aaronmdjones

55 ms·

1. 661.▲
   by aaronmdjones 10y ago

   I help maintain an IRC server that can use OpenSSL (or GNUTLS, or MbedTLS) and I added OpenSSL 1.1 compatibility last year (that is, 2015, while it was still under heavy development). It will compile against (and work with) OpenSSL versio
2. 662.▲
   Ask HN: Is it possible to get SVG vote icons?

   1 points by aaronmdjones 10y ago|0 comments
3. 663.▲
   by aaronmdjones 10y ago

   HTTPS is about more than just confidentiality (encryption), though. There's also authentication (the party serving the traffic to you is the party you asked for) and integrity (the traffic has not been modified since it was sent). This
4. 664.▲
   by aaronmdjones 10y ago

   Most commercial planes (and certainly almost every civilian airliner?) have an inertial reference system that is backed up by GPS. The inertial reference system is a physical unit that cannot be externally manipulated, but it has less accur
5. 665.▲
   by aaronmdjones 10y ago

   I was just thinking the same thing. Given that Yahoo, Google, Microsoft et al recently-ish obtained permission to release rough numbers of NSLs and such ("in FY 2015 we received between 1000 and 2000 requests for user data"), I wo
6. 666.▲
   by aaronmdjones 10y ago

   You may be interested in this PDF[1] which describes what you're talking about. Title: Triple-Triple Redundant 777 Primary Flight Computer [1] http://www.citemaster.net/get/db3a81c6-548e-11e5-9d2e-00163e...
7. 667.▲
   by aaronmdjones 10y ago

   You only need CAP_DAC_READ_SEARCH for backups.
8. 668.▲
   by aaronmdjones 10y ago

   ARM MbedTLS makes using TLS from C easy. Like, really easy. Really, really easy. As an aside, the last CVE (publicly known, logged vulnerability) for MbedTLS that affected server-side code was from January 2015 .
9. 669.▲
   by aaronmdjones 10y ago

   Indeed; if you have the Active Kernel Exploit Response feature enabled in grsec, and a root process triggers a kernel OOPS, it will panic() the kernel. You can combine this with the panic= kernel command-line argument to set a reboot delay,
10. 670.▲
    by aaronmdjones 10y ago

    If we're to go by this article [1], the TSA is only 4.3% effective. [1] http://edition.cnn.com/2015/06/01/politics/tsa-failed-underc...
11. 671.▲
    by aaronmdjones 10y ago

    wget writes a ~/.wget-hsts file with the HSTS information for any URI you have accessed that served an HSTS header. Making it ignore --no-check-certificate if the file has an entry for the hostname you are visiting should be trivial, i
12. 672.▲
    by aaronmdjones 10y ago

    > An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept IKEv1 security negotiation requests > There are no workarounds that address this vulnerability. Call me crazy,
13. 673.▲
    by aaronmdjones 10y ago

    urandom(4) and random(4) are /character/ devices, and getrandom(2) exists.
14. 674.▲
    by aaronmdjones 10y ago

    The Single Packet Authorization variant of port knocking has built-in authentication.
15. 675.▲
    by aaronmdjones 10y ago

    Wrong. 2048-bit RSA has an effective security level of approximately 112 bits, just like 3-DES. If you want 256 bits of security, you go all the way up to 15360-bit RSA. That's why Elliptic Curve systems are so attractive: they involve
16. 676.▲
    by aaronmdjones 12y ago

    StartSSL will use whatever certificate digest algorithm you used in your certificate signing request. Most openssl.cnf files distributed with Linux OSes set the default algorithm to SHA-1 - that's nothing to do with Startcom. Simply sp
17. 677.▲
    by aaronmdjones 12y ago

    Now THAT, is amazing - and perfectly explains what's going on. I operate several nameservers of my own for various domains, some owned by me, some not, and I'd not heard of that. I am happy with your answer, thanks!
18. 678.▲
    by aaronmdjones 12y ago

    I did not know about GGC, and that seems cool (and similar to the Netflix approach of putting content servers inside ISP networks). However, this does not explain why I get an address pointing to my ISP network when I query via OpenDNS, whi
19. 679.▲
    by aaronmdjones 12y ago

    I get the same addresses from 208.67.220.220 as I do from 8.8.8.8 - addresses belonging to my ISP. If I'm using OpenDNS's recursor to look Google up, that would put the query (from Google's perspective) firmly outside of my I
20. 680.▲
    by aaronmdjones 12y ago

    It should be noted, I forgot to include in the paste, that the address beginning with 62 (returned over IPv4) belongs to my ISP, not Google.
21. 681.▲
    My DNS queries are being intercepted and altered in-flight(paste.debian.net)

    30 points by aaronmdjones 12y ago|16 comments