agwa

68 ms·

811.
by agwa 12y ago
Indeed, one of SSLMate's CAs actually does require the country code to be present in the CSR, so SSLMate includes it (we get it from your online profile so you don't have to type it every time). Despite this requirement, the coun
812.
by agwa 12y ago
I've had much better luck with killcx: http://killcx.sourceforge.net/ In particular, it sends a spoofed SYN packet to induce an ACK packet containing the sequence numbers necessary to send the RST. That means it doesn
813.
by agwa 12y ago
Many of our customers realize that fact, but are nonetheless extremely happy to use SSLMate. We're not a normal certificate vendor, and the ease and automation of SSLMate sets us far apart. If these features aren't important to
814.
by agwa 12y ago
True, the demo doesn't show the sign up process, but you only have to sign up once and after that, buying certs is as simple as in the demo. (And the sign up process is itself very quick.) Thanks for the feedback about the credit card
815.
by agwa 12y ago
You might also be interested in checking out our security page: https://sslmate.com/security
816.
by agwa 12y ago
Founder here. As nailer says, the only detail signed in a DV cert is the hostname of your website. One of the crazy inefficiencies about buying certs elsewhere is that they tell you to use the openssl req command to generate a CSR. This
817.
by agwa 12y ago
Chrome only cares about the hash algorithm of the intermediate certificate(s) if the end-entity cert is expiring after 2016. So a SHA-1 certificate expiring in 2015 won't be marked insecure even if it's signed by a SHA-1 intermed
818.
by agwa 12y ago
HTTPS Everywhere has a whitelist of sites and only forces HTTPS on those sites. It doesn't force HTTPS on every server that merely listens on port 443.
819.
by agwa 12y ago
> https://time.com > Is that last one the best experience if you don't have a cert? Ironically, in order to serve an HTTPS to HTTP redirection, you need a valid cert. Indeed, time.com has a valid cert.
820.
by agwa 12y ago
The two websites are operated by the same company. I have nothing to do with them; I'm just a happy user of EZ-RJ45.
821.
by agwa 12y ago
Check out EZ-RJ45: http://www.ezrj45.com/
822.
by agwa 12y ago
Only if your TCP VPN is listening on one of the allowed ports ;-) (I do keep a TCP VPN running on port 443 ready to go for these situations, but UDP is always my first choice.)
823.
by agwa 12y ago
Me neither. I have come across networks that filter everything but a few TCP ports (like 80 and 443), but that's a matter of draconian firewall policy rather than a NAT limitation.
824.
by agwa 12y ago
> Plenty of mobile networks will timeout inactive TCP connections in less than 30 seconds. Good grief - that is awful, but sadly believable. Do you happen to know who does that? A couple years ago I tested AT&T's 3G and found
825.
by agwa 12y ago
IPSec is indeed hell with NATs, and an SSL VPN would be much better. But UDP is even better - most NATs do a good job with UDP too, and if done right, it's possible to switch Internet connections without the VPN having to reconnect.
826.
by agwa 12y ago
NAT is an argument against TCP, not for it, because when your NAT'ed IP address changes, TCP connections break. UDP will drift between NATs without skipping a beat. And I'm very surprised you find crappy coffee shop WIFI and 3G t
827.
by agwa 12y ago
> * We make HTTP show up as "insecure" in browsers > * We make HTTPS work with self-signed certificates, and display websites encrypted that way the same way we currently show http Clear text and opportunistic encryption sho
828.
by agwa 12y ago
This is an asinine comment. He also wanted to move to New York to be closer to his children and grandchildren[1]. The big tech-using companies in NY happen to be finance. But I guess by your logic wanting to be closer to his family is jus
829.
Please Stop Bugging Linus Torvalds About Subversion (2005)(subversion.tigris.org)
1 points by agwa 12y ago|0 comments
830.
by agwa 12y ago
As someone who's currently facing that daunting task myself, may I ask what you ended up doing? Did you have to roll your own reliable stream-oriented protocol?
831.
by agwa 12y ago
Indeed. Locking IE6 out to get an A/A+ on SSL Labs is totally worth it.
832.
by agwa 12y ago
> I'd imagine that 4096 will become the new minimum over the next few years. That's unlikely to happen. 2048-bit RSA provides a security level of ~112 bits, which would physically require a massive amount of energy to break, a
833.
by agwa 12y ago
No, that's not true. The only client with non-negligible use that you have to lock out to get an A+ is IE6 (because IE6 only supports SSLv3, at best, by default).
834.
by agwa 12y ago
You could look at the source for my titus TLS proxy server[1]. It gets an A out of the box, and an A+ if the application sends the HSTS header. [1] In particular, these two blocks of code: https://github.com/AGWA/titus
835.
by agwa 12y ago
It's often overlooked how including external Javascript impacts the security of your website (see also the recent Healthcare.gov information leak). It's not just the external sites' TLS configuration you have to worry about,
836.
by agwa 12y ago
CRLs are way too large to distribute through the DNS (e.g. the Comodo CRL mentioned in the blog post is 740kb). And what does that RFC say to do when a CRL is too big? Return a URL instead. So we're back to square one.
837.
by agwa 12y ago
How would users possibly know when it's safe to override an OCSP error?
838.
by agwa 12y ago
Disclosing the private key in this blog post was extremely irresponsible. Although the certificate has been revoked, revocation basically doesn't work[1], so for practical purposes this key will usable for MitM until it expires on Mar
839.
by agwa 12y ago
I've never heard of a CA doing that. By and large, the reason why this happens is human error - no one knows the cert is about to expire because it's not being monitored and/or the email from the CA (if they even send one) g
840.
by agwa 12y ago
The author does restrict which core the guest can run on, with a patch to qemu. And the guest is limited to a single CPU/core (-smp 1).

More ›