41–50 of 51 posts
The explanation of the Full cipher suite format has some tiny mistakes for the explained case. > Use GCM for the cipher mode > Use SHA256 for message authentication (making sure messages haven't been tampered with) GCM is an AEAD-Mode, it builts upon CTR-Mode, but also provides message authentication. SHA256 is used as a PRF (Pseudo Random Function) to generate key material based on the master secrect. See https://to…
Earlier quoted context omitted.
Edit: added reply to 'vkjv' below as I have hit the comment threshhold and have been unable to reply to this account. Since HN seems to be somewhat unsure of node's concept of IO (why I imagine the downmods) and why it's significantly different to common Python and Ruby setup (Tornado and EventMachine excepted). The main point of nginx is event based, non-blocking IO. That's why traditionally blocking languages (like…
While node.js is great at non-blocking IO, it's not great at the blocking kind. E.g., shuffling bytes. While you are correct that node.js is happily not blocking the main thread while reading from disk, once that returns it still needs to serialize that data from I/O to the request and that is both blocking and slow. I highly advise that you don't use node.js to service static content outside of a development environ…
This is why I'm, to this day, confused about building whole websites on Node. Dynamic, templated web sites are computation intensive (without result caching). Sure you can have N-Nodes running for N cores. This will minimize blocking. I/O for DB is time intensive so Node will pickup other workloads while it waits. So everything averages out, but it still an interesting thing often overlooked.
Earlier quoted context omitted.
Fair enough, I'm not familiar with that service. Running a Node.js application without a reverse proxy in front of it sounds like poor practice though, particularly from a security standpoint.
Do you have any particular security holes in mind that nginx guards which node.js / io.js are open for ?
Whether that's worth it is another question.
Isn't this all better implemented in the nginx/apache server in front of the application? I've just done a very similar thing for my Django hosted website, but didn't touch Python at all for it. Edit: Here's a blog post where I detail the steps to set this up in Nginx - https://news.ycombinator.com/item?id=9256200
Yes, I think is better to put nginx in front to handle this and sooner or later you will need some kind of reverse proxy as soon as your application grows. The reasons might be load balancing or just to map components of your app like "app.com" and "app.com/api" being different applications. One big difference to note is that nginx link to the local openssl while node binaries embeds an openssl. If there is a bug in…
Whoa. Slow down. They have only confirmed replacing their custom configuration language with JavaScript and hinted at an official JavaScript module [1], as opposed to the existing third-party module [2].
Bundling a Node.js-like JavaScript api layer with their official module would be a logical next step, because nginx is an event loop anyway. But, I highly doubt JavaScript will be anywhere near the Nginx core.
[1] http://www.infoworld.com/article/2838008/javascript/nginx-ha...
I kind of wish they wouldn't just hand out an A+ that easily. There are clear areas of improvement that the sub-scores call out (90 in both Key Exchange and Cipher Suite). They see the HSTS and grant the A+ when there is clearly improvement that can be made. In my mind, an A+ should be reserved for an SSL/TLS implementation that cannot reasonably be improved upon given the current state of the industry. To improve yo…
> I'd imagine that 4096 will become the new minimum over the next few years. That's unlikely to happen. 2048-bit RSA provides a security level of ~112 bits, which would physically require a massive amount of energy to break, and it's unlikely that so much energy would ever be expended on a single task. So 2048-bit RSA is only likely to be broken if there's a mathematical breakthrough against RSA. The thing is, such a…
This is a key you get re-signed every 1-3 years. You don't need it to last 10 years, you need it to last maybe a year longer than your SSL cert is actually good for. (Assuming your site is setup to have all the browsers do PFS)
This isn't prioritizing quite the right ciphers. The CBC mode construction in TLS has serious problems (MAC-then-encrypt instead of encrypt-then-MAC) and should be considered cryptographically broken. It's incredibly fragile and difficult to implement correctly. You want to make sure TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is negotiated, at least where browsers support it. (It's spelled "ECDHE-RSA-AES128-GCM-SHA256" in…
Just out of curiosity, why are you proposing that AES 128 is the one to go with? According to SSL Labs AES 256 is preferable and has broad support among browsers.
This isn't prioritizing quite the right ciphers. The CBC mode construction in TLS has serious problems (MAC-then-encrypt instead of encrypt-then-MAC) and should be considered cryptographically broken. It's incredibly fragile and difficult to implement correctly. You want to make sure TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is negotiated, at least where browsers support it. (It's spelled "ECDHE-RSA-AES128-GCM-SHA256" in…
Earlier quoted context omitted.
Do you have any particular security holes in mind that nginx guards which node.js / io.js are open for ?
Separating your TLS server from your app server also shields your app server from leaks in your TLS server. See: Heartbleed.
Earlier quoted context omitted.
Yes, I think is better to put nginx in front to handle this and sooner or later you will need some kind of reverse proxy as soon as your application grows. The reasons might be load balancing or just to map components of your app like "app.com" and "app.com/api" being different applications. One big difference to note is that nginx link to the local openssl while node binaries embeds an openssl. If there is a bug in…
> They are going to support JavaScript soon Whoa. Slow down. They have only confirmed replacing their custom configuration language with JavaScript and hinted at an official JavaScript module [1], as opposed to the existing third-party module [2]. Bundling a Node.js-like JavaScript api layer with their official module would be a logical next step, because nginx is an event loop anyway. But, I highly doubt JavaScript…
Earlier quoted context omitted.
IE6 Must Die. Except for China, IE6 is used by less than 1% of the population around the world, according to Microsoft's own data: https://www.modern.ie/en-us/ie6countdown
Indeed. Locking IE6 out to get an A/A+ on SSL Labs is totally worth it.