agl

24 ms·

181.
by agl 16y ago
Setting OCSP checking to best attempt doesn't really solve anything because, if you're assuming that an attacker is MITMing your HTTPS connection, it's not too much more to assume that they can intercept your OCSP checks too. http://www.im
182.
by agl 16y ago
The current certificate infrastructure already sits on top of DNS. If an attacker can control your DNS then they can get any CA to issue certificates to them because they can accept emails at that domain.
183.
by agl 16y ago
Please email me (my username at chromium.org) with the output of `openssl s_client -tls1 -showcerts -connect imap.googlemail.com:993` as well as any proxy settings, maybe a packet trace etc.
184.
by agl 16y ago
Thanks, this has been fixed.
185.
by agl 16y ago
Chrome already updated: http://googlechromereleases.blogspot.com/2011/03/stable-and-...
186.
by agl 16y ago
StartSSL is also my recommendation, although the site can be a little difficult to use. See if this helps: https://github.com/ioerror/duraconf/blob/master/startssl/REA...
187.
by agl 16y ago
I believe that speeding up SVG using the GPU is planned but that a few intensive operations on canvas are likely to get switched on first (image compositing, for example).
188.
by agl 16y ago
(I'm a Chrome dev) about:flags is useful for testing but, in general, you shouldn't switch on random features. If you're doing web page development and want to see how hardware accel affects things, then sure. But if the feature was ready f
189.
by agl 16y ago
OCSP is probably the bulk of that time. On Chrome Linux you can start a fresh instance, load the HTTPS page then open a tab with about:histograms and search for OCSP. The time taken should be in there. (Otherwise, use a packet sniffer and d
190.
by agl 16y ago
The initial redirect from HTTP to HTTPS is a weak spot. Most users will just type "example.com" into the address bar and an active attacker can strip HTTPS from there. There'll be no padlock icon, but how many of your users really going to
191.
by agl 16y ago
If you only need a certificate for (www).domain.com, (not a certificate with multiple names as detailed in the story) then here are step-by-step instructions for getting a free certificate from StartSSL: https://github.com/ioerror/duraconf
192.
by agl 16y ago
Multiple names in the certificate isn't the same as SNI. The server is still giving the same certificate to every client so SNI support isn't needed and XP clients will work.
193.
by agl 16y ago
Yes it does. The page in question describes setting up a certificate with multiple names. This works fine for XP and doesn't need SNI.
194.
by agl 16y ago
(I rather suspect that Mr Shaw is trolling, but anyway.) It's certainly true that humans have all manner of interesting behaviors owing to the fact that we're smart apes with huge numbers of survival heuristics. I would pause before taking
195.
by agl 16y ago
Hmm. That's something that I'll have to look into. It should be served the same as anything else.
196.
by agl 16y ago
I got Chart API fixed, although on a different hostname: http://www.imperialviolet.org/2010/11/29/charthttps.html The deal with encrypted.google.com is explained here: http://googleenterprise.blogspot.com/2010/06/update-on-encry...
197.
by agl 16y ago
As I've noted before, the issue with HTTPS is not one of server cost any more. However, I am aware of several Google services that are not available over HTTPS. Maps and AdSense are the ones which I'm familiar with and, if people are having
198.
by agl 16y ago
After reading the article I'm unclear about how the ads are served: "He says his company also has been placing ads on various websites to test the ad-placement technology and build up a base of advertisers, which now number about 100,000."
199.
by agl 16y ago
I haven't been able to read the article either but, from teasing apart the /. comments, it appears that they are extensions to the normal debugging support and aren't an immediate cause for concern. (If it's just a way to trigger a breakpoi
200.
by agl 16y ago
Literate programming, at least at Knuth defines it, includes some aspects which Docco omits. Firstly, the machine readable file can be output in a different order than the human readable. (Indeed, sequential chunks in the human readable out
201.
by agl 16y ago
Well, as I recall, several of the questioners at that session were verging on the point of heckling, so many of the responses were short. But the answer is that permitting mixed content was probably a mistake in the first place, but it's on
202.
by agl 16y ago
HTTPS using certificates signed by DNSSEC is coming. In fact, support for it is already in Chrome (although behind a command line flag). If you want details, see: http://www.imperialviolet.org/2010/08/16/dnssectls.html The current holdups
203.
by agl 16y ago
Disclaimer: I work for Google and Chris Palmer has since left to work for the EFF. That shouldn't change the fact that the slide deck is awesome though.
204.
by agl 16y ago
This should have been resolved for you now.
205.
by agl 16y ago
I'm sorry that you've had issues with the review system. A tiny number of extensions are flagged for review automatically. In your case, it was not because of NPAPI or file:// access. (The heuristic in this case resulted in a false positive
206.
by agl 16y ago
Chrome 6 uses NSS on all platforms and NSS will download missing intermediate certificates via HTTP, if the URL is given in an AIA extension. This is pretty much standard browser behaviour I'm afraid. One of the many unfortunate realities o
207.
by agl 16y ago
> What makes the continuous Chromium build a "Google Chrome distributed through promotional means"? The continuous builders exist to compile and test all the code. Therefore they build with RLZ options enabled. The continuous build bina
208.
by agl 16y ago
http://www.google.com/support/chrome/bin/answer.py?answer=11... http://inari.aerdan.org/gallery/chromeopts.png The initial request is the GoogleURLTracker class, which manages what Google TLD you're on. On the trunk, this won't happen
209.
by agl 16y ago
The server is misconfigured: it's missing intermediate certificates in its chain. Chrome 6.x should be able to work around this on all platforms at the cost of making the site slower. Additionally, the server is open to prefix attacks. For
210.
by agl 16y ago
You can get certificates for free at startssl.com

More ›