colmmacc

32 ms·

301.
by colmmacc 9y ago
Standing reminder that friends don't let friends use DNSSEC, because it is crazy and provides no real security. With that in mind, it's fun to dive in and see where the problems are ... Fundamentally this DANE idea swaps out the p
302.
by colmmacc 9y ago
10 year Amazonian here. I think we have one of the most expensive perks of all: an active, expansive, downtown campus. That's not cheap, those towers cost billions, and there's a reason many big technology competitors are in more
303.
by colmmacc 9y ago
A TLS server without mutual auth doesn't need to do any online X509 processing, and only a tiny amount of ASN.1 (parsing the DH share, which is easy). It just serves certs, without parsing them. Mutual auth increases the TCB by a lot,
304.
by colmmacc 9y ago
The main threats are protocol and network level. For example, request-smuggling and hi-jacking attacks can take the form of bugs in proxies and servers that allow requests to be smuggled because they don't escape newlines in headers an
305.
by colmmacc 9y ago
Even the question "Is this client one of ours?" is a bad question to ask. A much better question is "Is this specific action authorized and authenticated?". When you only authenticate a client, with a mechanism such as T
306.
by colmmacc 9y ago
Most of these middle boxes aren't actually man-in-the-middle attacking TLS. Instead they are enforcing aspects of the protocol, as some kind of Firewall. Sometimes this is silly fluff, preventing the bit-torrent protocol from running o
307.
by colmmacc 9y ago
Passwords are PSKs and are the overwhelming default authentication mechanism for Internet scale systems. Storing, distributing, and synchronizing billions of small blobs is actually a solved problem and not that big a deal. I wouldn't
308.
by colmmacc 9y ago
The IETF TLS working group has included a relevant suggestion in the TLS1.3 draft RFC: https://github.com/tlswg/tls13-spec/commit/465de0e189b2b5909... The idea is simple: use two different instances of a secu
309.
by colmmacc 9y ago
https://medium.com/@oskansavli/bells-theorem-and-randomness-... is a good write up of the relationship between randomness and Bell's theorem.
310.
by colmmacc 9y ago
RFC8020 is an example of the DNS WG making backwards incompatible changes. The "NXDOMAIN" for an empty non-terminal has long been the behavior in DJB's TinyDNS. That isn't what Route 53 is using, but I bring it up becaus
311.
by colmmacc 9y ago
There is a zone cut at ws.fdmg.org, so I think it's the latter. The zone is misconfigured, that's pretty simple to fix for whoever owns the zone, but the general question of whether Route 53 should be more strict and prevent it fr
312.
by colmmacc 9y ago
AWS Engineer here. I haven't worked directly on Route 53 in a few years, but I wrote most of the DNS answering logic back when we built Route 53. Route 53 is a so-called "child centric" DNS server, in that it considers the ch
313.
by colmmacc 9y ago
These days EDNS0 allows bigger UDP responses in many cases, which may mean some fragment re-assembly. Unfortunately there are a staggering number of networks and firewalls that don't open TCP 53, and also ones that don't permit UD
314.
by colmmacc 9y ago
Pretty hard :) We should do better (I work at AWS) to be more seamless, but we also take protecting customer data very seriously. Internally, it's quite a process, with security and legal and compliance reviews and multi-level approval
315.
by colmmacc 9y ago
PrivateLink is used to provision Endpoints, which can accept TCP connections, but not originate them. It's designed for services such as webservices, web sites, databases, e-mail, and so on. VPC peering does allow you to do full bi-dir
316.
by colmmacc 9y ago
There's lots on https://aws.amazon.com/vpc/ , and talks on youtube ( https://www.youtube.com/watch?time_continue=4&v=3qln2u1Vr2E is a fav). But the TLDR is this: VPC stands for "Virtual Pri
317.
by colmmacc 9y ago
I got a new Model S in October and it came with free supercharging for life, because I had a referral code from another Tesla owner.
318.
by colmmacc 9y ago
Wow, that's a cool trick - personally, I didn't know this is possible. Does it mean a system call and context switch for every check though? One thing I like about the MINHERIT_ZERO/MADV_WIPEONFORK approach is that it's
319.
by colmmacc 9y ago
We use RDRAND if it's available, and we also have our own hardware entropy generators in some systems. In either case, we use this entropy as additional input that provides prediction resistance, and it's fed into the AES_CTR gene
320.
by colmmacc 9y ago
See my reply here ... https://news.ycombinator.com/item?id=15761490
321.
by colmmacc 9y ago
http://docs.aws.amazon.com/cli/latest/reference/kms/generate... :)
322.
by colmmacc 9y ago
I couldn't make this work reliably ... the kinds of applications that call clone() directly and bypass the pthreads stuff are language runtimes and VMs that want to emulate their own lightweight processes. They also have their own page
323.
by colmmacc 9y ago
I'm still experimenting with the best approach. On Linux fork() clones a single thread's context, and since we know there's no call to fork() between the line of code checking the guard and the lines of code generating data,
324.
by colmmacc 9y ago
We can't change history, only improve the future. There are three levels of defense, precisely because until now there's been no way to robustly detect a fork(), but it will be nice to nail that for 4.14 and beyond and fleets can
325.
by colmmacc 9y ago
bmm6o's reply captures the approach; you WIPEONFORK a guard variable, and use the state of that variable to re-initialize. When we're writing a crypto library, like s2n, or OpenSSL, we don't get a choice to avoid fork() ... t
326.
by colmmacc 9y ago
madvise() works at the page level and if you're using madvise(), then you're expected to be using mmap() to allocate pages explicitly. It would be unusual and a bad idea to start madvise()ing memory that's being handled by an
327.
by colmmacc 9y ago
If you work on crypto, or any application where sensitive data is handled, then this short post on the WIPEONFORK option may be interesting: http://www.metzdowd.com/pipermail/cryptography/2017-November...
328.
by colmmacc 9y ago
These don't quite work the same. S3's different durability SLAs are ultimately about how many copies of the data there are ... storing the data in more places more times gives more durability, but obviously costs a bit more in rea
329.
by colmmacc 9y ago
We do also have CloudFront - which can front dynamic content, and even integrate with Lambda@Edge to serve responses. But at that point it's not really acting as a load balancer. R53 + Geo DNS | Latency Based DNS | Traffic Manager + Ap
330.
by colmmacc 9y ago
I have a Model S too, and my one irritation with it is that I don't have a physical button or dial to turn off the headlights. Whenever I drive onto a Washington State Ferry at night, it gets me into a bit of trouble. If you haven&#x27

More ›