Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
10
Impact
~261 people reached

1d
comment What Emacs package should I install for command-line on FreeBSD?
Would you know what the equivalent command is under FreeBSD 10.1? It appears to lack pkg_add.
May
18
comment How to set “server preference” for tls cipher suites?
@Michael - you could re-arrange the client list or the server list and it won't change the outcome. The order of the ciphers don't make a difference in this question. What matters is the choice of who (client or server) drives the selection. Either the server uses the client's list; or the server uses the server's list. If you are arguing otherwise, then it makes me believe you don't quite understand what is going on.
May
17
comment How to set “server preference” for tls cipher suites?
@sebix - also, the details of this are not discussed in the WP: Basic TLS handshake. Its glossed over in a couple of places with "depending on the selected cipher suite...". How the cipher suite is selected is not discussed.
May
17
comment How to set “server preference” for tls cipher suites?
@sebix - I'm not sure what you mean. Effectively, there are two lists - the client's list and the server's list. By convention (because the standard does not specify the behavior), the server honors the client's choice. If the client wants RC4-MD5, then that's what is used (some hand waiving). If the "server preference" option is configured at the server, then the server will use its its list, and not the client's list. In this case, the server chooses or the the server's preference is used.
May
17
revised How to set “server preference” for tls cipher suites?
Formatting.
May
17
comment VPN PPTPD with MPPE Support for Debian or Ubuntu
"Having an unencrypted vpn connection..." - I don't believe there is such a thing. The VPN standards don't have the equivalent to TLS's eNULL. VPN does not even allow opportunistic encryption or better-than-nothing encryption. Everything is encrypted, and you need to be pre-provisioned.
May
17
comment How to set “server preference” for tls cipher suites?
Agreed with respect to lists and not random. But this has nothing to do with the order of the cipher list within either the client's list or the server's list. It has to do with either: (a) the server using the client's #1 choice of cipher suite; or (b) the server using the server's #1 choice of cipher suite. (Or #2 if there's no intersection with #1, etc).
May
16
awarded  Citizen Patrol
May
16
comment How to set “server preference” for tls cipher suites?
Perfect, thanks. Related: why is it called or named "order" rather than "choice" or "preference"? The TLS standard is ambiguous whether its the client's choice or the server's choice; so its a choice or preferences, and not an order. I can't help but feel AWS's inability to name it correctly resulted in my inability to locate it.
May
16
awarded  Scholar
May
16
suggested approved edit on How to set “server preference” for tls cipher suites?
May
16
accepted How to set “server preference” for tls cipher suites?
May
16
asked How to set “server preference” for tls cipher suites?
May
12
awarded  Informed
May
12
comment Finding out what user Apache is running as?
The next question: what to do because its one of two users, like root and www-data. How do you give the "right" Apache group a permission to access something?
May
10
awarded  Autobiographer
Apr
18
comment apache ssl configuration - ssllabs how to get A+
Don't disable them. The ephemeral suites (DHE) provide perfect forward secrecy, and its a very desirable security property. GCM is a TLS 1.2 suite and it properly combines Encryption and Authentication (using Encrypt-then-Authenticate) so its almost laughable it is recommended for removal. (SSL/TLS has been doing the wrong thing for years, and POODLE was no surprise. It was fore-warned almost 15 years earlier, but the TLS Working Group decided not to act). Very related: Trust Extortion on the Internet.
Nov
19
comment nmap on my webserver shows TCP ports 554 and 7070 open
+1 for crappy FiOS Actiontec router. I know your box's private keys (so do others, thanks to Little Black Box).
Oct
7
awarded  Excavator
Oct
7
revised “Countersigning” a CA with openssl
Use 'example.com'; that's what IANA reserves it for. 'mydomain.com' is a real domain owned by a real organization.