agwa

21 ms·

271.
by agwa 3y ago
I submitted the first patch for this way back in 2012. It received a couple positive comments but was ignored by the maintainers, as was my followup[1]. William Orr made another unsuccessful attempt in 2015, and then there were the attemp
272.
by agwa 3y ago
Mozilla was the first browser maker to announce an intent to deprecate non-secure HTTP[1]. Even if they keep HTTP/1.1 support, at some point they will require TLS for it, just as they already do for HTTP/2. This is not somethi
273.
by agwa 3y ago
There are two reasons this is not comparable to the remote attestation proposal that Google is currently proposing: 1. The only things that WebPKI CAs are required to attest to is that domain validation was properly completed and that the p
274.
by agwa 3y ago
> API keys are used to secure the highest-stakes APIs that exist today — all of AWS's services, for example. Yet while API keys seem to be considered an entirely reasonable and industry standard design approach, This is not actual
275.
by agwa 3y ago
I've never had data loss (assuming that's what "lossage" means), but here's an incomplete list of problems I've experienced on systems running systemd: * System randomly taking 5+ minutes to boot * Daemons some
276.
by agwa 3y ago
Who did you switch to?
277.
by agwa 3y ago
Props to Fly for open sourcing this! Another thing you can do with a proxy like this is limit the types of requests which can be made to the 3rd party service. This is very useful if the 3rd party service doesn't support fine-grained
278.
by agwa 3y ago
8 of my last 10 blog posts[1] made the front page of HN. Before that, my posts only made the front page infrequently. What changed is I started picking topics and framings which are more appealing to HN readers, and I credit Michael Lynch&
279.
by agwa 3y ago
Beginning Go 1.21, the version in go.mod will control behavior in the standard library, so that you can upgrade the compiler/stdlib and not have your programs break: https://tip.golang.org/doc/godebug
280.
by agwa 3y ago
Curious what your concerns are? As of Go 1.21 the toolchain will be fully reproducible [ https://github.com/golang/go/issues/57120 ] and since the binaries will be distributed through the module system it&#x27
281.
by agwa 3y ago
It would indeed be downloading binaries. See the design doc, which talks about the need to set the execute bit on files in the module cache: https://go.googlesource.com/proposal/+/master/design/57001-g..
282.
by agwa 3y ago
You can query logs directly using the API described in RFC 6962: https://datatracker.ietf.org/doc/html/rfc6962#section-4 You'll need a list of logs to query. Chrome publishes their log list at: https:/
283.
by agwa 3y ago
Here's a list of affected DNS names: https://gist.github.com/AGWA/5b02c2bb07fc847733fa2a5c1931c4f...
284.
by agwa 3y ago
Google will continue to "own" .dev; you just won't be able to buy .dev domains directly from them anymore. .dev domains will continue to be available for purchase from registrars besides Squarespace. (Google is only selling
285.
by agwa 3y ago
That's a pretty good idea, and would also mitigate clients with slow clocks rejecting a certificate for not being valid yet.
286.
by agwa 3y ago
> So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. This is not engaging in good faith.
287.
by agwa 3y ago
>This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. That's news to you? I informed you last week that Caddy would serve broken certificates in
288.
by agwa 3y ago
Note that the certificates were not revoked until 2023-06-19 at 18:00. In contrast, ARI was updated on 2023-06-15 at 22:43 to tell ARI-supporting clients (such as lego) to renew immediately. That means Caddy served broken certificates for
289.
by agwa 3y ago
The CA is part of the solution by using ARI to inform ACME clients to replace impacted certificates.
290.
by agwa 3y ago
Unfortunately, crt.sh is chronically overloaded.
291.
by agwa 3y ago
Hopefully, although there are challenges to overcome. CT is a fast-moving ecosystem, with logs coming and going, and policies changing regularly. This requires CT-enforcing clients to be very on-the-ball with updates, both in the sense th
292.
by agwa 3y ago
Excellent question! The sctcheck command from https://github.com/google/certificate-transparency-go/ can be used to check the signatures of the embedded SCTs in a certificate. I've also got an online tool whi
293.
Last week's Let's Encrypt downtime(agwa.name)
218 points by agwa 3y ago|45 comments
294.
by agwa 3y ago
I picked 10 affected sites at random, and Chrome correctly rejected every one with ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. If Chrome isn't validating SCT signatures, that's a serious bug that would enable bypass of CT enforcement,
295.
by agwa 3y ago
From a policy standpoint, including AKI will still be a MUST, as will SKIs in CA certificates. Only in end-entity certificates will SKI be NOT RECOMMENDED. That said, they all suffer from the same problem - they look like they're deri
296.
by agwa 3y ago
Thank you, that's excellent feedback! I'm going to go ahead and add the pricing to the product page as you suggest; I hadn't even realized that this was inconsistent with the other product pages.
297.
by agwa 3y ago
Chrome and Safari only accept certificates which are publicly logged in Certificate Transparency logs, so if a government actor uses a CA to issue malicious certificates, they run a high risk of being detected and having that CA distrusted.
298.
by agwa 3y ago
It was signed by a Let's Encrypt intermediate. Roots are not allowed to sign website certificates. And that's why your server needs to also send the intermediate certificate - so that clients can construct a chain of signatures f
299.
by agwa 3y ago
Thank you! Not a bad idea to write a post about SKID because everyone misunderstands it! It does not reliably identify a key, since CAs are allowed to derive it however they want. If you want to find other certificates using the same ke
300.
by agwa 3y ago
Thanks for reading! Cert Spotter pricing is listed on https://sslmate.com/pricing/certspotter If we could be more clear about it, please let me know. I know that "enterprise" pricing isn't listed, but t

More ›