vtlynch

27 ms·

181.
by vtlynch 11y ago
Ah gotcha! Thanks for clarifying.
182.
by vtlynch 11y ago
Any citation for this claim: "it is expected that shared hosting providers will run the tool for you"? Currently SSL is a revenue stream for many shared hosting providers. Are there are on-record comments from major providers who
183.
by vtlynch 11y ago
So you don't have to run the Let's Encrypt client? I was under the impression you did because without running the client there was no way to communicate with the Let's Encrypt service? Or do you mean, you can have multiple se
184.
by vtlynch 11y ago
Thats what I originally assumed. Self-signed is not regulated and therefore was not coerced into the 2048-bit key transition.
185.
by vtlynch 11y ago
They aren't. Not to be rude, but aosmith is almost certainly wrong about what "Public/Private" means in this context. I have never seen a situation where the public and private key vary in length like that. It would also
186.
by vtlynch 11y ago
Yes I am aware of key pairs. But my understanding is that RSA key pairs are often (and unless im mistaken, required to be) the same number of bits.
187.
by vtlynch 11y ago
"Public" and "Private" denotes if its an internal/external server?
188.
by vtlynch 11y ago
If anyone needs help or has questions about SSL, please ask! I work at a company that provides SSL and would also be happy to give out discounts to anyone here.
189.
by vtlynch 11y ago
Not sure how one of the largest sites on the internet with intensive bandwidth successfully implementing encryption is anecdotal. Performance drop or not, they implemented it because they find the benefits to outweigh the costs. Netflix, an
190.
by vtlynch 11y ago
Except even Netflix has recently announced they are going to be performing "Full Body" encryption on their video streams and that it was financially worth it for them to do so. You can make value based arguments for/against p
191.
by vtlynch 12y ago
Correct. This all comes down to what the CAs order processing allows. Sometimes they can change things. Sometimes they cant. Somethings they say they cant because its a pain for them to change it.
192.
by vtlynch 12y ago
Agreed. SSL is a pain to set up and its hard to get right. But in my (limited) experience, SSL is simple compared to other aspects of your network's security. "At rest" data storage, network intrusions, DDOS attacks, etc, all
193.
by vtlynch 12y ago
This comment is a gem. Its not good. But its a gem.
194.
by vtlynch 12y ago
Use SSLLabs.com for diagnostics.
195.
by vtlynch 12y ago
Well one of the problems is that SSL does two things: Server Authentication and Encryption. Since there is nothing backing the identity of a self-signed certificate, it can easily masquerade as whatever it wants. Yes, a CA-issued cert and a
196.
by vtlynch 12y ago
I agree that the original article should be updated. The delay seems to be due to some "late-breaking chain building bugs": https://twitter.com/sleevi_/status/585429689646260224 This older Twitter thread
197.
by vtlynch 12y ago
Yes, I agree,Its not ideal. But I follow the industry very closely and I trust that Google's team is working on it and nearing some major improvements.
198.
by vtlynch 12y ago
If they are going to show a green padlock, the connection needs to be reasonably secure, because the icon is supposed to indicate as such. With HTTP there are no icons being shown indicating you are secure, so there should be no expectation
199.
by vtlynch 12y ago
"Obsolete cryptography" does NOT refer to SHA-1. It refers to using old cipher suites which are not viewed as secure. One of the security team engineers also acknowledged that this is an unclear warning and that they are working o
200.
by vtlynch 12y ago
what about the consequences of "streamlining" all these activities? We will create tons of disposable, one-purpose devices to add "convenience" to our life?
201.
by vtlynch 12y ago
Wow you are right! It sounds so convenient when you manufacture a description to make it sound like we are currently going through 9 arduous steps instead of opening a website!
202.
by vtlynch 12y ago
In my experience the biggest hurdles to implementing SSL are: advertising networks, dependencies (such as internal systems or APIs) that are incompatible, policy of providers (such as Akamai implementing fees far above the actual cost of SS
203.
by vtlynch 12y ago
Hmm, not sure if I totally agree. Superfish was certainly a huge abuse of the trust network. However, if we look at other recent SSL vulnerabilities: Heartbleed, POODLE, FREAK - most of these are all dealing with flaws in the encryption (so
204.
by vtlynch 12y ago
While I certainly don't love the CA system, this isnt where I see the biggest flaws with SSL. Regardless of who is "trusted", the true critical points are in the Private Key and the Cryptographic primitives. Fixing the CA mod
205.
by vtlynch 12y ago
Yup, hard not to see it this way.
206.
by vtlynch 12y ago
Uber is so unbelievably horrible. It should not be the solution to anything.
207.
by vtlynch 12y ago
Is there a difference when it comes to Bitcoin that makes it unique? In your example the majority of gold exchanges are regulated, arent they (if not, lets use a stock exchange as an example instead)? In that situation the bad actor is unre
208.
by vtlynch 12y ago
depression. fear. uncertainty. lack of time. stress.
209.
by vtlynch 12y ago
Certainly GMOs can be bad, such as crops that are "roundup ready". Others, like Innate Potatoes (that NPR recently did a story on), can be good. However there is not conclusive evidence on GMOs such as the Innate that prove they d
210.
by vtlynch 12y ago
Yeah you probably prefer professional idiot Thomas Friedman

More ›