jvehent

24 ms·

181.
by jvehent 11y ago
This is pretty much what Rob Pike advocates in Go: "A little copying is better than a little dependency." http://go-proverbs.github.io/
182.
by jvehent 11y ago
It's all a matter of prioritization. In an ideal world, address all the issues and be perfectly secure. But if you have to choose by priorities, private ssh key compromise is not exactly at the top of my concerns because people are gen
183.
by jvehent 11y ago
You're describing the workflow of an APT attack. Those are extremely costly, take several months to complete and definitely involve highly technical skills. I agree they are a real threat, but not to startups, to Fortune 500 companies.
184.
by jvehent 11y ago
> 3. Never grand direct SSH to access the the staging/production environment. Most complex systems fail in unexpected ways, and the best way to debug is to grant the devs access to production machines. It can be temporary, monitore
185.
by jvehent 11y ago
> Developer laptop compromise is probably the biggest security risk that any startup company faces, because the developer laptop is an uncontrolled environment with a lot of "attack surface" which may have been previously comp
186.
by jvehent 11y ago
They were distributed to several hundreds mozillians last year. I used one for a while. Excellent device, very responsive with FxOS on it. If it had enough apps, it could have been competitive...
187.
by jvehent 11y ago
This is my experience as well. The only thing that somewhat breaks between Go project is vendoring (or lack thereof). But in comparison to the pain of supporting python applications that must run on everything from 2.6.6 to 3.5, Go is a wal
188.
by jvehent 11y ago
Use cases and examples are pretty scarce. The doc is accurate, but understand the doc for a newcomer to the tool is difficult.
189.
by jvehent 11y ago
That's what your local security team should be for ;) At Mozilla, we track those and inform the various ops teams of our assessments. They very much rely on us to decide if it warrants emergency patching or not (modulo operational conc
190.
by jvehent 11y ago
This is cool! RabbitMQ could really use better documentation. I had to implement permissions for MIG a while ago, and it tooks many trials and errors to get it right. https://github.com/mozilla/mig/blob/master
191.
by jvehent 11y ago
Ops teams need a clear "should I do emergency patching? yes/no" message when any vulnerability gets published. In this instance, it looks like this doesn't require emergency patching unless you're using something un
192.
by jvehent 11y ago
Thanks for the excellent description of the vuln! You mention Apache not being vulnerbale. I just looked through the Nginx code, and it doesn't seem to be vulnerable either because Igor Sysoev enabled SSL_OP_SINGLE_DH_USE back in 2008.
193.
by jvehent 11y ago
> the scheme to accomplish this was rigorously vetted in a 12-day audit. Vetted by whom? It would help build trust if there was a public report on the strength of your implementation available somewhere.
194.
by jvehent 11y ago
I wrote some of my thoughts on the topic, and the primary motivation behind SOPS [1] (which uses PGP and KMS): https://jve.linuxwall.info/blog/index.php?post/2015/10/01/In... The initial trust probl
195.
by jvehent 11y ago
I see you've reused the zscan DB schema. It's a good choice, we used it to inspire our schema too. We went a bit beyond because we also store ciphersuites (from cipherscan) and chains of trusts, so the DB schema had to be more rel
196.
by jvehent 11y ago
The problem isn't so much exposing the data as a rest api, as it is allowing for complex queries that may contain various table joins, subqueries or recursive conditions. I only skimmed through the documentation of postgrest, but it do
197.
by jvehent 11y ago
That's fairly easy to do in a cron job: TARGET="mysite.example.net"; \ RECIPIENT="hostmaster@mysite.example.net"; \ DAYS=7; \ echo "checking if $TARGET expires in less than $DAYS days"; \
198.
by jvehent 11y ago
Exporting is one possibility, but eventually I'd like to provide a read-only sql access to the database we host. We have a few ideas on how to do this [1], but it's not implemented yet. [1] https://github.com/mozil
199.
by jvehent 11y ago
Our dataset is not loaded from an external source, it is generated by scanners. But to answer your question: yes, postgres can load data from csv files: http://stackoverflow.com/questions/2987433/how-to-import-csv.
200.
by jvehent 11y ago
I have about the same amount of data in a Postgres database as part of the TLS Observatory project [1]. observatory=> select count(distinct(sha256_fingerprint)) from certificates; count --------- 1239943 obser
201.
by jvehent 11y ago
Go has spoiled me for the past couple years.
202.
by jvehent 11y ago
The serie Foyle's War has excellent details about the impact of the war on normal citizens of southeast UK. I grew up in Normandie, on the other side of the channel, and heard the same stories from my grand-parents.
203.
by jvehent 11y ago
I work remote. Most video conferences are great, except when too many people are in the same office and start talking to each other. Then audio quality goes down, and you can't place a word in the discussion. I couldn't imagine us
204.
by jvehent 11y ago
The updates themselves are served over HTTP and signed, but the request that verifies an update is available is done over HTTPS.
205.
by jvehent 11y ago
Setting security.pki.sha1_enforcement_level to 0 will still only accept SHA-1 certs that are signed by a root CA in the NSS truststore. That setting only disables the SHA-1 deprecation logic.
206.
by jvehent 11y ago
For some background around the discovery and analysis of the issue, see this thread: https://groups.google.com/forum/#!topic/mozilla.dev.platform...
207.
Man-In-the-Middle Interfering with Increased Security(blog.mozilla.org)
97 points by jvehent 11y ago|43 comments
208.
by jvehent 11y ago
This should have been a blog post.
209.
Sops – editor of encrypted files that supports YAML, JSON and BINARY formats(github.com)
1 points by jvehent 11y ago|0 comments
210.
by jvehent 11y ago
Ryan Sleevi, of the Chrome PKI team, has written a much more detailed analysis of the Cloudflare proposal and its caveats. I recommend you read them before voicing an opinion on this topic, because it is a complex one. 1. https:/&#x2F

More ›