211–220 of 255 posts
a) in a sense maybe they thought they were disclosing their private key to a their CA so in a sense it didn't really matter because their CA could issue certificates for their domain anyway (... ignoring certificate transparency/other external verification)
[... we know this is not true and it's mostly people don't know/don't care/it doesn't matter what they are doing in the scheme of things]
Earlier quoted context omitted.
Your argument for guilt by association is not compelling. Cloudflare is their customer. I am Cloudflare’s customer. Does that make me a bad actor too?
Continued usage of Cloudflare baffles me. They spewed tons of private data, across customer boundaries, on random web responses, which made its way into search engine cache around the world. They conducted an act of Internet censorship: https://fightthefuture.org/article/the-new-era-of-corporate-... ..and the CTO who made that decision later backed down and said he wouldn't make that same decision again. O_o I really…
Earlier quoted context omitted.
What they actually had was probably more like: system('openssl req -config /prod/prod-config.cnf -subj "/CN={$DOMAIN}" ....' And whoever wrote that function assumed someone else had sanitized DOMAIN. It looks like a lot more understandable of a mistake when framed like that.
Does it really? Even if the code author hadn't learned to escape/sanitize close to use so it's visible (or to avoid cases where you need to escape/sanitize entirely, like using something that bypasses the shell and takes array arguments), let's look at the manpages. PHP's system() manpage: http://php.net/manual/en/function.system.php [red box] Warning When allowing user-supplied data to be passed to this function, us…
system() style functionality -> should be the hard thing to do execv() style functionality() -> should be the easy thing to do
Earlier quoted context omitted.
Why would they not try to transition their customers to new certs _before_ getting all the old certs revoked though? Seems like suddenly revoking 23k of their customer's certs with only 24 hours notice is just shooting themselves in the foot.
We're using the Symantec/Digicert API for getting certs at work. I'm not directly involved in that, but I think when you want to issue a new cert you have to revoke the old one first. The API will just return an error if there is an existing cert for the same domain name. I recall vividly that when we moved from manually-issued certs (using their website) to automatic issuing (using their API), we had to revoke all c…
Earlier quoted context omitted.
HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing. It would not prevent anyone from examining that content in flight, or altering it. It would allow any such alteration to be identified . It is possible to offer various levels of assurance on unencrypted communications. Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say,…
You cannot have a "trusted hash" if you cannot trust the delivery mechanism (unencrypted and unauthenticated TCP). The content of the delivered payload (your blog and your "trusted hash") can be altered by anyone in transit. When you take unencrypted and unauthenticated TCP and upgrade to encrypted and authenticated TLS, only then can you begin to have trust.
You can have authentication without encryption. This is what PGP signed messages are.
I'll admit it's weird to call a cryptographic signature a "trusted hash", which makes it seem like the author of the post you're responding to doesn't know what they're talking about. But it's totally possible to to have trust without encryption or TLS. TLS isn't even the best protocol for signing out there, as the whole thing depends on CAs being trustworthy (which they aren't).
All that said, if you want trust on the internet, start with HTTPS. Sure, you don't need the encryption for delivering non-secret content, but it's the easiest way to set up trust and the only one non-technical people are likely to verify in any way (because their browser does it for them). It doesn't provide very strong guarantees, but it's better than nothing. If you want more go with PGP.
And the fact that you can use PGP over HTTP doesn't in any way mean that HTTP is secure in general.
Earlier quoted context omitted.
Continued usage of Cloudflare baffles me. They spewed tons of private data, across customer boundaries, on random web responses, which made its way into search engine cache around the world. They conducted an act of Internet censorship: https://fightthefuture.org/article/the-new-era-of-corporate-... ..and the CTO who made that decision later backed down and said he wouldn't make that same decision again. O_o I really…
Keeping nazis off of servers one owns/rents themselves is not censorship.
Earlier quoted context omitted.
We use several CAs to issue—Comodo, DigiCert, GlobalSign—and will be adding Let's Encrypt once they support i) SHA-2/ECDSA signatures and ii) wildcards. Having multiple issuers is important for us as each CA, at some point in time, has operational issues. Additionally, as you've seen with Symantec, browsers take action to distrust certain issuers/roots. When either of these scenarios happens, our customers don't care…
If Cloudflare wants wildcards it's so they can have multiple customers, each using completely different origin servers, on a single certificate, which makes those certificates worthless, and I hope Let's Encrypt blacklists Cloudflare from using them when wildcards are launched.
Earlier quoted context omitted.
Keeping nazis off of servers one owns/rents themselves is not censorship.
How is that not censorship? Their opinions are wrong and disgusting but kicking them as a customer for their beliefs is very obviously censorship.
The fact that American TV networks weren't allowed to say "shithole" in reporting what the US President said is an example of censorship. The FCC, a government agency, requires that they not use certain words. When Fox decided to get rid of O'Reilly that's not censorship that's just basic ability to read how the wind is blowing.