Viewing profile — jcase

Thanks. You're right. Now I'm just wondering what IdenTrust gains from free DV certificates.

Acceptance into Mozillaʼs CA Certificate Program is usually discussed in public. Let's encrypt is not on the list of pending CA applications[0]. Does anyone know if they are introd…

Running the openssl s_client command from the article will show you live.

When you mentioned discourse serving 19k req/sec, does it hit the ruby stack at all? If no, serving 19k req/sec of cached HTML doesn't seem that impressive. What am I missing?

You're (almost) describing certificate pinning. Have a look at http://tack.io although it appears down for the moment. Here is the HN thread: https://news.ycombinator.com/item?id=4…

With SSH you usually own both endpoints (or at least trusting your cloud provider). The example you give with regards to exchanging a piece of paper is very similar. It's ridiculou…

This article[0] is largely about DNSSEC and DANE but it might give you some insights why making registrars the sole authorities isn't such a good idea. [0] http://www.thoughtcrime.…

Well, whatever the license, here is to a bright future! That a rising tide may lift all boats.

I'm not sure this is true (anymore?). There are many open source projects who are thriving under non copyleft licenses. If someone wanted to be a dick about it they could release m…

Not sure if you mean for profit and proprietary or just making money in general. For some reason though a lot of people think you can't sell GPL'd software which you absolutely can…

DANE isn't without its own problems. Moxie Marlinspike wrote an excellent blog post about it. http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

If users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start though. Ideally OS/Brow…

Sounds very similar to Convergence. In fact, it turns out that "Convergence is based on previous work from the Perspectives Project at Carnegie Mellon University".[0] I don't think…

Same version, no warning. Edit: Oops, had yet to read that it's now temporarily whitelisted by google.

Interesting, thanks!

When the EU region was announced[1] last month they weren't Safe Harbor compliant (yet). Has that changed? [1] https://blog.heroku.com/archives/2013/4/24/europe-region (near the bo…

For some reason it reminded me of "The Electronic Money Mill". Original site is gone but The Internet Archive has a copy: http://web.archive.org/web/20080412233535/http://www.msen.…

The Luna SA they are using doesn't come cheap. For an H/A setup with all the extras (backup tools, service contract) I was quoted ~$80k.

Automatic failover is a pretty big feature though. I wish Postgres had a built-in solution. Sure, I could use Pacemaker but it's no where near as painless.

It's 72 actually. I thought it was 56 as mentioned on the original [?] BCrypt website[1]. A thread[2] on security/stackexchange discusses a workaround for the 72 char limit. See ht…

Indeed. Chrome has baked-in public key pinning for their services. http://www.imperialviolet.org/2011/05/04/pinning.html

For domain validated certs, certainly. The issue is that it doesn't solve anything. We merely shift (more) responsibility to registrars and NICs. You can change (untrust) registrar…

Actually, I've thought about starting a "real" CA (read: get certified etc). I'm not sure the world needs another one though. Your experience running a homebrew setup is exactly wh…