jvehent

28 ms·

241.
Firefox Brings Fresh New Look to Windows 10 and Makes Add-Ons Safer(blog.mozilla.org)
3 points by jvehent 11y ago|2 comments
242.
by jvehent 11y ago
Very impressive tool. Not hard to pick up at all. It builds and runs on Fedora 22 without having to battle with dependencies, which is way easier than I expected :)
243.
by jvehent 11y ago
It's a cool awareness experiment. Ultimately, public keys are public and people shouldn't be afraid of sharing them. Agent forwarding sharing is a big one though. Getting people to stop doing that automatically takes a lot of educ
244.
Mozilla Winter of Security 2015(wiki.mozilla.org)
1 points by jvehent 11y ago|0 comments
245.
by jvehent 11y ago
Maybe it's time tech companies let their engineers globally work remotely from comfortable places, instead of parking them into metal boxes and sweetening the deal with catered lunches.
246.
You can't trust the infra; Encrypt client side(jve.linuxwall.info)
10 points by jvehent 11y ago|4 comments
247.
by jvehent 11y ago
90% of security incidents are due to human errors, not to some secretive hacker group spending $10m to crack TLS. Doing system administration right (eg. no secrets in repos) has a lot more impact on security than implementing all the other
248.
Using Mozilla Investigator (MIG) to detect unknown hosts(jve.linuxwall.info)
2 points by jvehent 11y ago|0 comments
249.
by jvehent 11y ago
... but can't buy a decent house for less than $800k. (note: I don't live in CA)
250.
by jvehent 11y ago
Can keepalived automatically float MAC addresses nowadays? Last time I checked, that didn't work and clients needed an arp flush to use the new master.
251.
by jvehent 11y ago
I guess creating a bug bounty program is an easier way of pretenting that you care than actually fixing your broken TLS... $ ./cipherscan united.com prio ciphersuite protocols pfs cur
252.
Mozilla Winter of Security is back(blog.mozilla.org)
7 points by jvehent 11y ago|0 comments
253.
by jvehent 11y ago
Microsoft was never a web stack company and always did a poor job at it. Their real power is in the Active Directory. It's very hard to find any decent alternative to that (and no, OpenLDAP isn't the same).
254.
by jvehent 11y ago
> Windows is dying. No. It is not. Windows still sells millions of computers and everyone uses it, from households to corporations. It's here to stay for a very long time.
255.
You can't trust the infra; Encrypt client side(jve.linuxwall.info)
2 points by jvehent 11y ago|0 comments
256.
Verizon suspected to degrade transfer speed on Fios connections(twitter.com)
8 points by jvehent 11y ago|0 comments
257.
by jvehent 11y ago
Use a proper ciphersuite and stop worrying about downgrade attacks. https://wiki.mozilla.org/Security/Server_Side_TLS
258.
by jvehent 11y ago
If you can a) route the traffic through your proxy and b) generate a valid certificate for the target site that's accepted by web browsers, then yes, it's a mitm :)
259.
by jvehent 11y ago
I don't know if that's the case here, but a lot of European colleges require summer internships. Compensation is sometimes permitted, but status of employment must be an internship.
260.
by jvehent 11y ago
That's definitely a trade-off compared to strong authentication, one that I wouldn't want to make in critical environments. But indeed a very nice feature for 99% of low/medium risk applications.
261.
by jvehent 11y ago
There are many solutions out there that attempt to solve the secrets distribution problem. Vault is the newest one. None of them solve the fundamental problem of the secret zero: provisioning the first secret on an untrusted system the au
262.
by jvehent 12y ago
Any functional advantage to using this instead of something like rabbitmq?
263.
by jvehent 12y ago
Surely you must have misread the docs, it's pretty damn powerful.
264.
by jvehent 12y ago
Netflix can serve up to 40Gbps of traffic per server in cleartext HTTP. Their initial test of adding TLS induced a performance cut of ~3x, which has huge cost impact to their infrastructure. This is due to sendfile(), a kernel syscall used
265.
by jvehent 12y ago
This is a fantastic comment! Thank you for posting it. I'd note that many of us don't have a choice and must still use 1024 bits DHE parameters because of java 6 clients. It's unfortunate, and we hope they go away very very s
266.
by jvehent 12y ago
DSS will be removed in a future version of the ciphersuites. I believe support is being removed from Firefox too.
267.
by jvehent 12y ago
I'm not sure how you got those results. I am certainly getting an A+ with the intermediate configuration and HAProxy. https://www.ssllabs.com/ssltest/analyze.html?d=jve.linuxwall...
268.
by jvehent 12y ago
I use haproxy to terminate the TLS of a number of sites, I'd say the support is pretty stellar :) $ ./cipherscan jve.linuxwall.info ........................ Target: jve.linuxwall.info:443 prio ciphersuite
269.
by jvehent 12y ago
That's a valid point. I'd suggest capturing it in the issue https://github.com/mozilla/server-side-tls/issues/39 There's a number of edge cases but we can probably find a middle ground that wor
270.
by jvehent 12y ago
We've had a long and detailed discussion on the dev-tech-crypto mailing list about the preferred ordering for Firefox and, subsequently, for the server side guidelines. It's worth a read if you're into these sort of things h

More ›