agwa

96 ms·

661.
by agwa 10y ago
Mozilla is killing StartCom. Chrome has not announced a decision yet, although I predict that they will also distrust.
662.
WoSign Incidents Final Report [pdf](wosign.com)
4 points by agwa 10y ago|0 comments
663.
Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate(sslmate.com)
2 points by agwa 10y ago|0 comments
664.
by agwa 10y ago
Probability has nothing to do with it. Trustwave was excused because what they were doing was not expressly prohibited at the time and other CAs were probably doing the same thing. Trustwave proactively came forward about what they had do
665.
by agwa 10y ago
That was the first and only CA to be excused for that. When ANSSI did it, they got name-constrained to French TLDs only: https://bugzilla.mozilla.org/show_bug.cgi?id=952572 When CNNIC did it, they were distrusted: https:&#
666.
by agwa 10y ago
> Well aware, but not having to pay for it makes it more widely accessible. Any nation-state attacker or attacker with the will to also compromise an identity or two will have no problems either compromising a CA or swiping an owned cred
667.
by agwa 10y ago
> such as more diligence by free certificate authorities -- the crux of the talk was rekeying at up to 20x per week enabling the attack You are wrong if you think this is the crux of the attack. Let's Encrypt is unique in rate limi
668.
by agwa 10y ago
GlobalSign gives free wildcard certificates to open source projects: https://www.globalsign.com/en/company/press/061913-globalsig...
669.
by agwa 10y ago
The end game for certificate transparency is that browsers will reject a certificate unless the server can prove that it has been submitted to at least two logs. In fact, as of the next version of Chrome, this will be required of all Syman
670.
by agwa 10y ago
Verifying based on DNS records is only a baseline. CAs can and do require more. If you want higher security for your domain, you can: 1. Make business arrangements with a handful of CAs to require additional verification when issuing cert
671.
by agwa 10y ago
That doesn't help if the public doesn't care, and for decades there was no public pressure to reform any prison, public or private. Now that criminal justice reform is mainstream, private prisons have received a disproportionate
672.
by agwa 10y ago
What? The Azure FAQ says: "The foundational work to enable IPv6 in the Azure environment is well underway. However, we are unable to share a date when IPv6 support will be generally available at this time." https://azu
673.
by agwa 10y ago
I agree, and furthermore the success of World IPv6 Day in 2011 showed that such breakage isn't all that common in the wild. The second point is still a real concern though.
674.
by agwa 10y ago
Yes, Linode will route /64 and /48 subnets to you. They'll even give you several of each if you ask, and the subnets can be failed over to other nodes for high availability. Linode are the only ones I have seen do IPv6 corre
675.
by agwa 10y ago
Nope, just relaying what the documentation says.
676.
by agwa 10y ago
No, S3 website hosting still doesn't support IPv6.
677.
by agwa 10y ago
It's kind of sucky, but there are a couple of good reasons for it: 1. Some people have broken IPv6 connectivity. Their OS will prefer the IPv6 address and won't fall back to the IPv4 address until after a lengthy timeout. 2. Peop
678.
by agwa 10y ago
From the documentation [ http://docs.aws.amazon.com/AmazonS3/latest/dev/ipv6-access.h... ]: "Before EC2 (VPC) supports IPv6, we recommend that you continue using the standard IPv4-only endpoints from EC2&q
679.
IPv6 Support for Amazon S3(aws.amazon.com)
153 points by agwa 10y ago|48 comments
680.
by agwa 10y ago
> 25 connections/second with a 2 KB certificate, 3,000 active connections, and 2.22 Mbps of data transfer or >5 connections/second with a 4 KB certificate, 3,000 active connective, and 2.22 Mbps of data transfer. "2KB c
681.
by agwa 10y ago
Yup, Ted Cruz learned about this the hard way ;-) http://arstechnica.com/information-technology/2015/03/ted-cr...
682.
Show HN: Certificate Transparency Log Monitor(sslmate.com)
53 points by agwa 10y ago|11 comments
683.
by agwa 10y ago
An even bigger difference is that with jsonb, strings and numbers are converted to their equivalent PostgreSQL types. That means that strings can't contain null characters or characters that violate the database's encoding rules.
684.
by agwa 10y ago
This is so ironic considering Mark Shuttleworth became a millionaire by starting and selling a certificate authority. Ubuntu is literally funded by the early success of HTTPS yet they don't use it. https://en.wikipedia.org&
685.
Certificate Incident(mail-archive.com)
1 points by agwa 10y ago|0 comments
686.
by agwa 10y ago
Those are not comparable. For better or worse, the attacks you speak of are not covered by DV's threat model, and all DV-issuing CAs--not just Let's Encrypt--suffer from them. The Startcom vulnerabilities, on the other hand, are
687.
by agwa 10y ago
It's also a shame they designed their own protocol instead of just using ACME[1], which is a standards-track IETF draft which has received significant security scrutiny. By ignoring ACME, they even managed to replicate my duplicate si
688.
by agwa 10y ago
"Nobody"? Google monitors for their domains. So does Facebook. I'll bet a lot of other high value sites are monitoring too but haven't said so publicly. As for everyone else, give it some time. The ecosystem is still
689.
by agwa 10y ago
> How long before Symantec gets an NSL demanding an appliance that can mint bogus certs on the fly for dropbox.com, facebook.com, twitter.com, etc...? If the bogus certs are not logged in Certificate Transparency, they will be rejected b
690.
by agwa 10y ago
Linode has been a monumental disappointment. I signed up with them in 2005, when they were 2 years old and AWS didn't even exist. They were reliable and the support was phenomenal. The Linode Manager was powerful and yet simple to u

More ›