jvehent

30 ms·

271.
by jvehent 12y ago
It's a tricky thing to do because of all the possible versions of all the possible web servers. The dropdown would end up being rather long, and require maintaining a list in the code. And then there's distribution specific backpo
272.
by jvehent 12y ago
You can reuse the same diffie-hellman parameter. It's a public value anyway.
273.
by jvehent 12y ago
Very good catch! Thanks for bringing it up. I had reverted the first one but missed the two others. Unfortunately, mediawiki only support two levels of access control: fully locked or fully open, so I need to manually police changes as they
274.
by jvehent 12y ago
Hello HN, author of Server Side TLS [1] and co-maintainer of the conf generator here. Thanks for pushing this tool to the front page :) We've been improving our guidelines and this generator for the past year and a half, and while it i
275.
Introducing Project Seasponge: Quick and Easy Threat Modeling(blog.mozilla.org)
18 points by jvehent 12y ago|2 comments
276.
Complete rewrite of HAProxy in Lua(haproxy.org)
2 points by jvehent 12y ago|0 comments
277.
by jvehent 12y ago
What if they are right, and saying no is the reasonable way to keep the language lean and efficient?
278.
by jvehent 12y ago
Most definitely. I use it for building RPM, DEBs and even MacOS PKGs and it works great. https://github.com/mozilla/mig/blob/master/Makefile#L233-L27... Package signing could use some love, but it's
279.
by jvehent 12y ago
When MIG was started, in the summer of 2013, Rust was still too unstable to be a good candidate. Go, however, already had the toolkit to build cross-platform agents, so I went with this. 18 months in, I still think it was the right choice.
280.
by jvehent 12y ago
You are correct: MIG is designed to prevent a rogue investigator from executing random commands on systems. We do so by filtering what agents can run through modules, and by requiring OpenPGP signatures on all actions ran. Even if the MIG p
281.
by jvehent 12y ago
They also use a pretty strong TLS conf https://gist.github.com/jvehent/98fdfef139b6237f7bf5 What strikes me is that their conf is inaccessible to old client (no sslv3, no sha-1 cert). Honest question: does the governme
282.
Mozilla peers into processes with student-built forensics probe(theregister.co.uk)
4 points by jvehent 12y ago|0 comments
283.
by jvehent 12y ago
GPG in Mutt is fantastically well integrated. Now, of course, you have to get used to Mutt first :)
284.
by jvehent 12y ago
75% of alexa's top 1 million have RC4 enabled [1]. It will take a lot of evangelizing to finally get rid of it. [1] https://securitypitfalls.wordpress.com/2015/03/13/february-2...
285.
by jvehent 12y ago
Looks pretty good. Their configuration could use a larger DHE parameters (2048), replace RC4 with 3DES and enable OCSP Stapling. But it's already in the top 1% for TLS quality! $ ./cipherscan pinterest.com ..............
286.
by jvehent 12y ago
Along the same line, there are currently around 4,000 sites in Alexa's top 1 million that only support RC4. Nothing else. Some of these sites have large user bases too, and it's making it hard to disable RC4 in Firefox. https:&#x
287.
Introducing Masche: memory scanning for server security(blog.mozilla.org)
6 points by jvehent 12y ago|0 comments
288.
10 years of self-hosting Linuxwall.info(jve.linuxwall.info)
2 points by jvehent 12y ago|0 comments
289.
by jvehent 12y ago
The same rule holds true for jobs in the private sector: work for a high profile company (Google, Apple, Facebook, ...) and you will find doors open everywhere. Getting there in the first place is the real challenge.
290.
by jvehent 12y ago
> let those rare clients use non-PFS suites That's not acceptable for us, which is why DHE is there. Mozilla aims to provide the best possible security to the larger number, and that drives a number of the choices in the recommende
291.
by jvehent 12y ago
Author of Server Side TLS here. Almost everyone should be able to use the intermediate configuration we propose. I recommend our conf generator at https://mozilla.github.io/server-side-tls/ssl-config-generat... . Ciphe
292.
by jvehent 12y ago
You know what's cooler than working for Walmart? Working on disrupting Walmart, and forcing them to increase the quality of the products they sell to keep competing.
293.
by jvehent 12y ago
I'm eagerly waiting for something better to come up. There hasn't been anything satisfying so far, so I keep encrypting truly confidential communication with GPG, and it gets the job done.
294.
by jvehent 12y ago
This is good advice. I went through similar experience in my 2nd and 3rd jobs, where the work of "junior security consultant" was reduced to pushing compliance paperwork. I ended up studying tons of new technologies on my own, and
295.
by jvehent 12y ago
At Mozilla Opsec, we use (and write) MozDef: https://github.com/jeffbryner/MozDef/
296.
by jvehent 12y ago
I don't need this, I have comcast. $ sudo ping -i 0.02 8.8.8.8 [...] 64 bytes from 8.8.8.8: icmp_seq=578 ttl=53 time=15.5 ms ^C --- 8.8.8.8 ping statistics --- 579 packets transmitted, 364 received, 37% packet
297.
by jvehent 12y ago
It got 3 years :)
298.
by jvehent 12y ago
Maybe the author understands programming as "writing lines of code", and not as "architecting software". Architecture requires experience. Writing the fastest quick sort in a given language is an exercise for fresh young
299.
by jvehent 12y ago
> TCP connections that don't match a handful of patterns would be suspicious (IMHO) and should probably just be dropped. I used to believe that. It is unfortunately not true. TCP packets will come in all shapes and forms, and all mu
300.
by jvehent 12y ago
"The key feature is a built-in custom TCP/IP stack capable of handling millions of DNS queries-per-second per CPU core." DNS uses UDP primarily. I suspect the author meant "UDP/TCP/IP" by "TCP/IP

More ›