jvehent

17 ms·

121.
by jvehent 10y ago
You need https to guarantee data in transit is not being modified between your server and web clients. ISPs, for instance, have a bad tendency to inject tracking cookies in http traffic.
122.
by jvehent 10y ago
Direct link to the live Observatory: https://observatory.mozilla.org/ Example run on addons.mozilla.org: https://observatory.mozilla.org/analyze.html?host=addons.moz... The Observatory measures site's
123.
Promoting Security Best Practices with Mozilla Observatory(medium.com)
3 points by jvehent 10y ago|1 comments
124.
by jvehent 10y ago
Many people try to switch to Mutt thinking it will be like using gmail but in the terminal. It is not. Mutt is a productivity tool, like vim and emacs, but for email instead of code. You need to invest a lot of time into learning it, refini
125.
by jvehent 10y ago
Unless you're poor. Then you don't have a computer.
126.
Let's Encrypt: The Road to Encrypting All the Things(air.mozilla.org)
2 points by jvehent 10y ago|0 comments
127.
by jvehent 10y ago
bitcoin.org does not implement HPKP. Any government that controls a CA can generate its own cert for bitcoin.org, hijack the site's IP and replace this page with their own fingerprint.
128.
Let's Encrypt: The Road to Encrypting All the Things(air.mozilla.org)
5 points by jvehent 10y ago|0 comments
129.
How Let's Encrypt was built(rmll.ubicast.tv)
1 points by jvehent 10y ago|0 comments
130.
MWoS 2015: Let’s Encrypt Automation Tooling(blog.mozilla.org)
3 points by jvehent 10y ago|0 comments
131.
by jvehent 10y ago
Does anyone have feedback running app at scale in Google Cloud for more than one year?
132.
TLS stats from 1.6B connections to mozilla.org(jve.linuxwall.info)
3 points by jvehent 10y ago|0 comments
133.
by jvehent 10y ago
This technique assumes the operator is OK with taking a few weeks for all users to register the new host key. In the event of a leak, revocation of the leaked key must be immediate. That's why we have CRLs (and OneCRL) and OCSP.
134.
by jvehent 10y ago
No. I said that changing the key, which must happen, will trigger a warning that will scare users away. Which is (partly) why no one uses SSH with non technical populations.
135.
by jvehent 10y ago
You're missing the point: SSH does not provide a host key rotation/revocation mechanism. TLS does.
136.
by jvehent 10y ago
> Why aren’t we using SSH for everything? Because when you have 100,000 users and you need to rotate your host key following a leak, the team in charge of user retention has a heart attack.
137.
by jvehent 10y ago
If you want to contribute to this page, or the config generator [1] that goes with it, check out its repository on github: https://github.com/mozilla/server-side-tls [1] https://mozilla.github.io/server
138.
by jvehent 10y ago
Firefox Services Security Engineer | Mozilla | Remote (GMT-4 to GMT-9) Mozilla’s Services Security Team is looking for an ambitious Security Engineer to help us protect the back-end services that power Firefox and serve millions of users wo
139.
Announcing the 2016 Edition of Mozilla Winter of Security(blog.mozilla.org)
2 points by jvehent 10y ago|0 comments
140.
by jvehent 10y ago
Godoc is searchable: https://godoc.org/?q=json+web+token
141.
by jvehent 10y ago
I have not looked into this. The S3 method is kinda experimental. It works for first-level packages but fails for nested packages. We need to look into setting up redirects for those. The best way to do this yourself is to run an instance o
142.
by jvehent 10y ago
Projects I care about use a domain I control. It's not that hard to setup: https://jve.linuxwall.info/blog/index.php?post/2015/08/26/Ho... We even do it with just an S3 bucket for go.mozilla.or
143.
by jvehent 10y ago
And this is why remote work for tech people is the future. Timezones are still an issue, but if you're willing to adapt your work hours to meet the majority, being remote allows you to work for fantastic companies without sacrificing y
144.
by jvehent 10y ago
Let's Encrypt currently uses a cross-signature provided by Identrust that expires in 2021. This inclusion is the first step toward making Let's Encrypt completely autonomous.
145.
ISRG (Let's Encrypt) Root X1 Inclusion in NSS(bugzilla.mozilla.org)
1 points by jvehent 10y ago|1 comments
146.
Monitor TLS with a Simple Bash Script and Mozilla's TLS Observatory(gist.github.com)
3 points by jvehent 10y ago|0 comments
147.
by jvehent 10y ago
That is a terrifying amount of crypto code. Has anyone audited this, or plan to?
148.
by jvehent 10y ago
Similar to Greenkeeper or requires.io, but with a larger range of languages supported. Very interesting. As a side note, I recommend creating a separate github account when granting permission to this kind of 3rd party. Don't grant the
149.
by jvehent 10y ago
and also influence policies that protect the Internet or support hundreds of local communities that teach the web worldwide [1] [1] https://www.mozilla.org/en-US/contact/communities/
150.
by jvehent 10y ago
Let me fix that for you: "Facebook Does Not [yet] Use Your Phone’s Microphone for Ads or News Feed Stories"

More ›