Earlier quoted context omitted.
Lookup the Tailnet Lock feature.
A feature in the client software they control, that you run as root, that auto-updates regularly?
[deleted]
Stop Breaking TLS
171–175 of 175 posts
Re: Stop Breaking TLS
#172Earlier quoted context omitted.
Aren’t most TLS implementations still using things like OpenSSL in userspace? How would the kernel get access to the request?
A process with kernel level permissions can patch into userspace process an intercept calls. For example https://github.com/SebastienWae/sslsnoop
You’ve still gotta do that for every TLS library used then. There’s a finite list of them of course, but it’s more than just a few.
Re: Stop Breaking TLS
#173Re: Stop Breaking TLS
#174Earlier quoted context omitted.
How is that not a MITM? Just because it's the modern day CryptoAG?
Because it’s not an attack but rather a voluntary infrastructure choice by a company. We don’t say that Varnish is a MITM because it’s in front of my application, because it’s intentional and under my control. Misusing the term muddies the topic rather than adding clarity, and while there’s a very useful discussion about centralization or why Cloudflare’s most stringent customers might want to deploy their Keyless SS…
Yes, but Cloudflare is not under your control, that's the point.
Re: Stop Breaking TLS
#175Earlier quoted context omitted.
Do you have an alternative, potentially one that's less centralised or private or in bed with three-letter agencies? I ask because my last infra was probed for vulnerabilities hundreds of times per day; putting Cloudflare in front with some blocked countries and their captchas brought the attempted attacks down to a few dozen per month .
I mean, is doing your own geo blocking actually a blocker for you?
Okay, but wouldn't that be based on IP ranges assigned to a country? How do you mimic their modelling of threat levels? I'm not sure, really, maybe F/LOSS has an equally good solution for small businesses.