Reputation
868
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
10 23
Newest
 Caucus
Impact
~278k people reached

13h
comment How can I choose between using my ISP's DNS, or Google's 8.8.8.8?
As an Australian, I would trust Google MORE than my ISP, if it was just on an individual basis.
14h
comment How can I choose between using my ISP's DNS, or Google's 8.8.8.8?
Note that your ISP can just as easily log dns requests to 8.8.8.8 as to their own dns servers. So its more a question of who do you trust out of your ISP, or both Google AND your ISP.
Aug
25
awarded  Caucus
Aug
12
comment Recommendation: Company website forced to https?
I realise this is an old answer, but the HTTPS not caching thing was always largely a myth. Browsers will still obey your caching directives as they would without HTTPS, ie they will treat something with "Expires" or "Cache-control: max-age=xx" the same way and do the same conditional requests and stuff. All you lose is caching by public proxies which is not a loss and kind of the point of HTTPS. The point about latency is absolutely right though, which is mitigated a little with new technology like TLS False Start, but not completely.
Jul
29
revised OpenDKIM - verifying mail forwarded by mailing lists
added 557 characters in body
Jul
14
revised Preventing SSL access to an Nginx Server
added 2 characters in body
Jul
14
comment Preventing SSL access to an Nginx Server
Yes, if a client without SNI connects it would go to your default_server for that listening port, which will result in the return 444. There's not really such a thing as a wildcard certificate from an actual CA, and multiple domain certificates are never cheap. Furthermore, in my testing the return 444 was only effective after the SSL connection was established, meaning nginx still served up a certificate for one of my other SSL sites, which had to be accepted, before the return 444 had an effect. However, my testing may have been flawed - I did not test with no other SSL sites.
Jul
13
revised Preventing SSL access to an Nginx Server
added 402 characters in body
Jul
13
answered Preventing SSL access to an Nginx Server
Jul
8
comment Any way for openssl to generate private key with 400 (-r--------) permissions from the start?
Note: that will probably result in a key file with permission of 600 or 700; to get 400 I think the umask should be 0377. Not that there is really any significant difference between them in this particular case.
Jul
8
answered Any way for openssl to generate private key with 400 (-r--------) permissions from the start?
Jul
7
comment Any way for openssl to generate private key with 400 (-r--------) permissions from the start?
Looks like my question is answered here: unix.stackexchange.com/questions/196802/… But that's a different site so I can't flag as duplicate.
Jul
7
asked Any way for openssl to generate private key with 400 (-r--------) permissions from the start?
Jun
25
awarded  Yearling
Apr
4
awarded  Popular Question
Feb
19
awarded  Necromancer
Jan
31
comment Is it bad to have the reverse DNS for two IPs point to the same domain name?
For example I just looked up google.com and the IP I got was 216.58.220.110. The reverse record for that is syd10s01-in-f14.1e100.net. I looked up that and got the same IP: 216.58.220.110. So that Google server passes FCrDNS check, even though the name it used for that purpose, syd10s01-in-f14.1e100.net, had nothing to do with the name I access that server by (which is google.com) or names used for things like SSL.
Jan
31
comment Is it bad to have the reverse DNS for two IPs point to the same domain name?
This shouldn't affect any services you have, that is it should not not affect your ability to do HTTPS or LDAPS or to load balance with many servers. The FCrDNS check does not have to use the same hostname as the hostname you are using to access the server. It can use any hostname; usually an internal hostname not necessarily seen by end users unless they did a PTR check. All that is required is that each unique IP visible to the world uses something for a unique hostname that resolves back to that IP.
Jan
29
awarded  Popular Question
Oct
18
comment What is the best Linux distribution for a production Web Server?
Debian went to a scheduled freeze date, but not a scheduled release date. It's still released "when it's done" ie when all RC bugs are eliminated and thus actual release date can still vary. Plus even the freeze date is only used as a guideline, not set in stone. Its aim was to make release schedule more predictable without compromising stability and the freeze process.