbanker 11y ago
  the only thing that (should) be loading on the page is bootstrap (which IIRC, is hosted locally). Please let me know if _anything_ from google is being loaded in the background, so I can remove it promptly.
  - madeofpalk 11y ago
    Did you look at your page? An extremely brief glance at your source shows that you're loading 3rd party javascript from two different hosts, one being Google. Are you sure you know what you're doing?
    - anonbanker 11y ago
      Yeah, I'm not seeing the javascript you're talking about. all our .js files are locally-hosted.

This article made me change my[0] business' choice from Odoo to Tryton. Thanks to RMS for pointing me/us to this better option. http://medicalcannab.is http://medicalcannab.is

icebraining 11y ago

Your site's tirade against "broken encryption" is weird. You do know that no major desktop browser uses OpenSSL, right?

andreasvc 11y ago
But most HTTP servers do use OpenSSL, so the tirade is not wrong.
- icebraining 11y ago
  But that's up to them, to choose a server which doesn't. Whereas currently, people are being redirected to the safe site from a completely unprotected landing page, so they can get MITM'ed and sent to a honeypot instead.
  - anonbanker 11y ago
    please let me know how someone can be MITM'ed when connecting to medicalcannab.is over Tor. When you connect to the domain with torbrowser, the server detects your IP, then redirects to the appropriate .onion site if coming from an exit node. In order to be MITM'd, you'd have to either be using a Tor exit node that was compromised, or my server would have to be completely compromised beforehand. neither of these seem like likely scenarios, so I'm curious as to what you see that I don't.
    - detaro 11y ago
      You should assume Tor exit nodes to be hostile. There have been exit nodes that injected malicious code into binaries downloaded through them, and running an exit node is an obvious choice for an attacker, hoping for people running unencrypted traffic through them.
      - anonbanker 11y ago
        Fair enough. someone could mirror my site's content, and we wouldn't have the ability to check where it's going. However, that's not too much an issue. we don't offer binaries (outside of two pdf files that may have a jpg embedded), and nothing on our Onion site requires a download. The most they could really do is make someone give bitcoins to the wrong wallet. That's a pretty easy customer service issue to solve ("We are not responsible for bitcoins sent to wrong wallets"). I guess I'm not seeing the vulnerability here.
anonbanker 11y ago
Your reply is kind of off-topic, don't you think? Nowhere on the site do I say that a desktop browser uses OpenSSL. I'm not sure where you got that from. If you'll notice, our website does not use broken encryption (because SSL delivered by OpenSSL is a joke anyway). And we currently require you to install Tor Browser in order to have dependable encryption before purchasing. Either way, thanks for looking at our website!

madeofpalk 11y ago

For someone so passionate about security of the internet, I was surprised to find that you're loading, trusting, and executing random 3rd party javascript from Google and others.

anonbanker 11y ago
the only thing that (should) be loading on the page is bootstrap (which IIRC, is hosted locally). Please let me know if _anything_ from google is being loaded in the background, so I can remove it promptly.
- madeofpalk 11y ago
  Did you look at your page? An extremely brief glance at your source shows that you're loading 3rd party javascript from two different hosts, one being Google. Are you sure you know what you're doing?
  - anonbanker 11y ago
    Yeah, I'm not seeing the javascript you're talking about. all our .js files are locally-hosted.