I have no idea what I am doing. Is my Digital Ocean - Default Ubuntu based server safe? I know I login via the shell using ssh from my OS-X and DO does not administrate the droplet I guess. Any advice on where I can educate myself?
Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
11–20 of 35 posts
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#12TLS 1.0 was created in 1999, and has approximately 97.7% website support worldwide. The only modern browser that doesn't support TLS 1.0 is IE6. Please, do the public a favor and remove the name "SSL" from your list.
Also, I get that you probably just found out what a cargo cult is, but there's really no purpose in telling people about the phrase; it doesn't help them stay more secure, and it's basically just pop psychology applied to technology. "Current guides for securing your TLS servers" would make a more accurate title.
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#13With the rise of the cloud, now everybody manages a server. I am curious about how many of the admins actually know what are they doing. If I have to speak for myself, I set up my first ssl by following a guide that seemed to written by reasonably well informed stranger. It was my first exposure to the topic so I could not tell what I am doing until I break things and start reading deeper materials so that I can debu…
Yes, that's the exact problem that made me write this. What's particularly amazing is the amount of magical cipher suite strings shared throughout the web, most of which do not take in account PFS, or still prioritize RC4. All of that was acceptable at some point in time. Other cipher lists just don't make any sense at all, e.g. first removing a cipher (-RC4), then killing it (!RC4), all in one string with no benefit…
Thanks for writing this post, I've bookmarked it for reading later as it has plenty of links and I can see I have a lot more reading to do.
If you edit or update your post, I hope you will Mozilla's excellent "Security/Server Side TLS" page at https://wiki.mozilla.org/Security/Server_Side_TLS. This helped me get up to speed quickly and provided clear examples.
As proof of how good the Mozilla docs are, I tested my personal website using the Qualys test you mention and received an A+ rating!
This beat the A- rating for your site (though I freely admit I'm a total noob in this area - I'm copy/pasting and don't understand much about SSL). I guess this reinforces your point that good documentation is critical, and I hope more people find it at the Mozilla site.
https://www.ssllabs.com/ssltest/analyze.html?d=tombrossman.c...
https://www.ssllabs.com/ssltest/analyze.html?d=daniel.molken...
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#14Earlier quoted context omitted.
Yes, that's the exact problem that made me write this. What's particularly amazing is the amount of magical cipher suite strings shared throughout the web, most of which do not take in account PFS, or still prioritize RC4. All of that was acceptable at some point in time. Other cipher lists just don't make any sense at all, e.g. first removing a cipher (-RC4), then killing it (!RC4), all in one string with no benefit…
Thanks for writing this post, I've bookmarked it for reading later as it has plenty of links and I can see I have a lot more reading to do. If you edit or update your post, I hope you will Mozilla's excellent "Security/Server Side TLS" page at https://wiki.mozilla.org/Security/Server_Side_TLS . This helped me get up to speed quickly and provided clear examples. As proof of how good the Mozilla docs are, I tested my p…
That's an excellent reference with good explanations. I'll add it to the list to get away from the strong Ivan bias :-). The reason why I had A- only is that my openssl (Debian) doesn't seem provide all the ciphers required.
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#15Earlier quoted context omitted.
A lot of sys admins are there by default. I would consider myself one of these - I would love to be able off load this work onto someone else who knows more than me, but there just isn't anyone.
Essentially this comes down to pressuring distros and server vendors do their homework finally ship with good examples/defaults. E.g. Microsoft IIS (!) has OCSP stapling enabled by default since ages. Apache? Most people still run 2.2, which isn't capable of OCSP stapling at all. Nginx is in a similar position. That said, the more sysadmins rely on rotten well-proven "Enterprise Linuxes" and "LTS" versions with old l…
> knowing your (Open)SSL setup is as important as e.g. knowing your RoR setup
Very true, and yet it's so much harder to know your OpenSSL or other security-related setup.
You learn your Rails setup well enough to make your application work, and hopefully well enough to make it performant. If you miss either of those goals, it's obvious to you. You know something's broken, and you grind away until you fix it.
Not so with security. Your system can be "working" by all outward appearances yet be riddled with vulnerabilities. And you won't know it, so you won't see any reason to go and learn more. Nor would you know what you don't know, or where you need to learn more. That's the scary part.
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#16TLS 1.0 was created in 1999, and has approximately 97.7% website support worldwide. The only modern browser that doesn't support TLS 1.0 is IE6. Please, do the public a favor and remove the name "SSL" from your list. Also, I get that you probably just found out what a cargo cult is, but there's really no purpose in telling people about the phrase; it doesn't help them stay more secure, and it's basically just pop psy…
About the Cargo Cult thing: Fair enough. I'm not a native speaker myself, but thought that it may be a well-enough-known idiom.
Anyway, SSL is still what people know it under (plus, according to Wikipedia, TLS support was only added in Java 7, and there are still many Java 6 setups around which have to put up with SSL 3). So I'll stick with SSL/TLS for the time being.
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#17Following incorrect guidelines is "cargo cult" now? Or are the guidelines themselves cargo cult? I'm confused.
All "cargo cult" means is that you're doing something associated with an outcome that you want, rather than understanding the mechanism by which what you're doing would lead to the desired outcome.
A common example: towns that have a lot of tourists have a lot of parking. Therefore if we tear down buildings to make more parking lots, we'll increase tourism!
I'm pretty sure that what 99.9% of developers (including me) are doing with SSL is cargo cult.
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#18With the rise of the cloud, now everybody manages a server. I am curious about how many of the admins actually know what are they doing. If I have to speak for myself, I set up my first ssl by following a guide that seemed to written by reasonably well informed stranger. It was my first exposure to the topic so I could not tell what I am doing until I break things and start reading deeper materials so that I can debu…
Yes, that's the exact problem that made me write this. What's particularly amazing is the amount of magical cipher suite strings shared throughout the web, most of which do not take in account PFS, or still prioritize RC4. All of that was acceptable at some point in time. Other cipher lists just don't make any sense at all, e.g. first removing a cipher (-RC4), then killing it (!RC4), all in one string with no benefit…
A very nice python script to check your server configuration: https://github.com/iSECPartners/sslyze
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#19I don't think this article is really helpful at all. The author attacks blog posts that state the current best-practices, but then goes on to recommend several books that are even more out of date than the blog posts. (Some of the books are 'theory' books and so presumably remain 'current' for longer, but not all of them). Second, instead of allowing sysadmins to find and follow simple, well-researched best-practices…
Just to be clear, my books mentioned in the blog post (Bulletproof SSL and TLS and OpenSSL Cookbook) are most certainly not out of date. In fact, they are a rare example of books that are continuously maintained. I pledged to maintain them for as long as there are people interested in reading them!
Re: Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection
#20Earlier quoted context omitted.
Yes, that's the exact problem that made me write this. What's particularly amazing is the amount of magical cipher suite strings shared throughout the web, most of which do not take in account PFS, or still prioritize RC4. All of that was acceptable at some point in time. Other cipher lists just don't make any sense at all, e.g. first removing a cipher (-RC4), then killing it (!RC4), all in one string with no benefit…
A very nice python script to check your server configuration: https://github.com/iSECPartners/sslyze
Thanks, added!