Elrond elrond@identi.ca
GNU MediaGoblin at 2015-07-04T16:19:21Z
MediaGoblin July 2015 meeting, happening now in #mediagoblin on irc.freenode.net! :)
Sean Tilley, Christopher Allan Webber, Elrond likes this.
Lars Wirzenius at 2015-06-24T07:24:38Z
note to self: clear naming for VMs is important; in the future names such as tmp, tmptmp, tmp2, temppitemp, and tttmp are not acceptablej1mc, Elrond, Christopher Allan Webber, Charles Stanhope and 5 others likes this.
how about "server"?Lars Wirzenius at 2015-06-17T14:36:25Z
This makes me want to run web browsers in heavily firewalled, read-only containers or VMs.Elrond, lnxwalt@microca.st, mnd, Christopher Allan Webber likes this.
Debian init system GR
gregor herrmann at 2014-11-19T22:09:45Z
Russ Allbery on what the result of the Debian init system coupling GR means: https://lists.debian.org/debian-project/2014/11/msg00079.html - I very much like this interpretation.
Francesco Ciattaglia, Scorpio20, Yutaka Niibe, Elrond and 4 others likes this.
Stephen Michael Kellat, Stephen Michael Kellat, Lisandro Damián Nicanor Pérez Meyer, Christopher Allan Webber shared this.
That's great!
@cwebber I hear Tony The Tiger's voice in reading your response.Jason Self at 2014-11-20T04:02:49Z
Christopher Allan Webber, X11R5, lnxwalt@microca.st likes this.
Why a free automated certificate authority is not the solution
The answer is simple: It's a certificate authority.
The certificate authority system is inherently flawed, this was not only proven by the fact governments as well as criminals could take over broadly accepted certificate authorities in the past, or that these takeovers had to be patched by software updates of a myriad of browsers, operating systems and other software.
It is flawed because it has that huge attack vector, there are over over 50 organizations that are trusted by your browser and they gave out the privilege to issue certificates for any domain to hundreds of other organizations. Remember this model is about trust. Do you trust all these or even the 50 root CAs? Did you verify they properly handle the power they've obtained? I did not, it's too much work.
Adding just yet another organization that can issue certificates for any domain only strengthens that model. It ensures future revenues for the companies providing you the nice little green icons in your browser, called "extended validation". I will leave looking up the prices for such a EV certificate and the estimate of how much real man work goes into that as an exercise for the reader.
There's hope though. For a few years now there's a new standard in the making, called "DNS-based Authentication of Named Entities", DANE for short. It's based on DNSSEC, an effort to prevent forged and not authoritative answers in the DNS system. In short DNSSEC guarantee's that the IP you're connecting to is controlled by the owner of the domain and DANE guarantees that there's no middle-man in your connection to the webserver listening on that IP.
DNSSEC reduces the number of entities you have to trust to effectively one, IANA. IANA does contract third parties to operate the root zone, currently this is VeriSign. Every signature can be chased to that single trusted party. To forge a domain you would need to compromise the root zones key, which is guarded by high standards, much higher than the ones of your average certificate authority. Also if you compromise at that level, you need to mirror the infrastructure of the whole top level domain your target domain is part of. This is feasible but also visible to monitoring systems. Attacking a top level domain infrastructure directly is also possible, the effect is greatly reduced though, only that single top level domain is compromised. You can't change the keys here either, as you would need to update the signatures in the root zone. And again an attack is more visible here.
Whether this is really greatly reducing the attack vector is debatable, what it objectively reduces is the damage you can make. Remember to compromise the current system on a whole you just need one of the hundreds of little certificate authorities.
You can activate DANE validation today through an excellent browser extension provided by the Czech domain registry. After you have installed it you can see that all my sites already deploy it, it's certainly possible.
I can understand if companies that benefit from the current system embark in such a "free" registry. I can understand if the EFF supports such a system as a short term measure, they don't directly influence any of the major software systems that would need to be adapted.
What makes me angry is that Mozilla is spending a lot of money to support it, while completely neglecting DANE support. There's no real progress for years now. They support the old broken system while they really could change something. If a major browser vendor like Mozilla shipped DANE support, across all its products, it would boost adoption of it a lot.
#mozilla #ssl #dns #dnssec #dane #letsencrypt
Igorette, lainfinity, jrobb, lnxwalt@microca.st and 9 others likes this.
Igorette, Olivier Mehani, Freemor, Douglas Perkins and 2 others shared this.
Show all 8 replies
There is a pretty good summary of the issues (including with DANE) and existing (or not) solutions to the SSL CA problem in the October issue of the Communications of the ACM (nice video for layish people there): Security Collapse in the HTTPS Market. An insightful read.
DANE did sound like the best solution to me, particularly for machine-to-machine verification (e.g., Pumps with self-signed certs didn't really federate last I tried), but the article points out that it is not all good.September, not October. Man, post is slow ta Australia....
I'm glad that Jonne Hass wrote this. Some of these same ideas have been swirling in my head all day. That said, DNS (even with DNSSEC) is laughably insecure and (because it is centralized) the weakest point in the entire Internet.lnxwalt@microca.st at 2014-11-19T03:49:33Z
jpope, Claes Wallin (韋嘉誠) likes this.
What smart AI in its right mind would want to do computer programming?
Claes Wallin (韋嘉誠), Bradley M. Kuhn, Elrond, Greg Grossmeier and 4 others likes this.
Elena ``of Valhalla'' at 2014-11-17T10:22:23Z
Tollef Fog HeenApparently, people care when you, as privileged person (white, male, long-time Debian Developer) throw in the towel because the amount of crap thrown your way just becomes too much. I guess that's good, both because it gives me a soap box for a short while, but also because if enough people talk about how poisonous the well that Debian is has become, we can fix it.
read the whole article, excellent words, if for a sad occasion.Lars Wirzenius, Elrond, Christopher Allan Webber, Evan Prodromou and 2 others likes this.
Scorpio20, Scorpio20, Christopher Allan Webber, Mike Linksvayer and 2 others shared this.
Christopher Allan Webber at 2014-11-13T16:14:15Z
I like the ncurses inspired design of the http://squatconf.eu/ website.
Elrond, Olivier Mehani, Amitai Schleier, Jason Self and 3 others likes this.
Wow that is a fantastic design. Web 1.0!
Christopher Allan Webber likes this.
Christopher Allan Webber at 2012-02-29T21:02:00+00:00
"I usually add a # TODO: Remove this comment" -- @joarElrond, Evan Prodromou likes this.
