2,893 reputation
1719
bio website
location
age
visits member for 4 years, 5 months
seen 8 hours ago

Dec
1
comment Is STARTTLS more safe than TLS/SSL?
There are RFCs about TLS (RFC 5246 and predecessors), PKI (RFC 5280), name verification (RFC 6125), but nothing to describe the interaction between SMTP and SSL/TLS in SMTPS officially AFAIK, not in the same way as you get a spec for HTTPS: RFC 2818. One may say "it's obvious, just establish the SSL/TLS connection first", but not everything about it is that obvious (in particular the identity verification aspect, only formalised quite recently in RFC 6125).
Dec
1
comment Is STARTTLS more safe than TLS/SSL?
Your point is certainly valid, but by lack of any RFC or official specification regarding SMTPS (i.e. SMTP + "implicit SSL/TLS" where SSL/TLS is established first), SMTP/SMTPS clients could also decide to fall back to a plain connection if they can't manage to initiate an SSL/TLS connection on port 465. That's still purely an implementation choice.
Nov
30
comment Is STARTTLS more safe than TLS/SSL?
@Greg (Note that "explicit TLS" often refers to STARTTLS, as opposed to implicit TLS where you establish the SSL/TLS connection beforehand). A client trying to do implicit TLS could also be badly implemented and send the data over plain TCP in the same way (for example by having an "SSL" tick box that doesn't actually do anything). Many other mistakes can be made in the implementation (like no proper identity verification). Both can be implemented as badly as you want, that doesn't mean the mechanism itself is less secure.
Nov
28
comment Is STARTTLS more safe than TLS/SSL?
@Greg you're getting confused with opportunistic use of STARTTLS between MTAs. The problem here is the "opportunistic" use of SSL/TLS not whether it's upfront or upgraded. SSL/TLS between MTAs is a whole different issue that doesn't really have much to do with explicit or implicit SSL/TLS, but that has to do with the fact MTAs can't know whether to expect other MTAs to support SSL/TLS at all (and also certificate management).
Nov
28
comment Is STARTTLS more safe than TLS/SSL?
@Greg I'm not planning to repeat what I've said in answers here and here, but STARTTLS isn't less secure. It's only less secure if the client is badly implemented (i.e. it's not a protocol or conceptual problem, but an implementation issue, as it was the case in Thunderbird up to 2010).
Sep
30
awarded  Explainer
Aug
31
awarded  Nice Answer
Jul
22
comment What types of systems have to “scale up” rather than “scale out”?
@LieRyan This depends heavily on the application (I don't just mean how the software was implemented, but also what it's meant to do). There are indeed distributed database systems, however they tend to have to make compromises in terms of ACID compliance. They may perform better for certain types of queries but not as well for others.
Jul
22
comment Isn't Ctrl-Alt-Delete on Linux *really* dangerous?
I've had the opposite problem once. I was logged on remotely to a server from a desktop machine, and wanted to reboot the desktop machine. I typed shutdown -r now only to realise, I was in the wrong window or forgot to log out from the server first... I wish I had used Ctrl+Alt+Del. (Of course, this doesn't necessarily apply to your case, since you seem to be concerned with disabling it on servers.)
Jul
13
comment Do I have to have an ssl certificate for my mail server?
@kyrias, I don't get your point about STARTTLS. Either you want to use SSL/TLS (upfront or via STARTTLS) and you make sure you use it, or you don't. Falling back without knowing only protects from passive eavesdropper, not MITM attackers. Of course, it's not necessarily a bad thing, better than nothing. It's just I'd guess attackers who are in a position to eavesdrop between MTAs are also very likely to be in a position to mount a MITM attacks: at that stage, the networks would tend to be within the hands of professionals exclusively, who'd certainly be in charge of the routers, etc.
Jun
30
awarded  Yearling
May
16
comment Is it safe for a production server to have make installed?
@Adnan, interesting. As far as I can tell, the main security flaw in this DVR example is the fact that the attacker can telnet to it as root with password 123456 in the first place. Having or not having wget or other tools (before the attack) is then barely relevant indeed.
May
16
comment DER encoded hash
The documentation for stunnel4 is probably not up to date, but with a modern version of OpenSSL, you'd need -subject_hash_old to produce an MD5 hash, since -hash would use SHA-1. (Details here.) I guess stunnel4 might not care either way and delegate all this to the version of OpenSSL it's linked to.
May
16
answered Issuer Subject Policy in Self-Signed CA Certificate
May
16
comment Are Cisco admins expected to understand classful networks?
I'm just saying it seems to have become a common expression (like everyone uses "RJ45" to talk about something that's not the RJ45 standard). Although it's incorrect, some people might find these class names easier to say than "/24", which in turns means than most people collectively know what they're referring to (I'm not endorsing the practice, I'm just saying it's not necessarily the end of the world). I'm not sure what you're saying about the OSI model and what I know about it or not... Where was I mistaken about the OSI model?
May
15
comment Are Cisco admins expected to understand classful networks?
I wonder if saying "class A, B and C" to mean "/8, /16 and /24" is such a big problem. Perhaps it's just something that changed its meaning with time. In the same category, how many people use "RJ45" correctly? I can't think of any networking device with an 8P8C networking connector that doesn't say "RJ45" in its spec instead.
May
15
comment Is it safe for a production server to have make installed?
While it's a good idea to build your applications on a separate server, saying the presence of compilers on a production system is a significant security issue doesn't make sense. What about scripting languages and JIT-compiled systems (Perl, Python, Java, ...)?
May
15
comment Is it safe for a production server to have make installed?
I would add to this that a number of production system rely on interpreted code (e.g. PHP, Perl, Python, ...). Banning development tools in this context wouldn't make sense. I'd consider compilers like gcc not to present a higher risk than these. As you say, an attacker in a position to use the compilers installed on a system would generally by in a position to do worse things anyway, such as uploading their own (possibly statically linked) executable.
Apr
2
awarded  Announcer
Feb
25
answered How to automatically announce Linux server resources to clients with arbitrary OSes?