jcase

9 ms·

1.
by jcase 11y ago
Thanks. You're right. Now I'm just wondering what IdenTrust gains from free DV certificates.
2.
by jcase 11y ago
Acceptance into Mozillaʼs CA Certificate Program is usually discussed in public. Let's encrypt is not on the list of pending CA applications[0]. Does anyone know if they are introducing a new root certificate or teaming up with an exis
3.
by jcase 11y ago
Running the openssl s_client command from the article will show you live.
4.
by jcase 12y ago
When you mentioned discourse serving 19k req/sec, does it hit the ruby stack at all? If no, serving 19k req/sec of cached HTML doesn't seem that impressive. What am I missing?
5.
by jcase 12y ago
You're (almost) describing certificate pinning. Have a look at http://tack.io although it appears down for the moment. Here is the HN thread: https://news.ycombinator.com/item?id=4010711
6.
by jcase 12y ago
With SSH you usually own both endpoints (or at least trusting your cloud provider). The example you give with regards to exchanging a piece of paper is very similar. It's ridiculously hard to do such a thing on large scale without trus
7.
by jcase 12y ago
This article[0] is largely about DNSSEC and DANE but it might give you some insights why making registrars the sole authorities isn't such a good idea. [0] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-aut
8.
NewsgroupDirect Security Breach(newsgroupdirect.com)
1 points by jcase 12y ago|0 comments
9.
by jcase 13y ago
Well, whatever the license, here is to a bright future! That a rising tide may lift all boats.
10.
by jcase 13y ago
I'm not sure this is true (anymore?). There are many open source projects who are thriving under non copyleft licenses. If someone wanted to be a dick about it they could release modified GPL code as one big diff and publish it on some
11.
by jcase 13y ago
Not sure if you mean for profit and proprietary or just making money in general. For some reason though a lot of people think you can't sell GPL'd software which you absolutely can.
12.
by jcase 13y ago
DANE isn't without its own problems. Moxie Marlinspike wrote an excellent blog post about it. http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...
13.
by jcase 13y ago
If users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start though. Ideally OS/Browser vendors would drop compromised CAs.
14.
by jcase 13y ago
Sounds very similar to Convergence. In fact, it turns out that "Convergence is based on previous work from the Perspectives Project at Carnegie Mellon University".[0] I don't think this (or Convergence) will see widespread ad
15.
by jcase 13y ago
Same version, no warning. Edit: Oops, had yet to read that it's now temporarily whitelisted by google.
16.
by jcase 13y ago
Interesting, thanks!
17.
by jcase 13y ago
When the EU region was announced[1] last month they weren't Safe Harbor compliant (yet). Has that changed? [1] https://blog.heroku.com/archives/2013/4/24/europe-region (near the bottom).
18.
by jcase 13y ago
For some reason it reminded me of "The Electronic Money Mill". Original site is gone but The Internet Archive has a copy: http://web.archive.org/web/20080412233535/http://www.msen.co... Fun (semi-fictional) read about Electronic Funds Tra
19.
by jcase 13y ago
The Luna SA they are using doesn't come cheap. For an H/A setup with all the extras (backup tools, service contract) I was quoted ~$80k.
20.
AWS CloudHSM: Secure Key Storage and Cryptographic Operations(aws.amazon.com)
37 points by jcase 13y ago|10 comments
21.
by jcase 14y ago
Automatic failover is a pretty big feature though. I wish Postgres had a built-in solution. Sure, I could use Pacemaker but it's no where near as painless.
22.
by jcase 14y ago
It's 72 actually. I thought it was 56 as mentioned on the original [?] BCrypt website[1]. A thread[2] on security/stackexchange discusses a workaround for the 72 char limit. See https://gist.github.com/4690368 for a simple test case that
23.
by jcase 14y ago
Indeed. Chrome has baked-in public key pinning for their services. http://www.imperialviolet.org/2011/05/04/pinning.html
24.
by jcase 14y ago
For domain validated certs, certainly. The issue is that it doesn't solve anything. We merely shift (more) responsibility to registrars and NICs. You can change (untrust) registrars I suppose but if you have a .com you'll have to trust Veri
25.
by jcase 14y ago
Actually, I've thought about starting a "real" CA (read: get certified etc). I'm not sure the world needs another one though. Your experience running a homebrew setup is exactly why I think CAs will continue to exist—even if self-signed cer
26.
by jcase 14y ago
> Consider this, if I hold a certificate for fubar.com, why am I not permitted to issue a certificate for xyz.fubar.com Or, better yet - another certificate for fubar.com? Because business model. StartSSL.com is afaik the first (only?)
27.
by jcase 14y ago
Some developments in this area are: * Convergence.io * DNS-based Authentication of Named Entities (DANE) + DNSSEC * Tack.io For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers. On DAN
28.
by jcase 14y ago
Did you look at Braintree?
29.
by jcase 14y ago
Short demo video http://www.datacenterknowledge.com/archives/2012/06/27/video...
30.
by jcase 14y ago
Note that e.g. BCrypt has a maximum passphrase length of 56 characters. http://bcrypt.sourceforge.net/

More ›