agwa

17 ms·

241.
by agwa 3y ago
It's not clear that a warning would be allowed. In particular, the new paragraph 45(2a) prohibits mandatory checks on eIDAS certificates. Mozilla has proposed text[1] that would make clear that the requirement is only to display ident
242.
by agwa 3y ago
That text is almost a year old. The recent trilogue negotiations added paragraph 45(2a) which is not public yet (hence the complaints about secrecy) but is alluded to in the open letter ( https://eidas-open-letter.org ): > The
243.
by agwa 3y ago
Historically, root constraints were only used in response to misissuance, but more recently, KamuSM voluntarily limited themselves to .tr when they applied.
244.
by agwa 3y ago
> Browsers should get their shit together and add proper support of domain-limited CAs They do in fact support this - e.g. Mozilla trusts KamuSM only for .tr [1], Chrome limited ANSSI to French TLDs [2]. However, there is no indication t
245.
by agwa 3y ago
You really don't know what you're talking about. First, you've confused registrars and registries - registrars don't operate DNS servers for TLDs; registries do. This isn't a pedantic point; understanding the disti
246.
by agwa 3y ago
That can help with the ongoing maintenance of your records, but doesn't help you when you're adding the record in the first place. As pointed out by singron at https://news.ycombinator.com/item?id=38069760 a malic
247.
by agwa 3y ago
As discussed elsewhere in this thread, domain validation needs to be frequently rechecked. Therefore, it's far more convenient to publish a DNS record than to manually sign messages out-of-band.
248.
by agwa 3y ago
In a perfect world there would be a special DNS record type for this. The DNS server would store the full token value, but would return the hash when someone queries it. I think this would provide both maximum security and maximum privacy
249.
by agwa 3y ago
No, domain validation should be frequent, so that revoking authorization can take effect quickly, which is particularly important if the domain changes ownership.
250.
by agwa 3y ago
Amazon Certificate Manager issues publicly-trusted certificates, so they have to abide by the validation rules mandated by the Baseline Requirements, which do not permit what you desire. CAs have often sought to bypass domain or CAA validat
251.
by agwa 3y ago
The problem with opaque records like "029845yn0sidng0345randomnyosndgf03548yn" is that you have zero clue what it's authorizing, making it impossible to audit your DNS records to ensure that you're only authorizing what
252.
by agwa 3y ago
Yes.
253.
by agwa 3y ago
> With the advent of ACME-based certificate authorities such as Let’s Encrypt, obtaining certificates is not at all hard for someone able to intercept and respond to traffic that is sent to your server, and in this case that’s exactly w
254.
by agwa 3y ago
Yes, the script can consult the $PUBKEY_SHA256 environment variable to get the hash of the certificate's public key.
255.
by agwa 3y ago
> This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway. People should do this, but in practice it often doesn't happen - as witnessed by the Appmattus
256.
by agwa 3y ago
It may be better for the XMPP ecosystem to focus on increasing adoption of channel binding rather than CT enforcement. I wrote briefly about the challenges faced by non-browser clients at < https://news.ycombinator.com/it
257.
by agwa 3y ago
If the CA doesn't log a certificate, the certificate won't work in CT-enforcing clients (Chrome, Safari, Edge) because it lacks receipts (SCTs) from CT logs. If a log fails to publish a certificate despite issuing a receipt for it
258.
by agwa 3y ago
Indeed, a CT monitor which sends alerts about legitimate certificates is almost useless due to noise. My service, Cert Spotter, provides an API endpoint[1] which you can upload your CSRs to, so you don't get alerted about certificates
259.
by agwa 3y ago
Should the majority of us continue to bear the risks of memory unsafe code because of a small minority that uses exotic architectures or doesn't want to install a new compiler?
260.
by agwa 3y ago
You can install your own CA certificate in the user certificate store, and it will be trusted by Chrome and any other app which opts into user-installed CAs, which should include email and calendar apps. What is unlikely to work is installi
261.
by agwa 3y ago
Yes, you have to use their DNS, which is tightly integrated with their CDN in ways that are fine for some people but others may find undesirable (e.g. they automatically obtain SSL certificates for your domains).
262.
by agwa 3y ago
If their costs have gone up due to inflation they should be honest about that. Their blog post implicitly blames Verisign for the price increase, which is not the whole truth.
263.
by agwa 3y ago
That's presumably going to increase on September 1 or else they'll be taking a $0.04 loss every time they sell a .com.
264.
by agwa 3y ago
Namecheap's current .com renewal price of $14.58 is broken down as: $0.18 ICANN fee $8.97 Verisign's current registry fee $5.43 Namecheap's markup Namecheap's new .com renewal price of $15.88 will be broken do
265.
by agwa 3y ago
> Compatibility is defined in terms of a contract between program and language implementation. If the program violates the contract by containing UB, then compatibility does not apply. Indeed, furthering my point that having UB in a la
266.
by agwa 3y ago
Undefined behavior is the opposite of programmer control. As the examples in the blog post show, you can write code that explicitly deferences a NULL pointer, or enters an infinite loop, and the compiler will think surely the programmer d
267.
by agwa 3y ago
> You are of course correct that NULL dereference checking is would incur a performance penalty at runtime. However, the compiler should be able to catch some subset of cases at compile time. At the very least, there could be a mode whe
268.
by agwa 3y ago
Undefined behavior permits backwards compatibility to be broken, because when a compiler adds a new optimization that exploits UB, existing programs can change behavior, breaking code that previously worked. The blog post cites infinite
269.
by agwa 3y ago
That's why DRM is bad, not why HTTPS is bad.
270.
by agwa 3y ago
Just a couple weeks ago I wanted to inspect some of the HTTPS traffic that Chrome was sending to Google. All I had to do was set the SSLKEYLOGFILE environment variable, and Chrome wrote the TLS session keys to this file. I told Wireshark t

More ›