Viewing profile — ivanr

You could argue that it was designed by one guy (Kipp Hickman) in three months: https://www.feistyduck.com/newsletter/issue_131_the_legend_o...

More context: https://www.recall.ai/blog/postgres-listen-notify-does-not-s...

Spoiler: They're not identical.

No, DNSSEC can enforce strong cryptographic validation _today_. Here's how: 1. Configure a CAA record that restricts issuance to two CAs that support locking down issuance to speci…

Ah, sorry, I should have referenced this sibling comment: https://news.ycombinator.com/item?id=47403528 EKR is https://educatedguesswork.org/about/

I'll share a couple of thoughts, but do read EKR's blog first: - Web PKI is inherently insecure and can't be fixed on its own. The root problem is that the CAs we "trust" can issue…

Maybe you're onto something, but in what way do you think that TLS is not serving other protocols? Personally, I think we have a bigger problem on the PKI side, where Web PKI is ve…

If you like this sort of thing, perhaps you'll enjoy my SSL/TLS and PKI history where I track a variety of ecosystem events starting with the creation of SSL in 1994: https://www.f…

Yes, there is! After I left SSL Labs, I built Hardenize, which was an attempt to go wider and handle more of network configuration, not just TLS and PKI. It covers a range of stand…

Thanks! Sadly, SSL Labs doesn't appear to be actively maintained. I've noticed increasing gaps in its coverage and inspection quality. I left quite a while ago (2016) and can't inf…

I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already familiar with ECH and it…

As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yes…

I wrote about OpenSSL's performance regressions in the December issue of Feisty Duck's cryptography newsletter [1]. In addition to Alex's and Paul's talk on Python cryptography, at…

Because "everybody uses RC4" (the sibling comment from dchest is correct). There was a lot of bad cryptography in that period and not a lot of desire to improve. The cleanup only r…

> > transactional enqueueing > But it is safe as long as it's done inside a DBOS workflow. Yes, but I was talking about the point at which a new workflow is created. If my transact…

> versioning Here's an example of a common long-running workflow: SaaS trials. Upon trial start, create a workflow to send the customer onboarding messages, possibly inspecting the…

Hello Peter. Thank you for your work. I really like this approach. I too have been following Temporal and I like it, but I don't think it's a good match for simpler systems. I've b…

+1 Absolutely. (Source: Original author of ModSecurity.)

I have a bunch of useful resources, most of which are free: - If you're looking for a concise (yet complete) guide: https://www.feistyduck.com/library/bulletproof-tls-guide/ - Open…

In what way does DoH provide end-to-end security? It doesn't, unless you adopt a different definition of "end-to-end" where the "server end" is an entity that's different from the …

Those two don't really compete. DNSSEC provides authenticity/integrity without privacy and DoH does exactly the opposite. If anything, you need both in order to secure DNS.

Your comment doesn't match what's written on the very page you quote: https://upcloud.com/fair-transfer-policy > Even if you exceed your monthly share, don’t worry, there are no ex…

> "Although the chance of a collision is extremely low because the random value has at least 150 bits of entropy, there is still a chance." I am... speechless. I mean... Um. The la…