101–110 of 188 posts
Earlier quoted context omitted.
"Not surprisingly, it wasn't worth my time," says the guy conducting multiple conversations in the comments section of an article on the internet that he didn't agree with.
Says the person arguing with said guy. Did you have a point other than that you think you're better-qualified to judge how I use my time than I am?
Earlier quoted context omitted.
Woah - have you never heard the phrase "pay peanuts, get monkeys"? Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? It's a little sinister to bring race into this at all - I don't think anyone else went remotely near that connotation until you brought it up.
> have you never heard the phrase "pay peanuts, get monkeys"? No. I'm familiar with the idiom of "peanuts" meaning little money, monkeys have never been mentioned. In the modern American cultural context, monkeys are associated with bananas. Peanuts are associated with elephants. > Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? I don't care what people call…
I'm getting a certificate warning on Chrome 33.0.1750.152. Is there a security corollary to Muphry's law?[1] [1] - http://en.wikipedia.org/wiki/Muphry's_law
This might be intended. Supporting SSL is better than not supporting it (well, except in situations where an OpenSSL bug could leak your server's memory, but that's a bit of a stretch " rel="nofollow">http://filippo.io/Heartbleed/#www.peereboom.us> -- but put this aside), because it's always better to encrypt traffic even in a way vulnerable to passive attacks; and some people may reasonably opt-out of the SSL CA bus…
They charge $25 to do the right thing and revoke your cert. So I will not use them again.
Edit: Btw. That's per fucking subdomain, as you don't get wildcard certs for free.
Going back to self signed I guess...
I've done quite a bit of programming with the OpenSSL library and this article is only scratching the surface of the awfulness. Documentation is horrible to non-existent, you really do need to go spelunking into the source to figure out how things work, and the code really is that horrible. The worst thing is that error reporting is not consistent - sometimes -1 means error, other times 0 means error, other times 0 m…
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
The semi-official reason though is that OpenSSL doesn’t offer API compatibility between versions.
Earlier quoted context omitted.
I'd trusts self-signed certs ahead of most CAs, frankly.
That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.
Earlier quoted context omitted.
That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.
Trusting myself with out-of-band verification rather than trusting a third-party to do out-of-band verification is more trustworthy. If you do not trust yourself to do it, why do you trust that the third-party would?
I don't think that is what the parent was saying, however, in saying he would trust a self-signed cert. I don't think he meant "Call up the website host and ask for them to verify their public key"
Earlier quoted context omitted.
I'd trusts self-signed certs ahead of most CAs, frankly.
That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.
Besides, having the third party CA signature in this day and age doesn't tell me much other than the person presenting the cert coughed up whatever protection money the particular face of the PKI protection racket demands, and ostensibly the CA did some level of verification (could be more, could be less, I honestly do not know or have time to find out) as to the "identity" of the person who's info is on the CSR.
Really, for your own uses, you're better off self signing with your own CA, noting down the identifying information of the cert at generation time, and then installing that cert as trusted either ahead of time, or hitting it from the third party and double checking the information matches up.
Earlier quoted context omitted.
I'd trusts self-signed certs ahead of most CAs, frankly.
That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.