2,884 reputation
1719
bio website
location
age
visits member for 4 years, 5 months
seen 16 hours ago

Sep
30
awarded  Explainer
Aug
31
awarded  Nice Answer
Jul
22
comment What types of systems have to “scale up” rather than “scale out”?
@LieRyan This depends heavily on the application (I don't just mean how the software was implemented, but also what it's meant to do). There are indeed distributed database systems, however they tend to have to make compromises in terms of ACID compliance. They may perform better for certain types of queries but not as well for others.
Jul
22
comment Isn't Ctrl-Alt-Delete on Linux *really* dangerous?
I've had the opposite problem once. I was logged on remotely to a server from a desktop machine, and wanted to reboot the desktop machine. I typed shutdown -r now only to realise, I was in the wrong window or forgot to log out from the server first... I wish I had used Ctrl+Alt+Del. (Of course, this doesn't necessarily apply to your case, since you seem to be concerned with disabling it on servers.)
Jul
13
comment Do I have to have an ssl certificate for my mail server?
@kyrias, I don't get your point about STARTTLS. Either you want to use SSL/TLS (upfront or via STARTTLS) and you make sure you use it, or you don't. Falling back without knowing only protects from passive eavesdropper, not MITM attackers. Of course, it's not necessarily a bad thing, better than nothing. It's just I'd guess attackers who are in a position to eavesdrop between MTAs are also very likely to be in a position to mount a MITM attacks: at that stage, the networks would tend to be within the hands of professionals exclusively, who'd certainly be in charge of the routers, etc.
Jun
30
awarded  Yearling
May
16
comment Is it safe for a production server to have make installed?
@Adnan, interesting. As far as I can tell, the main security flaw in this DVR example is the fact that the attacker can telnet to it as root with password 123456 in the first place. Having or not having wget or other tools (before the attack) is then barely relevant indeed.
May
16
comment DER encoded hash
The documentation for stunnel4 is probably not up to date, but with a modern version of OpenSSL, you'd need -subject_hash_old to produce an MD5 hash, since -hash would use SHA-1. (Details here.) I guess stunnel4 might not care either way and delegate all this to the version of OpenSSL it's linked to.
May
16
answered Issuer Subject Policy in Self-Signed CA Certificate
May
16
comment Are Cisco admins expected to understand classful networks?
I'm just saying it seems to have become a common expression (like everyone uses "RJ45" to talk about something that's not the RJ45 standard). Although it's incorrect, some people might find these class names easier to say than "/24", which in turns means than most people collectively know what they're referring to (I'm not endorsing the practice, I'm just saying it's not necessarily the end of the world). I'm not sure what you're saying about the OSI model and what I know about it or not... Where was I mistaken about the OSI model?
May
15
comment Are Cisco admins expected to understand classful networks?
I wonder if saying "class A, B and C" to mean "/8, /16 and /24" is such a big problem. Perhaps it's just something that changed its meaning with time. In the same category, how many people use "RJ45" correctly? I can't think of any networking device with an 8P8C networking connector that doesn't say "RJ45" in its spec instead.
May
15
comment Is it safe for a production server to have make installed?
While it's a good idea to build your applications on a separate server, saying the presence of compilers on a production system is a significant security issue doesn't make sense. What about scripting languages and JIT-compiled systems (Perl, Python, Java, ...)?
May
15
comment Is it safe for a production server to have make installed?
I would add to this that a number of production system rely on interpreted code (e.g. PHP, Perl, Python, ...). Banning development tools in this context wouldn't make sense. I'd consider compilers like gcc not to present a higher risk than these. As you say, an attacker in a position to use the compilers installed on a system would generally by in a position to do worse things anyway, such as uploading their own (possibly statically linked) executable.
Apr
2
awarded  Announcer
Feb
25
answered How to automatically announce Linux server resources to clients with arbitrary OSes?
Feb
24
comment What are the exact protocol level differences between SSL and TLS?
@culix, generally speaking, that's indeed correct (mainly because the TLS extensions are defined in the framework of IETF). SSLv3 was also able to have extra data in its ClientHello record (same as TLS 1.0 and 1.1). (Look for draft302.txt and "In the interests of forward compatibility...", compare with sections 7.4.1.2 in the TLS specs). To cope with stacks not supporting this, there's also workarounds such as the SCSV pseudo cipher-suite in the renegotiation extension.
Jul
9
comment Prevent SSL certificate being returned for a specific domain
Actually, it's possible to choose the server certificate to return before any HTTP traffic using Server Name Indication, which is increasingly supported. (The biggest non-supporters are IE on XP and a number of mobile phones.)
Jul
9
comment OpenSSL issues in Debian Wheezy
The CA certificates are only used to verify the remote certificate. Unfortunately, there's no remote certificate presented here at all, so that wouldn't help ("no peer certificate available").
Jul
9
answered OpenSSL issues in Debian Wheezy
Jul
9
answered why apt is not installing dependencies on Wheezy?