ivanr

6 ms·

1.
Show HN: Feisty Duck's Cryptography and Security News Aggregator(feistyduck.com)
5 points by ivanr 21d ago|1 comments
2.
by ivanr 2mo ago
You could argue that it was designed by one guy (Kipp Hickman) in three months: https://www.feistyduck.com/newsletter/issue_131_the_legend_o...
3.
by ivanr 4mo ago
More context: https://www.recall.ai/blog/postgres-listen-notify-does-not-s...
4.
by ivanr 5mo ago
Spoiler: They're not identical.
5.
by ivanr 6mo ago
No, DNSSEC can enforce strong cryptographic validation _today_. Here's how: 1. Configure a CAA record that restricts issuance to two CAs that support locking down issuance to specific customer accounts. For example, Let's Encrypt
6.
by ivanr 6mo ago
Ah, sorry, I should have referenced this sibling comment: https://news.ycombinator.com/item?id=47403528 EKR is https://educatedguesswork.org/about/
7.
by ivanr 6mo ago
I'll share a couple of thoughts, but do read EKR's blog first: - Web PKI is inherently insecure and can't be fixed on its own. The root problem is that the CAs we "trust" can issue certificates without technical con
8.
by ivanr 6mo ago
Maybe you're onto something, but in what way do you think that TLS is not serving other protocols? Personally, I think we have a bigger problem on the PKI side, where Web PKI is very strong, but Internet PKI has been neglected. The rec
9.
by ivanr 6mo ago
If you like this sort of thing, perhaps you'll enjoy my SSL/TLS and PKI history where I track a variety of ecosystem events starting with the creation of SSL in 1994: https://www.feistyduck.com/ssl-tls-and-pki-hist
10.
by ivanr 7mo ago
Yes, there is! After I left SSL Labs, I built Hardenize, which was an attempt to go wider and handle more of network configuration, not just TLS and PKI. It covers a range of standards, from DNS, over email, TLS and PKI, and application sec
11.
by ivanr 7mo ago
Thanks! Sadly, SSL Labs doesn't appear to be actively maintained. I've noticed increasing gaps in its coverage and inspection quality. I left quite a while ago (2016) and can't influence its grading any more, sadly.
12.
by ivanr 7mo ago
I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already familiar with ECH and its history: https://www.feistyduck.com&
13.
by ivanr 8mo ago
As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yesterday. Here's what worked for me: lego --do
14.
by ivanr 8mo ago
I wrote about OpenSSL's performance regressions in the December issue of Feisty Duck's cryptography newsletter [1]. In addition to Alex's and Paul's talk on Python cryptography, at the recent OpenSSL conference there hav
15.
by ivanr 9mo ago
Because "everybody uses RC4" (the sibling comment from dchest is correct). There was a lot of bad cryptography in that period and not a lot of desire to improve. The cleanup only really started in 2010 or thereabouts. For RC4 spec
16.
by ivanr 10mo ago
> > transactional enqueueing > But it is safe as long as it's done inside a DBOS workflow. Yes, but I was talking about the point at which a new workflow is created. If my transaction completes but DBOS disappears before the n
17.
by ivanr 10mo ago
> versioning Here's an example of a common long-running workflow: SaaS trials. Upon trial start, create a workflow to send the customer onboarding messages, possibly inspecting the account state to influence what is sent, and finall
18.
by ivanr 10mo ago
Hello Peter. Thank you for your work. I really like this approach. I too have been following Temporal and I like it, but I don't think it's a good match for simpler systems. I've been reading the DBOS Java documentation and h
19.
State of the post-quantum Internet in 2025(blog.cloudflare.com)
4 points by ivanr 11mo ago|0 comments
20.
by ivanr 1y ago
+1 Absolutely. (Source: Original author of ModSecurity.)
21.
by ivanr 1y ago
I have a bunch of useful resources, most of which are free: - If you're looking for a concise (yet complete) guide: https://www.feistyduck.com/library/bulletproof-tls-guide/ - OpenSSL Cookbook is a free ebook
22.
by ivanr 1y ago
In what way does DoH provide end-to-end security? It doesn't, unless you adopt a different definition of "end-to-end" where the "server end" is an entity that's different from the domain name owner, but you&#x2
23.
by ivanr 1y ago
Those two don't really compete. DNSSEC provides authenticity/integrity without privacy and DoH does exactly the opposite. If anything, you need both in order to secure DNS.
24.
by ivanr 1y ago
Your comment doesn't match what's written on the very page you quote: https://upcloud.com/fair-transfer-policy > Even if you exceed your monthly share, don’t worry, there are no excess fees. We will simply noti
25.
by ivanr 2y ago
> "Although the chance of a collision is extremely low because the random value has at least 150 bits of entropy, there is still a chance." I am... speechless. I mean... Um. The last time I checked, no one was able to break 128
26.
by ivanr 2y ago
Try NATS @ https://nats.io It's a single binary and can operate as a message bus, persistent queue, KV store, object store, provide services, and so on.
27.
by ivanr 2y ago
Sounds like you're in the UK? Any chance you could send me the details of your doctor(s) to ivan.ristic@gmail.com? I've been struggling to find a doctor willing to diagnose me properly. Much appreciated.
28.
by ivanr 2y ago
You're not alone. Hang in there.
29.
by ivanr 2y ago
Yes. ModSecurity is best used as a tool for virtual patching, meaning something you can use to create a temporary defence for a problem you know you have. That buys you some time until the problem is fixed. When you're writing a virtua
30.
by ivanr 2y ago
If you're struggling to the extent that you're questioning your sanity, you're trying to do too much. There's a limit to what a single person can do. If you want to stay a one-person company and keep your sanity, do less

More ›