jvehent

24 ms·

1. 211.▲
   by jvehent 11y ago

   My colleague Guillaume Destuynder wrote that blog post. We still use CryptoSticks at Mozilla, with sops[1] to securely store backup keys of some of our secrets files. [1] https://github.com/mozilla/sops
2. 212.▲
   by jvehent 11y ago

   > In the event that Persona is decommissioned, we will provide at least 9 months of notice, so there are no actions that need to be taken right now. Persona continues to be monitored and supported, though there is still no new featur
3. 213.▲
   by jvehent 11y ago

   There is an Apache module too: https://github.com/mozilla/mod_authnz_persona
4. 214.▲
   by jvehent 11y ago

   AWS CodeCommit is another option.
5. 215.▲
   by jvehent 11y ago

   Soon enough, modern browsers will deprecate SHA-1, rendering this attack mostly impossible.
6. 216.▲
   by jvehent 11y ago

   > The best solution imo is to just let the community take over. ... which is exactly what is being proposed here, with financial help from the Mozilla Foundation to ease the transition.
7. 217.▲
   by jvehent 11y ago

   Microsoft not supporting older IE doesn't mean front-end people won't have to if their sites have users who don't upgrade. It just means Microsoft can't be bothered to ship patches for those older browsers.
8. 218.▲
   by jvehent 11y ago

   Well, it was a conference presentation... But if you prefer text, there is a pretty good overview at http://mig.mozilla.org ;)
9. 219.▲
   by jvehent 11y ago

   MIG was started in 2013, and osquery did not exist back then. Even today, osquery does not provide a good way to remotely investigate your infrastructure, it's mostly a local-only tool (I know they are working on that now, but it'
10. 220.▲
    by jvehent 11y ago

    Hi HN, I'm the lead dev of MIG and author of this presentation. We've been using it at Mozilla for over two years now, and it's proven to be very useful in our security effort. Happy to answer any questions you may have. Also
11. 221.▲
    MIG: Search through your infrastructure in real-time from the command line(mig.ninja)

    19 points by jvehent 11y ago|6 comments
12. 222.▲
    by jvehent 11y ago

    An alternative approach, if you don't want to be 100% tied to KMS, is https://github.com/mozilla/sops . It uses KMS, but also PGP, and potentially anything that comes up in the future.
13. 223.▲
    Secrets management stinks, use some sops(github.com)

    1 points by jvehent 11y ago|0 comments
14. 224.▲
    by jvehent 11y ago

    Been doing it for 10 years, and it's still fun :) https://jve.linuxwall.info/blog/index.php?post/2015/03/11/10...
15. 225.▲
    Mozilla Launches Open Source Support Program(blog.mozilla.org)

    7 points by jvehent 11y ago|0 comments
16. 226.▲
    by jvehent 11y ago

    It's a poor workaround, but you can set your ELBs in TCP mode, and terminate TLS and HTTP/2 on the instances directly.
17. 227.▲
    SHA1/SHA256 certificate switching with HAProxy(jve.linuxwall.info)

    2 points by jvehent 11y ago|0 comments
18. 228.▲
    Introducing SOPS: a manager of encrypted files for secrets distribution(jve.linuxwall.info)

    3 points by jvehent 11y ago|0 comments
19. 229.▲
    Investigating SSH authorized keys across the infrastructure using MIG(jve.linuxwall.info)

    1 points by jvehent 11y ago|0 comments
20. 230.▲
    by jvehent 11y ago

    And apparently des-cbc3-sha is still a thing...
21. 231.▲
    by jvehent 11y ago

    There is nothing wrong with thunderbird, but it's a very different user experience from a terminal-based application. Side note: I use mutt with gmail imap and have no problem whatsoever. http://wiki.linuxwall.info/doku
22. 232.▲
    by jvehent 11y ago

    You can be a full stack developer. You cannot be a full stack expert. Expertise takes focus and time. At some point, you have to make a choice between knowing a bit of everything, or knowing one thing very well. There is no bad choice, both
23. 233.▲
    by jvehent 11y ago

    I don't think people use mutt because of security (other than good PGP support). I think people use mutt because they like the efficiency of a lean, terminal based, email client.
24. 234.▲
    by jvehent 11y ago

    Same here. I can sort through 300 emails in a few minutes, removing/organizing the cruft into folders, and keeping only a handful of them I need to reply to. That, plus excellent PGP support, just makes mutt a much better email client
25. 235.▲
    Kinto – Store, Sync, Share, and Self-Host(kinto.readthedocs.org)

    5 points by jvehent 11y ago|0 comments
26. 236.▲
    by jvehent 11y ago

    see also http://kinto.readthedocs.org/en/latest/
27. 237.▲
    Hosting Go code on GitHub with a custom import path(jve.linuxwall.info)

    3 points by jvehent 11y ago|0 comments
28. 238.▲
    by jvehent 11y ago

    We don't need noise cancelling headphones. We need cat purr generating headphones!
29. 239.▲
    Notifications in Kinto(servicedenuages.fr)

    1 points by jvehent 11y ago|0 comments
30. 240.▲
    by jvehent 11y ago

    While I find this initiative fantastic, it's a bit frustrating that Github, a company that lives on source code being open, does not publish the code of tools like this one.