4 ms·
Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/ http://selinuxgame.or
by nickysielicki 5y ago
Everyone who has even a slight interest in learning how to use selinux should just go through this CTF-style game: http://selinuxgame.org/ http://selinuxgame.org/
- colordrops 5y agoIronic (maybe intentional?) that this site doesn't use TLS.
- josephg 5y agoThere's something funny about a website about teaching security practices being unavailable through HTTPS. It looks like the website is hosted by github pages, and the author didn't bother setting up SSL correctly.
- vermilingua 5y agoIs there anything on the site that needs to be secured with TLS? There's no authentication, no user details, why would it need to be secured?
- deniska 5y agoSo that your ISP, or someone else along the way, doesn't put a cryptocurrency miner into the page source.
- withinrafael 5y agoSomeone in the middle could teach you a variant of the material in hopes of creating more insecure servers out there. Or perhaps link to an "official companion app|pdf|exe" on the page.
- d2wa 5y agoOr more likely: insert a cryptocoin miner script or ads.
- stevenhuang 5y agoUsing HTTP leaves you open to being mitm'd, for one.
- perryizgr8 5y agoWhy would you need SSL/HTTPS for a casual game like this?
- Gigachad 5y agoIt's free to set up. Justify why it can't be https.
- perryizgr8 5y agoLots of things are free. Doesn't mean you need to do them. The burden of justification lies on the people advocating for adding complexity and dependency to a simple system.
- Gigachad 5y agoIt’s not complex. You click a button on GitHub. So gaining a decent amount of security and privacy easily justifies the work of clicking a button.
- nix23 5y agoThe Vagrantfile, but otherwise your right.
- josephg 5y agoBecause plenty of unscrupulous ISPs and governments log unencrypted web traffic. Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages their customers visit for who knows what reason. HTTPS is free and stops most of these tricks from working. You can still sniff the domain name via DNS or SNI, but HTTPS blocks attackers from seeing the URL you're visiting, or seeing the traffic the server sends back. It also stops people from doing MITM attacks on the connection. Its 2022. HTTPS is fast, it works great and its free. Use it everywhere.
- perryizgr8 5y ago> Because plenty of unscrupulous ISPs and governments log unencrypted web traffic. Ok. Not relevant here. I don't care if my ISP knows I'm learning SELinux. And they would know that even with HTTPS. > Some ISPs use that information for advertising, or inject custom javascript into unencrypted web pages Sounds like an ISP problem. Buy service from a better one. No need to impose SSL on the website for this. > HTTPS is free Absolutely not. It takes time and effort to set up. And then maintain forever. Plus you're introducing an unnecessary dependency on multiple third parties. > HTTPS is fast HTTP is faster.