regecks

9 ms·

31.
by regecks 6y ago
(June 2020) I like client certificates, for all the reasons stated in the article. I have recently used them to authenticate API/RPC access for some IoT-ish devices. They work great. Setting up nginx to proxy things through to the back
32.
by regecks 6y ago
>but it's very much secondary in importance when compared to the backup solution being bulletproof To an extent, anyway. I moved to Borgmatic precisely because the restore speed on Tarsnap made it unsuitable for my needs. Unfortunat
33.
by regecks 6y ago
The server admin also has the choice to defer that to at least 2020-07-01, if they configure their ACME client to prefer the legacy chain.
34.
by regecks 6y ago
Not really. Twitch has been sending in-m3u8-playlist ad segments to clients like Streamlink for long a while now. Streamlink's workaround is to avoid playing pre-roll ads by sniffing for SCTE35 segments in the playlist. However, you ca
35.
by regecks 6y ago
ECDSA has some bad footguns as well. I don't see why you'd consider ECDSA to be any more robust than RSA if we're talking about certificates keys for TLS. EdDSA is better, but is in general not yet supported in the WebPKI (br
36.
by regecks 6y ago
I initially disliked the article as well, but I think it makes a fair point about misuse-resistant libraries. Or as you put it, "correct vetted tools". Where are all the secure hybrid RSA schemes? I use RSA-OAEP for tiny messages
37.
by regecks 6y ago
>Plus, that doesn't fix the problem of other certificates expiring, only extends it. Although I agree fully on the sketchiness part, installing the root is a fix. ISRG Root X1 expires in 2035. Not one of these problematic Android de
38.
by regecks 6y ago
ZeroSSL is operated by Sectigo (Comodo). It works fine with Certbot and should work fine with any ACME client. I did run into some random 503s occasionally, but that was pretty soon after it was launched. Maybe just a few teething issues.
39.
by regecks 6y ago
Nothing so drastic; I often find that Debian/Ubuntu VPS servers do not come with rsync preinstalled.
40.
by regecks 6y ago
Me too. I've uploaded the same website to pretty much every static host listed, and anecdotally, Vercel seems to get me pages noticeably faster. I'd love to know whether that's because of my specific geography and whether it
41.
by regecks 6y ago
I believe it inherits the same pruning behavior of Borg itself. I don't know the architecture of Borg storage too closely, but I assume that since it is all end-to-end encrypted, Borgbase cannot do the pruning for you. If you use appen
42.
by regecks 6y ago
As pointed out in other comments, it's not the case. It's deprecating an insecure way to use RSA keys to perform crypto operations. RSA keys themselves continue to be secure.
43.
by regecks 6y ago
After many years, I moved from tarsnap to Borg as well (hosted with borgbase.com). It wasn't about price for me either. On the few occasions I actually had to restore some files, Tarsnap was glacially slow. That made me nervous if I ev
44.
by regecks 6y ago
To be clear on the facts, Let's Encrypt hasn't shut down ACMEv1 (yet). Accounts with domains which were already renewing via ACMEv1 can continue to do so, until June 2021. Only new domains are shut out. To me, seems fair enough. I
45.
by regecks 6y ago
Thank you! How recently was this change made? I could still do it in 2018, but I wasn't able to do it just now. As you say, no signature on the message, which makes my DMARC record do something useful. That's really great, a huge
46.
by regecks 6y ago
You can do the same thing with Fastmail. Completely indistinguishable from a legitimate email - all signatures look exactly the same. Any user can impersonate any other user. Not considered a vulnerability. What's especially frustratin
47.
by regecks 6y ago
No guarantees either way - Google Code was alive and kicking, until it suddenly wasn't. I do appreciate how easy git and other dvcs make it to mirror repositories, though. I find myself using Github mirrors of projects that are otherwi
48.
by regecks 6y ago
I think it's an interplay between system clock skew, Chromium's SCT validation implementation, and (very) recently issued certificates (which are backdated by 1 hour). It's a bit of a heisenbug but it's occasionally repo
49.
by regecks 6y ago
In HTTP/2, because all the streams are muxed over a single TCP connection, packet loss really screws things up - every stream grinds to a halt. It is worse than HTTP/1.x in that case. I observed it myself when Fastmail was having
50.
Let's Encrypt revokes 3M certificates due to CAA checking bug(letsencrypt.org)
11 points by regecks 7y ago|1 comments
51.
by regecks 7y ago
>these will typically never have a cert so important that it can't be easily revoked I think this is specifically addressed with the introduction of TLS Delegated Credentials[1]. This allows the CDN edge to use a very short lived cr
52.
by regecks 7y ago
I tried running Go HTTP servers bare to the internet (after Cloudflare promoted doing so in a blog post), but went back to using a reverse proxy the next time. The main benefit seems to be convenience. I can upgrade and graceful-restart ngi
53.
by regecks 7y ago
>What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure? I was running node_exporter, which exports a lot of detailed network info from my kernel to Promet
54.
by regecks 7y ago
I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our
55.
by regecks 7y ago
6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and the
56.
by regecks 7y ago
Where does the authorization token come from? I notice it appears in quite a few projects on e.g. GitHub. https://github.com/zedeus/nitter/blob/8836cf51e8a6b385e1ac0a... The project is cool. The de-crapified
57.
by regecks 7y ago
Certbot, and most other standalone ACME clients, are just stop-gaps. The end game is first-party support for automatic HTTPS in all web (and other) servers. It is happening (e.g. mod_md), it's just going to take time. For example, to
58.
by regecks 7y ago
Also https://lists.zx2c4.com/pipermail/wireguard/2019-December/00...
59.
by regecks 7y ago
Oh, neat. I've been wanting to do something like that, but I was afraid that the combination of LXC + Docker would blow up due to networking or cgroups or something. Are you running Docker and LXC containers side by side? Any documenta
60.
by regecks 7y ago
I run it on a single node to run LXC guests for all sorts of non-production workloads. That it takes care of all the networking, storage, OS templates, backups, KVM access and has a comprehensive web UI is all very useful to me. What else i

More ›