agwa

79 ms·

1. 871.▲
   by agwa 12y ago

   > Among the entries was one named track.nextuser.com In order to be a supercookie they need more than one entry (since each entry only stores 1 bit of information). Do you see any other entries that look like they could be associated wi
2. 872.▲
   by agwa 12y ago

   Firefox stores HSTS entries in a SQLite database, which you can query by running: echo "SELECT * FROM moz_hosts WHERE type='sts/use';" | sqlite3 permissions.sqlite from inside your profile directory. To clear
3. 873.▲
   by agwa 12y ago

   It's going to take a lot more than Cloudflare adding DNSSEC support to make SSHFP records viable. Every system running an SSH client will need to run its own validating resolver. If you leave validation to an upstream server you lose
4. 874.▲
   by agwa 12y ago

   Initiating an SSH connection takes 300ms on my LAN. If it's taking you several seconds then you probably have a reverse DNS problem. (By default, the SSH server looks up the reverse DNS of the client when it connects.)
5. 875.▲
   by agwa 12y ago

   I have no idea, but considering they are from DJB, they were probably created in a very unusual way ;-)
6. 876.▲
   by agwa 12y ago

   Thanks for pointing that out. TIL that my browser trusts the CAcert root, which is not something I remember doing. Too late to edit my comment. Here is a non-HTTPS link: http://events.ccc.de/congress/2014/Fahrpla
7. 877.▲
   by agwa 12y ago

   This video is excellent. Slides: https://events.ccc.de/congress/2014/Fahrplan/system/attachme... Sample code: http://ecchacks.cr.yp.to/
8. 878.▲
   by agwa 12y ago

   It's quite interesting to study why crypto_(secret)box requires zero padding. It's not to avoid memory allocation, as tedu suggests, but to make the implementation stupidly simple. For every invocation of crypto_secretbox, NaCl n
9. 879.▲
   by agwa 12y ago

   Under what compiler? On GCC 4.9 they're neck-and-neck:: qsort: 6727 ms std::sort: 6718 ms (CPU is Core i7-950)
10. 880.▲
    by agwa 12y ago

    I've been using Prosody for ~2 years on a couple servers and I can't recommend it highly enough: it's extremely simple, lightweight, and easy to configure. Its author is even on HN. https://prosody.im/ I do
11. 881.▲
    by agwa 12y ago

    You're being downvoted because this article is about the security of NTP implementations, yet your basis for recommending systemd-timesyncd is that it "works really well" for you. Well, ntpd worked well for me too but that d
12. 882.▲
    by agwa 12y ago

    In practice, there are systems that use SNTP or regular NTP with periodic calls to ntpdate. Ubuntu does the latter, by default, and is thus susceptible to the attacks I described,
13. 883.▲
    by agwa 12y ago

    You could circumvent certificate revocations by replaying expired OCSP Staple responses that say a certificate is not revoked. You could also cause expired certificates to be accepted, which limits the utility of short-lived certs as a mean
14. 884.▲
    by agwa 12y ago

    Thanks. Indeed, it's not generally possible to go from a file descriptor to filename, because not all file descriptors refer to files with names (e.g. sockets). So I guess the second argument in this case is just a dummy value that i
15. 885.▲
    by agwa 12y ago

    > Notice how the discussion is full of edge-cases which this code doesn't handle? Can you point to a single unhandled edge case mentioned so far in this discussion? The only possible one I see is finnh's complaint that it d
16. 886.▲
    by agwa 12y ago

    Does anyone know what's going on with this line: > file := os.NewFile(3, "/tmp/sock-go-graceful-restart") What's with that filesystem path, which isn't referenced anywhere else, and which should be unne
17. 887.▲
    by agwa 12y ago

    Instead of taking a loss to compensate drivers, perhaps they should just waive their 20% cut during emergencies, so 100% of the fare went to drivers. They could sell the surge pricing as hazard pay for drivers without opening themselves to
18. 888.▲
    by agwa 12y ago

    This is how I understand chains to work in practice, and it's what the chain cert generator assumes. However, the SSL certificate ecosystem is so vast there may well be a case of chains ending up at different roots. I'd love to
19. 889.▲
    by agwa 12y ago

    Thanks for letting me know. I looked in the logs, and determined that the server in question has a variety of issues, including intolerance to TLS 1.1 and TLS 1.2. For more details, try testing it here: https://www.ssllabs.com&#
20. 890.▲
    by agwa 12y ago

    Thanks for the feedback. I'm using a database of CA certificates that should contain the lowest common denominator of CA certs among different OS/browsers, and picking the shortest chain that leads to these roots. I may not have
21. 891.▲
    by agwa 12y ago

    Your chain should start with the certificate that signs your server's certificate and continue up to, but not including, a root certificate that's trusted in all browsers. Certificates can have multiple chains to a root certific
22. 892.▲
    by agwa 12y ago

    IE does this, but Firefox doesn't and never has. See: https://bugzilla.mozilla.org/show_bug.cgi?id=399324 https://bugzilla.mozilla.org/show_bug.cgi?id=245609 Chain cert problems can still go unnoticed
23. 893.▲
    by agwa 12y ago

    Yeah, I'm seeing some certificate authorities which are serving their certificates in formats that I wasn't expecting. All the errors are being logged and I'm working on adding support for these formats. Edit: These errors s
24. 894.▲
    by agwa 12y ago

    Thanks! Yes, the SSL Labs test is way more comprehensive. I think a single-purpose tool is still valuable because it provides background about chain certs, and if it detects a misconfiguration, it provides a link to download the correct ch
25. 895.▲
    by agwa 12y ago

    You have good habits. But many website operators don't, and I've had a tough time in the past reporting chain cert issues because website operators insist nothing's wrong since their site works for them (due to chain cert cac
26. 896.▲
    Show HN: What's My Chain Cert?(whatsmychaincert.com)

    48 points by agwa 12y ago|31 comments
27. 897.▲
    by agwa 12y ago

    This page is absolutely correct that you should not use 32 bit key IDs, ever. However, some of its information about GnuPG is out of date. As of version 1.4.17 (released in June), GnuPG no longer blindly accepts responses from key servers:
28. 898.▲
    by agwa 12y ago

    Yeah, you're right. Part of the problem is that certificates are valid for too long and it's too damn hard for website operators to upgrade their certs when something better comes along. That's what SSLMate is hoping to fix.
29. 899.▲
    by agwa 12y ago

    You can install a cert (wildcard or non-wildcard) on any number of servers, haproxy instances, etc. There aren't any discounts for open source projects at the moment, but it's something I'll consider. GlobalSign does give aw
30. 900.▲
    by agwa 12y ago

    Now that the SHA-2 transition is finished, EV certs are next. (Because of the transition, there was some uncertainty about where we'd be sourcing our certs moving forward, which blocked progress on EV certs.)