hsivonen

46 ms·

421.
by hsivonen 11y ago
The HTML spec migrated from a Python-based cross-reference generator ( https://bitbucket.org/ms2ger/anolis/ ) to a Pascal-based one ( https://github.com/whatwg/wattsi ) recently.
422.
by hsivonen 11y ago
Thank you.
423.
by hsivonen 11y ago
Recently issued SHA-1 cert from this root: https://www.ssllabs.com/ssltest/analyze.html?d=members.spi-i...
424.
by hsivonen 11y ago
FWIW, Ubuntu appears to inherit this cert from upstream.
425.
Ca-certificates: removal of SPI CA(bugs.debian.org)
70 points by hsivonen 11y ago|36 comments
426.
by hsivonen 11y ago
Is there an ETA for getting built-in ACME clients into nginx and Apache?
427.
by hsivonen 11y ago
The Cloudflare ancestor comment raised the concern about certain countries--not enterprise. The CA/B forum post is relevant regarding the downsides of exceptions even if the thread there focuses on enterprise issues.
428.
by hsivonen 11y ago
When should one expect to see an ACME client built into nginx so that you could specify an ACME-enabled CA instead of a key file right in nginx config and have nginx itself do the rest?
429.
by hsivonen 11y ago
1. Right. I suggested they probably should (with permission) to change the content. 2. The cache is a red herring. It wouldn't matter on the Cloudflare side if done on the edge. It wouldn't matter on the client, because the client
430.
by hsivonen 11y ago
Since you already have the capability to do something different for SHA-256-intolerant browsers, I suggest you inject ( this year with permission from your customers) banners informing the users of these browsers to switch to SHA-256-compa
431.
by hsivonen 11y ago
Hence, "ahead of time".
432.
by hsivonen 11y ago
Sadly, XP users who should be installing Firefox or Linux or Nokia users who should be installing Opera Mini don't read tech news. Is anyone trying to inform them ahead of time?
433.
by hsivonen 11y ago
Addressing non-HTTPS Web issues with migration to DNSSEC instead of migration to HTTPS is totally bogus. It's especially bogus as a use case in the Cloudflare case, since Cloudflare had HTTPS first.
434.
by hsivonen 11y ago
The flipside: https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXC... "That said, the fact that Linux distros might switch off Telemetry and [Firefox Health Report] by default causes issues right
435.
by hsivonen 11y ago
What's the use case? Thanks to TLS, you don't need DNSSEC for the Web. For email, if your DNSSEC-enabled domain delegates to a provider that isn't DNSSEC-enabled, you haven't accomplished anything of true value.
436.
by hsivonen 11y ago
Last I checked (updates may have fixed this), Ubuntu 12.04 had ECC-capable OpenSSL but ECC-incapable Apache.
437.
by hsivonen 11y ago
Sadly, users who follow this advice will forget that they did by the time they can't figure out why connections fail to servers that have been configured for forward secrecy only but run an ECC-incapable version of Apache (thanks to lo
438.
by hsivonen 11y ago
How is that legal in the European Economic Area?
439.
by hsivonen 11y ago
Once you look at it from the perspective of the crypto protecting the user instead of the content, it should be obvious why publishing the private key is not OK.
440.
by hsivonen 11y ago
It's pretty sad that the embedded system problem is exposed to the userland, which isn't a reasonable place to deal with the problem. A better solution would be to require the bootloader to supply the kernel with a seed (as, I gat
441.
by hsivonen 11y ago
If the right way to use the Linux system call is to use it with flags set to such that it becomes equivalent to the OpenBSD system call, 1) Why does the Linux system call have flags at all? 2) Why does the Linux system call have a different
442.
by hsivonen 11y ago
Jolla uses a Qt port of Gecko (ESR, it seems) as the engine of Sailfish Browser, the default browser on Jolla devices. See https://github.com/tmeshkova/qtmozembed As I understand it, even during the Nokia days, the poi
443.
by hsivonen 11y ago
Having fopen() that takes utf-8 on Windows is a huge deal. I already want to investigate using this for Firefox on Windows for this reason alone.
444.
by hsivonen 11y ago
I think the system browser in 3.x is a significant UX improvement. The old browser app always felt like trying to impose an Android-like world-view on a system where the system was supposed to be a browser all along.
445.
by hsivonen 11y ago
Relevant: http://ed.agadak.net/2015/04/whys-and-hows-of-suggested-tile... Key quote: "to summarize, Firefox makes generic encrypted cookieless requests to get enough data to decide locally in Firefox whether
446.
by hsivonen 11y ago
Please open a bug report and CC :hsivonen
447.
by hsivonen 11y ago
Today a commented on a bug report from someone who still hasn't migrated to a UTF-8 locale. And when POODLE happened, there were still servers on SSLv3. So, yeah. :-(
448.
by hsivonen 11y ago
For software that runs as non-admin, authenticode is very much about checking delivery -time integrity. If you have admin-level malware, it can replace signed software (that gets run without admin privs and doesn't have UAC at launch)
449.
by hsivonen 11y ago
Your scenario already has the malware running with the user's privileges. This means that the malware already has more privileges than sandboxed GMPs in your scenario.
450.
by hsivonen 11y ago
Firefox checks SHA-512 hashes at download time. If you have local malware that changes the GMP DLLs thereafter, the malware might as well change Firefox itself.

More ›