23david

26 ms·

211.
by 23david 13y ago
thanks for letting me know. emailing the mods.
212.
by 23david 13y ago
Not exactly drop-in. With CloudFlare you need to be careful to configure it really well in the control panel settings. Also not always 100% compatible with all of your website's features. You may want to only use CloudFlare with your s
213.
by 23david 13y ago
Thanks for your hard work and for setting that up. Sounds like an awesome program. If I had more time right now, I'd love to check it out more. I think we're on the same page here, but coming at it from different perspectives. I o
214.
by 23david 13y ago
Home electrical work is a great example. Just pick up a $10 book at your local Home Depot and if you can read and follow the simple instructions and guidelines inside, you'll be able to do most simple electrical work. Some electricians
215.
by 23david 13y ago
Thanks for sharing your perspective and knowledge here. Really important to know how to be safe and what to look out for. I wasn't getting the feeling that many infosec professionals on HN were able/willing to outline reasonable g
216.
by 23david 13y ago
Great link! The takeaway for me is that in an ideal world we would be able to use only strong peer-reviewed crypto written by programmers experienced in codebreaking and cryptanalysis. Phil Zimmerman admits in that article that this is his
217.
by 23david 13y ago
If cash cost is your only consideration it might make sense to look outside of AWS. One of the big issues I see is that the feature-set and global footprint of AWS is pretty much unmatched. The really sad part (for AWS competitors) is that
218.
Assange: How cryptography is a key weapon in the fight against empire states(guardiannews.com)
179 points by 23david 13y ago|67 comments
219.
by 23david 13y ago
You're right, this wouldn't make a lot of sense for most users. But this would be useful in a corporation where it's possible to centrally manage CA lists for approved applications.
220.
by 23david 13y ago
Probably makes sense to start deciding which CAs we should or shouldn't trust? Has anyone reliable done any work on rating or evaluating the trustworthiness/security of different CAs?
221.
by 23david 13y ago
So perhaps that's an issue with the UI not clearly showing which CA is verifying the identity, and alerting you clearly if an encrypted email is using a different CA than prior ones. Depending on the client you're using, it should
222.
by 23david 13y ago
Not necessarily true. There are certainly CAs that are able to keep their private keys out of the hands of most governments. But there is definite uncertainty about who to trust. For the truly cautious, wouldn't it make sense to explor
223.
by 23david 13y ago
I agree with your points here. I think a major issue is the lack of understanding of best-practices with regards to security. So we tend to rely on the security of systems that aren't battle-proven. But even battle-proven solutions sti
224.
by 23david 13y ago
K cool. Thanks for clarifying. Keep up the good work. :-)
225.
by 23david 13y ago
Ansible is licensed as GPLv3. But it sounds like AnsibleWorks-awx is a commercial-only product? Are future 'pro' features going to only be released and maintained in commercial variants of AnsibleWorks or separate related projects
226.
by 23david 13y ago
Lol. And I do consulting. Hire me!!!! And if you criticize me, I down-vote you. Classy.
227.
by 23david 13y ago
you care about network security, why are you exposing ssh ports in public anyhow? Put them behind a VPN. There are ways to configure salt with masterless or behind vpcs or with syndics that are perhaps an enhanced security model. But defau
228.
by 23david 13y ago
Maybe they should hire you to review it for security flaws?
229.
General Alexander: NSA to implement two-man rule for sysadmins
16 points by 23david 13y ago|7 comments
230.
by 23david 13y ago
Game on.
231.
by 23david 13y ago
This looks like Part 2. Part 1 was whistleblowing for the US audience. This is for HK/China, probably intended to help keep him from being extradited to the US for his efforts in Part 1. Interesting strategy. Kinda unexpected imo.
232.
by 23david 13y ago
`Committing officer`? wtf is this? Subpoena these guys. They have immunity, so why not make them talk? If necessary, a company executive, known as a “committing officer,” is given documents that guarantee immunity from civil actions
233.
by 23david 13y ago
why couldn't they coerce all CA's into sharing the keys?
234.
by 23david 13y ago
Yeah that seems fishy for non-manager positions even at large software companies. Maybe google pays that high? Or Netflix? Oracle?
235.
by 23david 13y ago
Yes the Facebook product has some utility. And they do have big engineering challenges, and have contributed to open-source. These are not unique to Facebook, and if these are the criteria for working there, I can think of a lot of other pl
236.
by 23david 13y ago
amazing. that example explains how it works better than 200 pages of documentation :-) thx!
237.
by 23david 13y ago
I never thought of Ansible for orchestration particularly, but that sounds interesting! The current orchestration support in saltstack is somewhat limited, so it would be neat to check out. Are people using Ansible to replace or manage fabr
238.
by 23david 13y ago
AMIs are really useful for production servers when you want to quickly launch a bunch of similar servers or set up auto-scaling groups to launch new servers based on load. The issue is that to take full advantage of using AMIs, you need to
239.
by 23david 13y ago
Sounds interesting. Any possibility that you could anonymize the script and paste a link to a gist of it? would be interesting to see some real-world Ansible examples.
240.
by 23david 13y ago
FWIW, I tested juju a few months ago and found it to be buggy and unreliable. Sometimes the instances would connect together correctly, and sometimes they would fail inexplicably. Didn't seem ready for any kind of production use to replace

More ›