agwa

81 ms·

901.
by agwa 12y ago
Small comfort. When a project has the incredibly poor judgment (and, frankly, hubris) to write a caching DNS resolver without even the most basic cache hardening protections, and then declare it "a pretty complete caching DNS and LLMN
902.
by agwa 12y ago
> "a pretty complete caching DNS and LLMNR stub resolver" That quote is gold. Most of DNS isn't implementing the protocol, but implementing all the protections against cache poisoning, many of which are not intuitive. But
903.
by agwa 12y ago
The reason why a project with a bunch of tightly-coupled disparate components will have a hard time doing anything well is that an expert who could do a good job isn't going to spend their time working on an implementation that can on
904.
by agwa 12y ago
This is a perfect example of why the systemd approach of putting a bunch of disparate components under a single tightly-coupled umbrella is bad engineering. Generally, projects focused on doing one thing are able to do it well, while proje
905.
by agwa 12y ago
> Rob Pike once expressed surprise that people migrating to Go weren't C++ programmers, but Ruby/Python/etc. programmers who needed more performance. That leads you to wonder: who is still using C/C++ in 2014, and why
906.
by agwa 12y ago
Note there is a newer version of the draft: https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21
907.
by agwa 12y ago
Yup, we create three cert files for every purchase: www.example.com.crt - the certificate by itself www.example.com.chain.crt - the intermediate certificate www.example.com.chained.crt - concatenation of the certificate and the intermediate
908.
by agwa 12y ago
Yes, we do resell and that's just how certificate authorities price things. If you have fewer than 10 hostnames to secure, definitely go with individual certs and use SNI instead of a wildcard cert. Support for SNI is quite widespread
909.
by agwa 12y ago
We have wildcard support. Just specify a hostname like '*.example.com' when buying a cert :-)
910.
by agwa 12y ago
Good point about serving non-personal, non-confidential data - in this case, there's no benefit to the process-per-connection model, but there is still a benefit to isolating the private key. Unsure how you could easily separate out t
911.
by agwa 12y ago
Yes, actually, I've been contemplating offering EV certs, and have some ideas for making it work well with the SSLMate model. I do understand the boss factor. Do you mind if I shoot you an email at the address listed on your website?
912.
by agwa 12y ago
There's definitely overhead to the process-per-connection approach, but I disagree that protecting the key is more important then protecting the state of the connection. A private key is just a means to the end of securing a connectio
913.
by agwa 12y ago
That's a very nice idea. Of course, you sound like exactly the kind of sysadmin I'm not concerned about ;-)
914.
by agwa 12y ago
HSTS prevents that, though it doesn't protect you the first time you visit the site, unless you request addition to HSTS preload lists. If you want to be added to the Chrome HSTS preload list, which is also used by Firefox, go here: h
915.
by agwa 12y ago
This raises an issue that has been troubling me recently. There has been an explosion in guides that tell you how to secure your TLS installation, and virtually all of them hard code a cipher list, which I fear won't get refreshed as
916.
by agwa 12y ago
The state of things really does suck, and I'm trying to do something about it. SSLMate [ https://sslmate.com ] sells SSL certs from the command line for $15.95/year. The sslmate command line tool takes care of properly
917.
by agwa 12y ago
> I've yet to see a use case that couldn't be handled with either threads, or spawning another process fork() allows you to set up file descriptors such as stdin and stdout before execing another process. This is essential for
918.
by agwa 12y ago
But the "viralness" of the GPL applies to modified versions of the covered work, and this is a discussion of the distribution of GPLv3-licensed software in Mac OS X, which is not a modified work. Thus the "viralness" do
919.
The Bacon Boom Was Not an Accident(businessweek.com)
118 points by agwa 12y ago|110 comments
920.
by agwa 12y ago
> The core UX for gnupg.vim is open .gpg/.pgp/.asc file, be automatically prompted for passphrase (unless file is new), edit file, save (be prompted for recipients if new). Done. > gnupg.vim does turn off the viminfo/sw
921.
by agwa 12y ago
Just make sure you're using the latest version and set cryptmethod=blowfish2! Edit: Actually just use gnupg.vim - as nknighthb has explained the UX is just as good as vim's builtin encryption, and then you don't have to worry
922.
by agwa 12y ago
It's not just swap (I don't think encrypted swap is that common anyways) but also the viminfo and swp files. The UX for vim's encryption is really good - it's convenient and easy to use. Any replacement would need to be
923.
by agwa 12y ago
I don't see how you can justify hex editing without justifying encryption. In both cases, you can either do a conversion with a separate tool outside of the editor, edit the converted text, and then covert it back, or have the convers
924.
by agwa 12y ago
> Its advisable to rename bash, and replace it with a symlink to dash; it shouldn't break any scripts It most certainly will. dash provides a tiny subset of bash's functionality. Even scripts using #!/bin/sh often c
925.
by agwa 12y ago
You're right; thanks! I saw the HTTP_* variables in phpinfo() and assumed they'd be passed on to children through system(), but they actually aren't. In fact the only environment variables passed through look pretty innocuo
926.
by agwa 12y ago
No, the real culprit is bash. Environment variables are a perfectly valid way to pass information around in a Unix environment. Let's not ruin the utility of environment variables because bash decided to do something idiotic with th
927.
by agwa 12y ago
Your CGI application does not need to be written in bash for you to be vulnerable. If at any point your non-bash CGI program (and this includes PHP, even with mod_php, since it sets the same environment variables), or one of its descenda
928.
by agwa 12y ago
Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]? [1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
929.
by agwa 12y ago
Excellent point. Apache actually passes along any HTTP header, even undefined ones, as CGI environment variables (of the form $HTTP_HEADERNAME) so an attacker could just make up a header and it would be very unlikely to be logged.
930.
by agwa 12y ago
Ouch - that first attempt (ping without the -c option) has probably resulted in a number of long-lived ping processes.

More ›