pfg

71 ms·

691.
by pfg 10y ago
This happened in 2012 and caused a number of changes to various root programs[1]. Mozilla, for example, is now forcing CAs to disclose any subCAs they sign. This is also from a time when the Baseline Requirements in its current form were no
692.
by pfg 10y ago
If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of business in a heartbeat. That would be a severe violation of Baseline Requir
693.
by pfg 10y ago
> It feels especially egregious because, as commenters pointed out, implementing the PAM API is a better (and undoubtedly more portable) way to do this that the developers of systemd didn't seem to consider. I wouldn't consider
694.
by pfg 10y ago
Google hasn't said anything about removing Symantec under those circumstances. Failing to publish a certificate will result in a browser warning for visitors beginning June 1st[1]. [1]: https://groups.google.com/a/
695.
by pfg 10y ago
It's a pity Symantec (with all their sub-brands) is used by such a large number of sites that it's not feasible to simply remove them from the trust store completely. Between the cases of misissuance, misleading marketing and thei
696.
by pfg 10y ago
Google argued that feature phones only had Java ME, which only included a small subset of Java's APIs, in contrast to Android, which includes significantly more Java (SE) APIs, as well as Android-specific APIs. My layperson understandi
697.
by pfg 10y ago
The district court originally ruled that APIs weren't copyrightable. The appeals court overturned that decision, ruling that APIs were copyrightable, but that it could be fair use. The case went back to the district court for that poin
698.
by pfg 10y ago
> Any lawsuits that don't end up in the Federal Circuit (which pure copyright suits never do) [...] It seems (based on this case) that you could make that happen by simply throwing in a patent claim, even if you'd get defeated
699.
by pfg 10y ago
> APIs are copywriteable (so says the Supreme Court) My understanding is that they refused to hear the case at the time. Is that, legally speaking, the same thing as agreeing with the circuit court, or could they have just refused to hea
700.
by pfg 10y ago
OpenDNS/Cisco Umbrella is basically a DNS-level security service that analyzes your DNS queries, blocks known malware domains, etc. For some high-risk domains - depending on some settings - it will also switch to MitM'ing the conn
701.
by pfg 10y ago
OnionTip[1] allows you to send BTC to relay operators that publish their bitcoin address as part of their contact details. [1]: https://oniontip.com/
702.
by pfg 10y ago
Not to take anything away from your comment (I certainly agree that a lot of Electron apps perform significantly worse than their native counterparts), but I thought this statement was funny in this context given that we're comparing E
703.
by pfg 10y ago
> The logical choice would have been the left arrow key (since there is a corresponding right arrow). Without some sort of modifier key, this would come with the same set of problems, i.e. failing to focus a text field while using it to
704.
by pfg 10y ago
I seem to have read this as "that extension won't be a content script (i.e. require access to all websites, like the existing extension)" initially, but on second reading, that might not be the case (and might, in fact, not b
705.
by pfg 10y ago
The problem with that solution is, at least in my experience, that it doesn't really work reliably for most "rich" web apps , which are more and more common. (I understand that this is a controversial topic in its own light.)
706.
by pfg 10y ago
Let's Encrypt does this by checking their records and determining whether a recent enough certificate was issued for your domains. They don't monitor your site to check the actual expiration dates of the certificates you use in pr
707.
by pfg 10y ago
ACME defines an authorization object, which is created for every FQDN on a certificate. Part of this object is a randomized token. A valid authz object (i.e. one for which you have solved a challenge by, say, creating a TXT record with the
708.
by pfg 10y ago
> The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever. This happened last year and they offered free replacements for affected users[1]. [1]: https://www.yubico.com&#x2
709.
by pfg 10y ago
My current recommendation when I get asked that question is not to bother with any third-party AV and just use Windows 10 with Windows Defender (unless they're on OS X anyway). When I'm asked to set things up, I switch their defau
710.
by pfg 10y ago
My best guess is that you have previously issued a certificate using the apache plugin on that system, and the renewal config file for that certificate is still there. $ echo "BreakThisConfig" > /etc/apache2/
711.
by pfg 10y ago
--standalone won't inspect your web server configuration. Only the apache (and nginx, if you enabled it manually) plugin would do that.
712.
by pfg 10y ago
> So basically HTTP/2.0 performs on par with HTTP/1.1 with pipelining, but has a complexity which is a million times higher, and everyone working on it experiences bugs and incompatibilities. Can you quote the section of the ar
713.
by pfg 10y ago
> To be fair, it's not. It simply wraps Go's HTTP/2 server which is mostly developed by Brad Fitzpatrick, which in turn relies on Go's crypto libraries (written in Go and assembly). I don't think that's a fa
714.
by pfg 10y ago
This was discussed on HN a couple of months ago[1] when Go fixed a carry propagation bug that affected crypto/tls. [1]: https://news.ycombinator.com/item?id=10897511
715.
by pfg 10y ago
I haven't seen a list yet. A couple of Go community sites have started using it (for obvious reasons). Without having any particular insight, I'd guess the user base consists mostly of early adopters, Go developers and some side-p
716.
by pfg 10y ago
That post is more than a year old. Caddy has since had more than 70 contributors and > 1K commits. Based on my experience, replacing nginx (in my case acting as a fairly simple reverse proxy for rails) with Caddy wasn't significantl
717.
by pfg 10y ago
If you're stuck on a OpenSSL version without ALPN, and don't want to deal with upgrading OpenSSL (or rather statically linking your web server to a newer release), consider using caddy[1]. It's a HTTP/2 web server writte
718.
by pfg 10y ago
You can work around that fairly easily by having a permanent redirect (HTTP 301) for /.well-known/acme-challenge/* to a dedicated validation server (which might just be certbot in HTTP-01 standalone mode).
719.
by pfg 10y ago
HTTP-01 verification works quite well behind load balancers - it's a simple GET request to a specific URL. You're probably thinking of TLS-SNI-01, which requires changes on the host that's terminating TLS (which isn't po
720.
by pfg 10y ago
This blog post[1] explains the motivation behind the name change (and moving the project to the EFF). [1]: https://letsencrypt.org/2016/03/09/le-client-new-home.html

More ›