451–460 of 463 posts
Earlier quoted context omitted.
There’s little point in encrypting if you’re not authenticating
Which is why ssh is meaningless compared with telnet?
Earlier quoted context omitted.
It's a silly hack, but if you install googles "Suspicious site reporter" extension for chrome, then the chrome address bar retains the full URL all the time.
You can also right click the address bar > "Always show full URLs".
(Who reads those menu entries anyway, at least fully?)
Earlier quoted context omitted.
let's encrypt with *.lan.mydomain.com via DNS validation, installed all over where needed, and annoying to update every 90 days because it's in weird/internal/non-standard places :)
let's encrypt does not like that use case btw. because you would need to validate the cert and store it somewhere and then download it to the specified box, since the service can only be inside an intranet.
Earlier quoted context omitted.
> Shared hosting is awful Depends on your use case. For my use case, I upload a bunch of HTML files via SFTP, and it just keeps working. I don't have to deal with the server software, someone who can dedicate a lot more time does that for me for a nominal cost (because keeping the server for 10000 people updated is only marginally more difficult than me keeping my own server updated). I pay the same or less than I'd…
Can you use Github Pages?
Earlier quoted context omitted.
I don't worry about port scanners. If your infrastructure becomes less secure because of a port scanner, it's not very well secured. Sending a REJECT is cheap, no DDoS opportunity and helps browsers and other apps fail over fast. The recommended practise I've heard everywhere is that an ICMP REJECT provides no opportunities for an attacker they wouldn't have with 10 minutes extra time (modern port scanners can be set…
Yeah, that absolutely makes sense - as I said, a site could also avoid the timeout by sending a TCP RST packet. My point was more that I believe not many sites are doing any of this as in the past, "best-practice" firewall configuration was to be as silent as possible.
Earlier quoted context omitted.
Yeah, that absolutely makes sense - as I said, a site could also avoid the timeout by sending a TCP RST packet. My point was more that I believe not many sites are doing any of this as in the past, "best-practice" firewall configuration was to be as silent as possible.
Being as silent as possible has only two effects; an attacker takes 2 seconds longer and you significantly degrade the network experience of all your users. It hasn't been best-practise in a while (outside the greybeard firewall admin circles), ie, almost a decade at this point. Anyone who hasn't figured that out should really consider not doing network admin if their knowledge is a decade out of date.
I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…
Just host a certificate + private key at a well known location and have all the devices download / update it every month. /s (I'd bet someone has done this).
This is a great instance of https://xkcd.com/1172/ for me. "example.com" is the only domain name I intentionally load over HTTP in Chrome, so this change breaks my workflow. Many for-pay wifi networks (e.g. on airplanes) are designed to intercept all HTTP requests from guest users, redirecting the browser to a login/signup page. Until you log in HTTPS is blocked, so you have to try to open a domain Chrome doesn't rec…
Did you read the blog post? It will now use http if https fails. So http only sites will still work for this.
Earlier quoted context omitted.
And other programs don't?
An instant messaging client shouldn’t be executing arbitrary remote code, no.
Issues like this exist at all layers of the stack, so anything touching the internet needs regular security patches.
Earlier quoted context omitted.
Just host a certificate + private key at a well known location and have all the devices download / update it every month. /s (I'd bet someone has done this).
How do you trust that the devices are allowed to pull down the private key?