jvehent

21 ms·

151.
by jvehent 10y ago
The best way to make sure something never gets done is to share ownership of it.
152.
by jvehent 10y ago
Neither should they. Both guides haves different goals. SSLLabs evaluates the highest possible security, while Mozilla's levels compromise to implement the best possible TLS for a given population of users. "best" isn't
153.
by jvehent 10y ago
We also recommend AES-256 being preferred to AES-128 in Mozilla's modern configuration. From the rationale section: AES256-GCM is prioritized above its 128 bits variant, and ChaCha20 because we assume that most modern devices
154.
by jvehent 10y ago
See also https://hacks.mozilla.org/2016/01/web-push-arrives-in-firefo... WebPush is (going to be) an IETF standard: https://datatracker.ietf.org/wg/webpush/documents/
155.
by jvehent 10y ago
Ivan Ristic has done a remarkable service to the Internet with SSLLabs and ModSecurity, and he has done so with a fantastically positive attitude all throughout. Thank you Ivan, I'll be curious to see what you come up with next ;)
156.
by jvehent 10y ago
Sites operators should reward responsible disclosure, not get researchers into trouble. Bug bounties are a good way to do that. Unfortunately, there are still people out there who don't understand their true value.
157.
by jvehent 10y ago
I agree. The clickbaity title actually makes me want to skip that article, whereas an informative title like you proposed would make me read it.
158.
by jvehent 10y ago
How does it compare to https://github.com/jinzhu/gorm/ ?
159.
by jvehent 10y ago
That's what your boss is for.
160.
State and future of Heka(mail.mozilla.org)
1 points by jvehent 10y ago|0 comments
161.
by jvehent 10y ago
Soft reload takes care of that for you, sockets aren't dropped. If you restart, however, everything's dropped.
162.
by jvehent 10y ago
I use taskwarrior with bugwarrior [1] to automatically maintain a list of pending bugs/issues and pull requests assigned to me. The initial setup takes a couple hours, but it's a great way to track stuff spread across dozens of lo
163.
by jvehent 10y ago
That only works if your application is simple enough for the infosec folks to know how to write a patch for it. If the organization has 200 of those apps, it's unlikely a transversal security team is able to write patches for each one
164.
by jvehent 10y ago
I've seen this happen way too often at various organizations. My take away is security is a function of the product, not some external process you bolt on top of it. Organizations typically fail at security because they try to manage i
165.
Web Security analysis of the Alexa Top 1M sites(pokeinthe.io)
2 points by jvehent 11y ago|0 comments
166.
Risk with GitHub imports and account deletion(groups.google.com)
1 points by jvehent 11y ago|0 comments
167.
by jvehent 11y ago
Can you share an example of challenge given to candidates? In the past, I've used "script a file sharing tool that handles encryption", which worked well and took candidates ~4/8 hours to complete, but isn't somethi
168.
by jvehent 11y ago
echo 'alias json="$(which jo)"' >> ~/.bashrc
169.
by jvehent 11y ago
> Not to say 150th isn't impressive or likely a lot of traffic.. Ballpark, I'd say that's between 700 and 1,000 hits/second on the main frontend. I sort of doubt either AWS or GCP is so much faster than the other for
170.
by jvehent 11y ago
Those articles are useful: everytime someone mentions LinkedIn, I remember to check my account. Without them, I'd pretty much never open the site.
171.
by jvehent 11y ago
Since they have so much money to burn, why don't they support worthwhile OSS efforts (like SSL, for example)? The NSS library is supported by Mozilla and Red Hat, mostly. There are tons of little tools and libraries that
172.
by jvehent 11y ago
Yes, as long as one of the server that shares the keypair has SSLv2 enabled.
173.
by jvehent 11y ago
The important bit, if you have to decide on patching emergency: OpenSSL has classified this vulnerability as "low severity", which we agree with. In order to mount the attack, the attacker has to be able to run the attack code on
174.
by jvehent 11y ago
From a pool of 11 million scans of HTTPS sites, I could only find ~265k targets with SSLv2 enabled [1]. That's 2.4%, not 25%. A breakdown of the type of target that have SSLv2 enabled would be useful to understand how they reached that
175.
Payment Processors Still Using Weak Crypto(blog.mozilla.org)
23 points by jvehent 11y ago|1 comments
176.
A Minimal TLS 1.3 Implementation in Go(github.com)
1 points by jvehent 11y ago|0 comments
177.
by jvehent 11y ago
tldr: Let's Encrypt is achieving its original mission: help people use TLS on domains that were previously insecure, and make the internet a safer place. > In the first quarter of its' operation then, Let's Encrypt has far
178.
by jvehent 11y ago
iptables -t filter -A INPUT -p udp --sport 53 -m connbytes --connbytes 512 --connbytes-dir reply --connbytes-mode bytes -j DROP iptables -t filter -A INPUT -p tcp --sport 53 -m connbytes --connbytes 512 --connbytes-dir reply --connbytes-mod
179.
by jvehent 11y ago
Fine grained classification and management of issues is why Mozilla is so reliant on Bugzilla. Bugzilla is a beast, for sure, and it takes some time to learn how to use it correctly, but few other systems come close in functionalities, and
180.
Go Proverbs(go-proverbs.github.io)
1 points by jvehent 11y ago|0 comments

More ›