151–160 of 165 posts
Earlier quoted context omitted.
Isn't everything forced to https now
Browsers try to navigate you to HTTPS but no, http the protocol is still working as it always has. Both nginx and Apache will require configuration to serve HTTPS. You might still use HTTP on an internal network in a DMZ or other trusted network.
Earlier quoted context omitted.
It's done for speed. Straightforward text replacement is so much faster than checking to see if a path is properly terminated by a slash. And remember that Nginx became popular due to benchmarks that showed that it was more "web scale" than Apache2.
Your comment makes nginx sound like some fly-by-night server that only achieved its performance by making lots of tiny-yet-dangerous "optimisations" like this one. More likely it is an omission, which could be rectified with a warning or failure running nginx -t (verify configuration). The actual performance comes from an architectural choice between event vs process based servers, as detailed in the C10k problem art…
FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)
I just gave nix a go and so far it seems great. But do you know, if they’re a nicer options finder? The one I found where you just search all several thousand options kinda sucks. I want to just see my package (say, ssh) and just the ssh options, but the results get littered with irrelevancy.
Earlier quoted context omitted.
The default for new Bitwarden accounts from Feb 2023 on is PDBFK2 HMAC SHA 256 setting at 600,001 iterations on the client and 100,000 on the server with the option to use Argon2id. These settings are above current OWASP recommendations. https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor... https://bitwarden.com/help/kdf-algorithms/
All the replies have given random statistics, but these don't shed much light on the length of time it may take an attacker to brute-force a password, or find a chink in the armor of the vault's encryption algorithm. Now as I said, a significant threat actor with lots of time in their future plans can collect encrypted stuff such as vaults and bide their time. Someday, the decryption may be cost-effectively cheap. So…
If the concern is general encryption when you were concerned about a 20 year from now scenario, don’t send it.
If all you need is a simple way to serve static files that minimizes resource consumption and is reliably secure, what is the state of the art these days? In the past I would probably reach for Nginx, but I wonder if a more focused/less configurable tool would be preferable from a security standpoint.
I use https://static-web-server.net/ Cross-platform, written in Rust, straightforward configuration, secure defaults, also has a hardened container image and a hardened NixOS module. I wouldn't recommend Caddy. Their official docker image runs as root by default [1], and they don't provide a properly sandboxed systemd unit file [2]. [1]: https://github.com/caddyserver/caddy-docker/issues/104 [2]: https://github.com/c…
Earlier quoted context omitted.
I use https://static-web-server.net/ Cross-platform, written in Rust, straightforward configuration, secure defaults, also has a hardened container image and a hardened NixOS module. I wouldn't recommend Caddy. Their official docker image runs as root by default [1], and they don't provide a properly sandboxed systemd unit file [2]. [1]: https://github.com/caddyserver/caddy-docker/issues/104 [2]: https://github.com/c…
What's wrong with the unit file?
Earlier quoted context omitted.
I use https://static-web-server.net/ Cross-platform, written in Rust, straightforward configuration, secure defaults, also has a hardened container image and a hardened NixOS module. I wouldn't recommend Caddy. Their official docker image runs as root by default [1], and they don't provide a properly sandboxed systemd unit file [2]. [1]: https://github.com/caddyserver/caddy-docker/issues/104 [2]: https://github.com/c…
If you want a sandboxed unit file, why not just sandbox it yourself?
Besides, we should be creating and using software that is secure by default: https://www.cisa.gov/sites/default/files/2023-06/principles_...
FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)
If a webserver requires additional tools for the user to avoid all these pitfalls, maybe just maybe it should re-evaluate its defaults.
nginx was once amazing, but it’s decidedly bad now when compared to modern webservers.
Earlier quoted context omitted.
If a webserver requires additional tools for the user to avoid all these pitfalls, maybe just maybe it should re-evaluate its defaults.
But then how will nginx continue to pretend that it is still 1995? nginx was once amazing, but it’s decidedly bad now when compared to modern webservers.
Earlier quoted context omitted.
But then how will nginx continue to pretend that it is still 1995? nginx was once amazing, but it’s decidedly bad now when compared to modern webservers.
What is a modern webserver? I only use Apache or nginx... anything cobbled together with nodejs or go doesn't count.
Among other things, it features automatic TLS via ACME and dead-simple configuration for my most common use cases: namely, serving a directory of static files and reverse-proxying to an app server.
It is written in Go, but I certainly wouldn't describe it as "cobbled together."
I'm also a fan of Traefik but it's strictly a reverse proxy, there's not even built-in support for serving static files. But it's great if you have e.g. a bunch of containers on a single host and you want to front them all with a single load balancer.