11–20 of 43 posts
This is probably a stupid question, but what exactly is the distinction here? Why can't we just think of the "asynchronous messaging" email-equivalent as long, drawn-out synchronous OTR communication?
(Or, how to better organise a discreet relationship with the Director of the CIA.) from https://github.com/agl/pond (the source) is a good elevator pitch, for people (like me) who are taking their time getting what this is. also, is code like this https://github.com/agl/pond/blob/master/server/server.go#L15... just extreme defensive programming? or is there some other reason for the check (eg is not everything locked…
That's checking for integer overflow - an often-overlooked source of many security vulnerabilities.
That's a signed integer though, and I don't know if signed integer overflow has defined behavior in Go. In C that would be undefined behavior, allowing the compiler to do potentially nutty things, so you would want to do the overflow check before the increment. (Edit: considering who the author of this code is, I would assume that Go has sane defined behavior on signed integer overflow ;-)
Secure Connection Failed
An error occurred during a connection to pond.imperialviolet.org.
Peer attempted old style (potentially vulnerable) handshake.
(Error code: ssl_error_unsafe_negotiation)
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.(Or, how to better organise a discreet relationship with the Director of the CIA.) from https://github.com/agl/pond (the source) is a good elevator pitch, for people (like me) who are taking their time getting what this is. also, is code like this https://github.com/agl/pond/blob/master/server/server.go#L15... just extreme defensive programming? or is there some other reason for the check (eg is not everything locked…
> also, is code like this https://github.com/agl/pond/blob/master/server/server.go#L15... just extreme defensive programming? or is there some other reason for the check (eg is not everything locked)? That's checking for integer overflow - an often-overlooked source of many security vulnerabilities. That's a signed integer though, and I don't know if signed integer overflow has defined behavior in Go. In C that would…
"For signed integers, the operations +, -, *, and
func main() {
var foo int8 = 127
fmt.Println(foo + 1)
}
Earlier quoted context omitted.
> also, is code like this https://github.com/agl/pond/blob/master/server/server.go#L15... just extreme defensive programming? or is there some other reason for the check (eg is not everything locked)? That's checking for integer overflow - an often-overlooked source of many security vulnerabilities. That's a signed integer though, and I don't know if signed integer overflow has defined behavior in Go. In C that would…
From the Go language spec: "For signed integers, the operations +, -, *, and func main() { var foo int8 = 127 fmt.Println(foo + 1) } prints -128
Looking at the spec, I see that signed integers are elsewhere defined to be represented using 2's complement, so this is completely kosher.
> For secure, synchronous communication we have OTR and, when run over Tor, this is pretty good. But while we have secure asynchronous messaging in the form of PGP email, it's not forward secure and it gratuitously leaks traffic information. This is probably a stupid question, but what exactly is the distinction here? Why can't we just think of the "asynchronous messaging" email-equivalent as long, drawn-out synchron…
I don't know about you people but I can't access this site in latest firefox: Secure Connection Failed An error occurred during a connection to pond.imperialviolet.org. Peer attempted old style (potentially vulnerable) handshake. (Error code: ssl_error_unsafe_negotiation) The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website own…
https://www.ssllabs.com/ssltest/analyze.html?d=pond.imperial...
https://wiki.mozilla.org/Security:Renegotiation
https://community.qualys.com/blogs/securitylabs/2010/10/06/d...
If you set security.ssl.require_safe_negotiation to false in about:config you should be able to establish a connection.
[1] Edit: actually it's not; the parent poster had tweaked settings in about:config ;-)
I don't know about you people but I can't access this site in latest firefox: Secure Connection Failed An error occurred during a connection to pond.imperialviolet.org. Peer attempted old style (potentially vulnerable) handshake. (Error code: ssl_error_unsafe_negotiation) The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website own…
This is kind of ironic considering it's Adam Langley's website, but it appears his server is not indicating that it supports secure renegotiation, and apparently in the latest Firefox that's grounds to refuse a connection[1]. See: https://www.ssllabs.com/ssltest/analyze.html?d=pond.imperial... https://wiki.mozilla.org/Security:Renegotiation https://community.qualys.com/blogs/securitylabs/2010/10/06/d... If you set se…
All this week this was the first website to fail because of that.
It works with it set to false.
I don't know about you people but I can't access this site in latest firefox: Secure Connection Failed An error occurred during a connection to pond.imperialviolet.org. Peer attempted old style (potentially vulnerable) handshake. (Error code: ssl_error_unsafe_negotiation) The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website own…
This is kind of ironic considering it's Adam Langley's website, but it appears his server is not indicating that it supports secure renegotiation, and apparently in the latest Firefox that's grounds to refuse a connection[1]. See: https://www.ssllabs.com/ssltest/analyze.html?d=pond.imperial... https://wiki.mozilla.org/Security:Renegotiation https://community.qualys.com/blogs/securitylabs/2010/10/06/d... If you set se…
(The TLS stack doesn't support renegotiation at all, so it's not vulnerable, but a client can't know that unless it echos the extension in question.)
Earlier quoted context omitted.
This is kind of ironic considering it's Adam Langley's website, but it appears his server is not indicating that it supports secure renegotiation, and apparently in the latest Firefox that's grounds to refuse a connection[1]. See: https://www.ssllabs.com/ssltest/analyze.html?d=pond.imperial... https://wiki.mozilla.org/Security:Renegotiation https://community.qualys.com/blogs/securitylabs/2010/10/06/d... If you set se…
Good to know. I knew that I needed to do it, but I'll be sure to add support for this prior to Go 1.2. (The TLS stack doesn't support renegotiation at all, so it's not vulnerable, but a client can't know that unless it echos the extension in question.)
As it turns out the latest version of Firefox still connects to servers which don't indicate secure renegotiation; the parent poster caused the problem by mucking around with the TLS settings in about:config.