4 ms·
Two observations: a) after signing up there setting "Allow Ello to gather anonymous information about your visit, which helps us make Ello better. Learn more."
by jnsaff2 12y ago
Two observations:
a) after signing up there setting "Allow Ello to gather anonymous information about your visit, which helps us make Ello better. Learn more." defaults to YES.
This from a site that is selling themselves as a privacy conscious is simply comical.
b) https://www.ssllabs.com/ssltest/analyze.html?d=ello.co https://www.ssllabs.com/ssltest/analyze.html?d=ello.co
- SHA1 cert
- No FS
- Defaults to RC4
Their ops team has not paid attention to properly configuring TLS. Not encouraging at all.
If anyone at Ello is reading this there is an excellent resource for securing your TLS setup at https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS
- ddw 12y agoTheir app is full of hilarious bugs and hacks. But I guess that money can buy them a real dev team?
- rco8786 12y agoDon't really fault them here. Every startup's app is full of hilarious bugs and hacks.
- valarauca1 12y agoSSL configuration are a pain, especially across multiple sites. Even if you can afford a full dev team, case and point: https://blog.docker.com/ https://blog.docker.com/