konklone

17 ms·

121.
by konklone 12y ago
> for very high traffic websites HTTPS costs a lot of money. .gov sites are not very high traffic. .gov sites can be very high traffic. Think weather, social security, health care, immigration, visas... > - When you have such high t
122.
by konklone 12y ago
> Exactly what the American people have come to expect from the government. Unless its been gift wrapped by a contractor they lack any ability to do anything technical. Exactly the expectations that 18F would like to change.
123.
by konklone 12y ago
Every site is going to have a different sort of userbase, so it's tough to make sweeping proclamations about support. I don't think we'll have trouble using SHA-2 in our deployments.
124.
by konklone 12y ago
> Those aren't the only downsides. The other downside is dramatically increased first byte latency due to the handshake. The latency increased, but it doesn't have to be drastic. Ilya Grigorik has a great piece on how to get th
125.
by konklone 12y ago
Exactly - and that's why we have SPDY header compression disabled on our nginx config: https://github.com/18F/tls-standards/blob/master/configurati... When SPDY 4 or HTTP/2 make their way into
126.
by konklone 12y ago
> Do you have to encourage your colleagues to use it? I've enabled HTTPS on all our sites yet when the links are distributed they are the typical HTTP. Yeah, sometimes. But that's also why we enable HSTS on our stuff, so that t
127.
by konklone 12y ago
Very glad to help. :D For those reading this, the best URL is https://github.com/18F/tls-standards/blob/master/configurati... , which is heavily based on the nginx config I maintain personally at https:&
128.
by konklone 12y ago
Thanks! But actually, it pains me that we're still showing a SHA-1 cert. Because bureaucracy, we're still waiting on a replacement SHA-2 cert, which once installed will bring our score up to an A+ like this: https://www
129.
by konklone 12y ago
> Considering that latey there's been a pretty strong shift to using HTTPs everywhere, I don't see how using it on .gov site needs an explanation :) If only the .gov space were shifting at the same rate! That sense of inevitabi
130.
Why we use HTTPS for every .gov website we make(18f.gsa.gov)
233 points by konklone 12y ago|82 comments
131.
by konklone 12y ago
Right on, but tiny correction - 12.04 has over two years of life left, not three.
132.
by konklone 12y ago
@MarcBodnick - I do understand this perspective. But I strongly disagree with its tradeoffs. Quora should find other ways to protect its users, and/or make users aware of their own rights to get their old contributions taken down. The
133.
by konklone 12y ago
> The post is nothing more than an attempt to shame Quora into opening up their data. My post is definitely an attempt to shame Quora into opening up their data, in at least the sense of making it available to the Internet Archive. No bo
134.
by konklone 12y ago
> What are some ideas about what Quora's long-term business model might end up being? There's some good discussion on that on, how about that, Quora: https://www.quora.com/What-could-Quoras-long-term-business-p.
135.
by konklone 12y ago
> Hey, I'm the random guy that asked you to answer on Quora. How I found you isn't very mysterious, I just asked all the folks listed here: http://18f.gsa.gov if I could easily identify a Quora profile. And hopefull
136.
by konklone 12y ago
> and if someone -- including the Internet Archive! -- reproduces it without your permission, you are legally entitled to ask them to stop. The Internet Archive won't even make you involve a lawyer. That's right. And this is im
137.
by konklone 12y ago
> And their mission is certainly not to "share and grow the world's knowledge". Well, I obviously agree that it's not their actual mission as executed. But I'm putting it in quotes because I copied it from Quora&
138.
Daniel Ellsberg and Sunlight Foundation Are Opposing USA Freedom Act(sunlightfoundation.com)
8 points by konklone 12y ago|0 comments
139.
by konklone 12y ago
I could have said "practically unique", instead of "in theory is unique" there, but I make the distinction more clear just below that and note that there are always collisions out there.
140.
by konklone 12y ago
In fact, Heartbleed helped a lot: http://news.netcraft.com/archives/2014/05/05/sha-2-very-cryp... But there's a long way to go.
141.
by konklone 12y ago
I have, it's one of the links in there. I truly loved reading that discussion.
142.
by konklone 12y ago
That's right, but the root cert is not sent by the server (in my case). More importantly, SHA-1 isn't a problem for root certs, as their signature is not used to verify their integrity.
143.
by konklone 12y ago
It's a roundup of last week's news, and (hopefully) better all-around explanation and background for people with less technical knowledge. It also points people to another tool I made, https://shaaaaaaaaaaaaa.com , to a
144.
by konklone 12y ago
I added links to both papers to the bottom, and removed the "we'll probably need to upgrade" to SHA-3 sentence fragment.
145.
by konklone 12y ago
> Another way to think about SHA2 and SHA3 is that it's entirely possible that SHA3 could fall before SHA2 does. They are unrelated algorithms. Very good point, though I would expect SHA2 to see far more research on weakening it. It
146.
by konklone 12y ago
a) This is great. Also, a friend linked me to Expedited SSL yesterday and I link to it in the bottom of this post. b) I think its SHA-1 scanner is mistaken - it flags my site as using SHA-1, but it's SHA-2 in every cert in its chain:
147.
by konklone 12y ago
SHA-256 is a form of SHA-2.
148.
by konklone 12y ago
They can be seen in the Chrome discussion thread, complaining to Google that the timeline is too aggressive. But they're a good company, and I imagine they'll update as soon as they can.
149.
by konklone 12y ago
@tptacek - I tried to include enough detail to make it clear that a SHA-1 forgery isn't as trivial as a brute force. That you'd have to "coax a Certificate Authority" into issuing you a targeted forgery, and that that&#x
150.
by konklone 12y ago
A .deb package sounds like a terrific idea!

More ›