regecks

23 ms·

181.
by regecks 9y ago
Cloudflare is interesting because they do it even if you don't and have never used their proxy service, just their DNS hosting. I was surprised when they issued certificates for my domains (as well as injecting a tonne of broad CAA r
182.
by regecks 9y ago
I mean, it's kind of overstated to call it rogue. A new feature of Github hosting, sure. It's a pretty common practice to do it automatically in hosting and CDNs. cPanel does it, Cloudflare does it (by themselves adding up to 10-2
183.
by regecks 9y ago
Super fast provided that you're in California ... network latency dominates any other implementation detail.
184.
by regecks 9y ago
They're not containers as in Linux containers, they're "contextual identities" within the same Firefox process, that isolate things like cookies. Much weaker isolation (technologically) than process/user privilege s
185.
by regecks 9y ago
Nice! This is exactly the feature I had been pining for, with Containers already being a core part of my browser experience. Works as advertised. Always pays to open the comments, thanks!
186.
by regecks 9y ago
There are other "security issues" too. One is that you can send email as any other FastMail user, and it won't stop you. SPF passes and DKIM signatures signed (even for other customers' custom domains), totally impossibl
187.
by regecks 9y ago
Had? Have. https://www.trustico.com.au/ssltools/create/csr-pem/create-a... Generated server-side. http://termbin.com/eu4c
188.
by regecks 9y ago
Well, Trustico is a reseller. There's very little to stop them doing anything they want, since they are not subject to CABF regulations. For example, consider this page: https://www.trustico.com.au/ssltools/create&
189.
Mass Trustico/Digicert/RapidSSL certificate revocation(reddit.com)
3 points by regecks 9y ago|0 comments
190.
by regecks 9y ago
DNS, or whois (43/tcp), or the ability to retrieve/fabricate government documents. There are plenty of documented ways that the Web PKI can be subverted.
191.
by regecks 9y ago
They definitely support issuewild now, but annoyingly will inject their own extremely broad CAA records into your zone unless you go into a different UI and hit "Disable Universal SSL" down the bottom of the page, even if you don&
192.
by regecks 9y ago
The problem with dns-01 is that it much of the time, it requires granting far too much privilege to the system that requests the certificate. This is because the great majority of DNS hosts do not provide sufficiently granular permissions t
193.
by regecks 9y ago
An alternative: I run dnscrypt-proxy locally, encrypting (TLS) all my DNS traffic between me and OpenDNS, also giving me the option for my system resolver to give NXDOMAIN for any names on a local blacklist. It was remarkably easy to setup,
194.
by regecks 9y ago
Indeed, I just tried a CDN provider that I recalled allowed custom SNI certs, and was able to deploy a ".acme.invalid" certificate to the global network. It's a real issue for public CDNs, but we can rejoice that Cloudflare a
195.
by regecks 9y ago
New Update, explaining the issue with shared infrastructure and crediting the discovery to Frans Rosén of Detectify: https://community.letsencrypt.org/t/2018-01-09-issue-with-tl...
196.
by regecks 9y ago
Any links to discussions on this topic? Sounds suspiciously like SNI proxies.
197.
by regecks 9y ago
> TLS server to "solve" such a challenge by effectively echoing back the requested SNI value blindly I would be mildly surprised if they pulled tls-sni because of this, since it is basically a client vulnerability, and both htt
198.
by regecks 9y ago
In particular, autocert ( https://godoc.org/golang.org/x/crypto/acme/autocert ) relies on tls-sni and does not support the other DV methods. Hopefully it is not fatal flaw in the design of the method, othe
199.
Let's Encrypt tls-sni-01 disabled due to credible vulnerability report(letsencrypt.status.io)
374 points by regecks 9y ago|84 comments
200.
by regecks 9y ago
What would signed packages have achieved in this incident? Who needs to sign the packages? The developers of the packages, right? Otherwise developer credential compromise subverts the entire point. Which keys are authorized to sign for whi
201.
Issuing SSL certificates for any FastMail.com subdomain(id-rsa.pub)
2 points by regecks 9y ago|0 comments
202.
by regecks 9y ago
Is that less than 3 seconds a production bundle (npm run build)?
203.
by regecks 9y ago
It's pretty much missing or empty data for the entire .au TLD (e.g. even google.com.au is not present). Living here, I know that their whois server rate limits heavily and the ccTLD zonefile is not available, so I'm guessing those
204.
by regecks 9y ago
> So there you have it, folks, definitive proof that expired signing certs do not prevent an app from launching on iOS Hmm. What is the point of notBefore/notAfter constraints if they don't do anything?
205.
by regecks 9y ago
> Could be more general: finding subdomains by watching CT logs. Yep. Can use crt.sh for this on a per domain level, I also wrote ausdomainledger.net as an experiment to index all subdomains in the .au TLD, querying the CT logs directly,
206.
by regecks 9y ago
Genuine question: To what extent is it a second factor if you e.g. have both your password manager and your TOTP secrets on the same device?
207.
by regecks 9y ago
Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redaction. Symantec say they are only submitting these entries to the deneb.ws.symante
208.
by regecks 9y ago
> Sure, as long as you're not using CGO and dynamic linking. Otherwise you'll get the exact same problems as the others. Not even then, to be honest. I wrote a product that is deployed on many thousands of servers, and all of
209.
by regecks 9y ago
A very interesting read. I developed chronic pain after a fairly minor injury (at least, now I can see it was minor) and then proceeded to waste 4 years on diagnosis and physical therapy and exercise that wasn't helping at all. My late
210.
by regecks 9y ago
I would suggest to visitors to Vue to not dive into using something like Vuex unless you really know need it - IMO it's not at all a 'by default' library to bring into a Vue project. Give a try using only props and events. Y

More ›