How's my SSL? • Hacker News Board

Re: How's my SSL?

#81

Post by jasomill » Thu, Jan 09, 2014, 2:50 PM UTC

DiabloD3 wrote: post #66

wiml wrote: post #54

Earlier quoted context omitted.

They ship Apache, but they only ship obsolescent (0.9.8) versions of OpenSSL. So their system Apache is built against OpenSSL 0.9.8y.

Thats rather unfortunate. I think you can use Homebrew to pull in newer stuff, though, but I haven't tried (I don't host stuff on my MBP, I use my Linux workstation for that).

I'm sure you could, but bear in mind that several OS X Server services are built on top of the system Apache and its configuration file structure, so you probably don't want to replace it with a package manager-built version if you rely on any of these services.

On the other hand, it wouldn't be too hard to build and install a version of the SSL module compatible with the system Apache linked against a newer OpenSSL version, however, and I wouldn't expect this to break Apple's services, at least not until you install an update that either breaks binary module compatability or clobbers your tweaked module configuration.

I don't use Homebrew, so I couldn't tell you if it's capable of building modules for the system Apache, but building the SSL module "by hand" for system Apache with Homebrew OpenSSL should be straightforward enough.

Re: How's my SSL?

#82

Post by ivanr » Thu, Jan 09, 2014, 3:25 PM UTC

DorianMarie wrote: post #15

Do you have some stats? I'm interested in the "TLS Compression" part (e.g. can I remove the breach-mitigation-rails gem from my project)

The compression-related issue in the TLS protocol is known as CRIME. BREACH actually applies to HTTP response body compression. So, chances are that you should continue to use the breach-mitigation-rails gem, even if your server does not support compression at the TLS level. (Disclaimer: I am not familiar with this gem; just inferring its purpose from the name.)

Re: How's my SSL?

#83

Post by josho » Thu, Jan 09, 2014, 5:04 PM UTC

DiabloD3 wrote: post #66

wiml wrote: post #54

Earlier quoted context omitted.

They ship Apache, but they only ship obsolescent (0.9.8) versions of OpenSSL. So their system Apache is built against OpenSSL 0.9.8y.

Thats rather unfortunate. I think you can use Homebrew to pull in newer stuff, though, but I haven't tried (I don't host stuff on my MBP, I use my Linux workstation for that).

The point however is that for a few bucks Apple gives me a dead simple GUI to manage a few key services 'that just works'.

If I was inclined to download and compile libraries then I'd clearly be better off running a linux distro for complete control.

Re: How's my SSL?

#84

Post by josho » Thu, Jan 09, 2014, 5:10 PM UTC

tptacek wrote: post #52

josho wrote: post #20

Earlier quoted context omitted.

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

TLS 1.0 is definitely broken; TLS 1.1 introduced explicit per-record IVs for CBC mode.

How is TLS 1.0 broken? All I could find is BEAST, but that seems to be mitigated by client patches.

Interestingly Wkikipedia says that TLS 1.1 and 1.2 only have about 25% adoption on servers. Which is shocking if in fact TLS 1.0 is truly broken.

Re: How's my SSL?

#85

Post by kseistrup » Thu, Jan 09, 2014, 5:24 PM UTC

jlgaddis wrote: post #68

kseistrup wrote: post #55

wget, w3m, lynx, and links are all rated “bad” here… :( Is there any way to improve this?

Those are probably all linked against OpenSSL so that's what you would need to upgrade.

I'll take a look at libssl and libgnutls. Thanks.

Re: How's my SSL?

#86

Post by ToastyMallows » Thu, Jan 09, 2014, 5:33 PM UTC

IvyMike wrote: post #3

Thumbs up on everything here. > Google Chrome 32.0.1700.72 (Official Build 243157) m > OS Windows

I got bad for my Chrome, 31.0.1650.63 m, Windows 7

Re: How's my SSL?

#87

Post by tptacek » Thu, Jan 09, 2014, 6:44 PM UTC

josho wrote: post #84

tptacek wrote: post #52

Earlier quoted context omitted.

TLS 1.0 is definitely broken; TLS 1.1 introduced explicit per-record IVs for CBC mode.

How is TLS 1.0 broken? All I could find is BEAST, but that seems to be mitigated by client patches. Interestingly Wkikipedia says that TLS 1.1 and 1.2 only have about 25% adoption on servers. Which is shocking if in fact TLS 1.0 is truly broken.

TLS 1.0 uses chained IVs, which is a protocol flaw. It also has an explicit protocol alert for decryption failures, which makes error oracle attacks simpler. TLS 1.0 is broken. It isn't catastrophically broken so far as we know now, but nobody should be deliberately preferring it.

Re: How's my SSL?

#88

Post by mcpherrinm » Fri, Jan 10, 2014, 10:08 AM UTC

zurn wrote: post #59

suprgeek wrote: post #49

Very useful Site - Thanks! Reminded me of an old favorite "Shields Up" https://www.grc.com/shieldsup - Great way to quickly test your Router

A router's job is to forward traffic between its multiple interfaces to ensure packets get where they are addressed to go. They generally look like this: http://www.ebay.com/itm/Cisco-CCNA-CCNP-LAB-2500-2501-ROUTER... I think you mean "firewall" or maybe "NAT box".

Trying to take the word "router" away from the typical home all-in-one network appliance is a silly way to waste everyone's time.

Yes, the device on my shelf at home doesn't support BGP, doesn't have any TCAM, and probably falls over with more than 10 routes, and is unlikely to ever have more than the default one. But we call them routers.

The layer 3 switches I work on can do BGP, can do layer 3 routing at hundreds of gigabits per second, but still isn't a router.

Language is flexible, terms aren't strictly used, and I don't think anyone was helped by your "correcting" the grandparent poster.

Re: How's my SSL?

#89

Post by fulafel » Fri, Jan 10, 2014, 3:11 PM UTC

mcpherrinm wrote: post #88

zurn wrote: post #59

Earlier quoted context omitted.

A router's job is to forward traffic between its multiple interfaces to ensure packets get where they are addressed to go. They generally look like this: http://www.ebay.com/itm/Cisco-CCNA-CCNP-LAB-2500-2501-ROUTER... I think you mean "firewall" or maybe "NAT box".

Trying to take the word "router" away from the typical home all-in-one network appliance is a silly way to waste everyone's time. Yes, the device on my shelf at home doesn't support BGP, doesn't have any TCAM, and probably falls over with more than 10 routes, and is unlikely to ever have more than the default one. But we call them routers. The layer 3 switches I work on can do BGP, can do layer 3 routing at hundreds…

A big minus coming from the hijacking of the "router" term is that that people will start thinking that's how internet routing works, and through this newspeak come to tolerate these nat-"routers" and firewalls.

We badly need to get back to end-to-end or we won't be able to deploy new protocols and apps in a few years. Eg it's doubtful if BitTorrent could take off if it was invented today.

Re: How's my SSL?

#90

Post by fulafel » Fri, Jan 10, 2014, 3:17 PM UTC

jtheory wrote: post #63

zurn wrote: post #59

Earlier quoted context omitted.

A router's job is to forward traffic between its multiple interfaces to ensure packets get where they are addressed to go. They generally look like this: http://www.ebay.com/itm/Cisco-CCNA-CCNP-LAB-2500-2501-ROUTER... I think you mean "firewall" or maybe "NAT box".

The vast majority of the times I hear the word "router" nowadays, it refers to the box everyone with broadband internet has at home, connecting the internet (via DSL/cable modem) and the home network (via ethernet/wifi). Are you saying that's not a router? I'm pretty sure there are more of those deployed than the big kind.

This is probably the most authoritative source in the Internet context: http://www.ietf.org/rfc/rfc1812.txt

Like the RFC says, routing is forwarding IP packets unmodified. If you mess with the insides of the packets, you're just a no good packet munging middlebox.