agwa

46 ms·

571.
by agwa 9y ago
Comodo is required by Mozilla to publish a public incident report: https://wiki.mozilla.org/CA/Responding_To_A_Misissuance
572.
by agwa 9y ago
You may find my CAA website helpful: https://sslmate.com/caa/support
573.
Chrome’s Plan to Distrust Symantec Certificates(security.googleblog.com)
4 points by agwa 9y ago|0 comments
574.
by agwa 9y ago
A zombie is a process which has terminated but has not been waited for by its parent. SIGKILLing a process blocked in an uninterruptible system call does not create a zombie.
575.
by agwa 9y ago
> When I kill -9 in Linux, the application is dead, gone... doesn't hang, doesn't sit there frozen. Wrong. If a Linux process is blocked in an uninterruptible system call (typically for disk I/O), it cannot be killed, eve
576.
Show HN: CAA Record Generator(sslmate.com)
11 points by agwa 9y ago|1 comments
577.
by agwa 9y ago
Barclays pinned to an intermediate. Here's what happened: https://cabforum.org/pipermail/public/2016-November/008989.h... It worked out OK for Barclays in the end, but only because Symantec was willing
578.
by agwa 9y ago
Executing arbitrary code put at a specific URL on a website is exactly how software updates work. As long as it's properly authenticated, it's fine.
579.
by agwa 9y ago
What do you think might break?
580.
by agwa 9y ago
It's called an I-D, for "Internet Draft." Very roughly, a Standards Track document in the IETF goes through four stages: 1. Someone submits an I-D as an individual. Literally anyone can do this and such a document carries no
581.
by agwa 9y ago
To be clear, this is not an RFC yet. It's not even adopted by a working group, although I hope it will be. Mods: can RFC be removed from the title? [Edit: thanks for updating the title!]
582.
by agwa 9y ago
A far better attempt at redesigning the boarding pass was done by Timoni West: http://blog.timoni.org/post/318322031/a-practical-boarding-p... Unlike the author of this post, West actually endeavored to understand
583.
by agwa 9y ago
Having used isatty in some of my CLI programs to alter the behavior depending on whether STDOUT is a TTY, I see the appeal. It allows the program to do the best thing depending on how it's being invoked. However, more recently I'
584.
by agwa 9y ago
> (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords) Unfortunately, it only does this if STDOUT is a TTY. If it's a pipe, then it outputs a single 8 character long password. So I'm afraid you
585.
by agwa 9y ago
The flip side to Amazon's easy returns is that I regularly receive used/returned merchandise from Amazon that was advertised as new.
586.
by agwa 9y ago
In theory, yes. In practice, I don't know of any CA which guarantees continuity of intermediate certificates. In fact, some explicitly say they may rotate intermediates at any time. So the footgun is much worse than you describe: ev
587.
by agwa 9y ago
> However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary. Really? Storing every possible 10 character long pr
588.
by agwa 9y ago
Cache and DNSSEC do not require a non-standard DBUS API. LLMNR and per-interface DNS resolution are features that very few applications need. Those that do can link with their own resolver libraries.
589.
by agwa 9y ago
It's extremely easy to induce a computer to make a DNS request. For example, embed an IMG tag in a web page pointing to the attacker's domain. Anyone loading that page will get the malicious DNS response.
590.
by agwa 9y ago
The most dangerous thing about systemd-resolved is that it exposes its own non-standard DNS resolution protocol over dbus, which the documentation recommends applications use instead of standard, interoperable protocols[1]: > The native,
591.
by agwa 9y ago
Yes, it's true. To replace PID 1 with sysvinit, run: apt-get install sysvinit-core systemd-sysv- reboot To prevent it from coming back, create the file /etc/apt/preferences.d/no-systemd.pref containing:
592.
by agwa 9y ago
Why can a bank have such a robust procedure for replacing tokens, and be trusted to follow it, but not have a similarly robust procedure for handling password resets?
593.
by agwa 9y ago
Are you sure your bank wouldn't allow someone to disable it over the phone like they allowed someone to change your password? People lose cell phones just as they forget passwords, so there is surely a way for customer support to deal
594.
by agwa 9y ago
Explain what might happen, as I did in my comment. People are more likely to take heed of a warning if it's concrete.
595.
by agwa 9y ago
> To get rid of the checks, we can either use bytes directly (usually via Vec<u8> / &[u8]) or, if we are absolutely sure the input will be valid UTF-8, use str::from_utf8_unchecked(_) (note that this will require unsafe an
596.
by agwa 9y ago
Thanks for posting this publicly! I suggest updating your post to say that the issues are still unfixed as of today's date.
597.
by agwa 9y ago
This post is from last year, so I checked the nginx source to see if they had fixed things since then. Nope! Still using ngx_random to generate packet IDs: http://hg.nginx.org/nginx/file/tip/src/core&#x2
598.
by agwa 9y ago
> It's pretty easy to audit a couple lines of unsafe in a library. You have to audit more than just the lines within the unsafe block. For example, I discovered a buffer overflow in a Rust library this week that was caused by an i
599.
by agwa 10y ago
Fortunately, Trillian supports pluggable storage backends! https://github.com/google/trillian/tree/master/storage
600.
by agwa 10y ago
I suspect it was a joke, but you raise a very important question. Unfortunately, some clients (likely embedded devices) trust only Symantec roots, since that's the CA the website was using at the time the developer slapped together th

More ›