2,893 reputation
1719
bio website
location
age
visits member for 4 years, 5 months
seen 17 hours ago

Dec
1
comment Is STARTTLS more safe than TLS/SSL?
There are RFCs about TLS (RFC 5246 and predecessors), PKI (RFC 5280), name verification (RFC 6125), but nothing to describe the interaction between SMTP and SSL/TLS in SMTPS officially AFAIK, not in the same way as you get a spec for HTTPS: RFC 2818. One may say "it's obvious, just establish the SSL/TLS connection first", but not everything about it is that obvious (in particular the identity verification aspect, only formalised quite recently in RFC 6125).
Dec
1
comment Is STARTTLS more safe than TLS/SSL?
Your point is certainly valid, but by lack of any RFC or official specification regarding SMTPS (i.e. SMTP + "implicit SSL/TLS" where SSL/TLS is established first), SMTP/SMTPS clients could also decide to fall back to a plain connection if they can't manage to initiate an SSL/TLS connection on port 465. That's still purely an implementation choice.
Nov
30
comment Is STARTTLS more safe than TLS/SSL?
@Greg (Note that "explicit TLS" often refers to STARTTLS, as opposed to implicit TLS where you establish the SSL/TLS connection beforehand). A client trying to do implicit TLS could also be badly implemented and send the data over plain TCP in the same way (for example by having an "SSL" tick box that doesn't actually do anything). Many other mistakes can be made in the implementation (like no proper identity verification). Both can be implemented as badly as you want, that doesn't mean the mechanism itself is less secure.
Nov
28
comment Is STARTTLS more safe than TLS/SSL?
@Greg you're getting confused with opportunistic use of STARTTLS between MTAs. The problem here is the "opportunistic" use of SSL/TLS not whether it's upfront or upgraded. SSL/TLS between MTAs is a whole different issue that doesn't really have much to do with explicit or implicit SSL/TLS, but that has to do with the fact MTAs can't know whether to expect other MTAs to support SSL/TLS at all (and also certificate management).
Nov
28
comment Is STARTTLS more safe than TLS/SSL?
@Greg I'm not planning to repeat what I've said in answers here and here, but STARTTLS isn't less secure. It's only less secure if the client is badly implemented (i.e. it's not a protocol or conceptual problem, but an implementation issue, as it was the case in Thunderbird up to 2010).
Jul
22
comment What types of systems have to “scale up” rather than “scale out”?
@LieRyan This depends heavily on the application (I don't just mean how the software was implemented, but also what it's meant to do). There are indeed distributed database systems, however they tend to have to make compromises in terms of ACID compliance. They may perform better for certain types of queries but not as well for others.
Jul
22
comment Isn't Ctrl-Alt-Delete on Linux *really* dangerous?
I've had the opposite problem once. I was logged on remotely to a server from a desktop machine, and wanted to reboot the desktop machine. I typed shutdown -r now only to realise, I was in the wrong window or forgot to log out from the server first... I wish I had used Ctrl+Alt+Del. (Of course, this doesn't necessarily apply to your case, since you seem to be concerned with disabling it on servers.)
Jul
13
comment Do I have to have an ssl certificate for my mail server?
@kyrias, I don't get your point about STARTTLS. Either you want to use SSL/TLS (upfront or via STARTTLS) and you make sure you use it, or you don't. Falling back without knowing only protects from passive eavesdropper, not MITM attackers. Of course, it's not necessarily a bad thing, better than nothing. It's just I'd guess attackers who are in a position to eavesdrop between MTAs are also very likely to be in a position to mount a MITM attacks: at that stage, the networks would tend to be within the hands of professionals exclusively, who'd certainly be in charge of the routers, etc.
May
16
comment Is it safe for a production server to have make installed?
@Adnan, interesting. As far as I can tell, the main security flaw in this DVR example is the fact that the attacker can telnet to it as root with password 123456 in the first place. Having or not having wget or other tools (before the attack) is then barely relevant indeed.
May
16
comment DER encoded hash
The documentation for stunnel4 is probably not up to date, but with a modern version of OpenSSL, you'd need -subject_hash_old to produce an MD5 hash, since -hash would use SHA-1. (Details here.) I guess stunnel4 might not care either way and delegate all this to the version of OpenSSL it's linked to.
May
16
comment Are Cisco admins expected to understand classful networks?
I'm just saying it seems to have become a common expression (like everyone uses "RJ45" to talk about something that's not the RJ45 standard). Although it's incorrect, some people might find these class names easier to say than "/24", which in turns means than most people collectively know what they're referring to (I'm not endorsing the practice, I'm just saying it's not necessarily the end of the world). I'm not sure what you're saying about the OSI model and what I know about it or not... Where was I mistaken about the OSI model?
May
15
comment Are Cisco admins expected to understand classful networks?
I wonder if saying "class A, B and C" to mean "/8, /16 and /24" is such a big problem. Perhaps it's just something that changed its meaning with time. In the same category, how many people use "RJ45" correctly? I can't think of any networking device with an 8P8C networking connector that doesn't say "RJ45" in its spec instead.
May
15
comment Is it safe for a production server to have make installed?
While it's a good idea to build your applications on a separate server, saying the presence of compilers on a production system is a significant security issue doesn't make sense. What about scripting languages and JIT-compiled systems (Perl, Python, Java, ...)?
May
15
comment Is it safe for a production server to have make installed?
I would add to this that a number of production system rely on interpreted code (e.g. PHP, Perl, Python, ...). Banning development tools in this context wouldn't make sense. I'd consider compilers like gcc not to present a higher risk than these. As you say, an attacker in a position to use the compilers installed on a system would generally by in a position to do worse things anyway, such as uploading their own (possibly statically linked) executable.
Feb
24
comment What are the exact protocol level differences between SSL and TLS?
@culix, generally speaking, that's indeed correct (mainly because the TLS extensions are defined in the framework of IETF). SSLv3 was also able to have extra data in its ClientHello record (same as TLS 1.0 and 1.1). (Look for draft302.txt and "In the interests of forward compatibility...", compare with sections 7.4.1.2 in the TLS specs). To cope with stacks not supporting this, there's also workarounds such as the SCSV pseudo cipher-suite in the renegotiation extension.
Jul
9
comment Prevent SSL certificate being returned for a specific domain
Actually, it's possible to choose the server certificate to return before any HTTP traffic using Server Name Indication, which is increasingly supported. (The biggest non-supporters are IE on XP and a number of mobile phones.)
Jul
9
comment OpenSSL issues in Debian Wheezy
The CA certificates are only used to verify the remote certificate. Unfortunately, there's no remote certificate presented here at all, so that wouldn't help ("no peer certificate available").
Jul
9
comment why apt is not installing dependencies on Wheezy?
Just to check... Did you run apt-get update first?
Dec
13
comment Prevent hotlinking at DNS level
@Zoredache, the problem is that the DNS queries may come from somewhere completely different from (a) the browser's IP address and (b) the site that's hot-linking.
Dec
13
comment Prevent hotlinking at DNS level
Have you considered hosting your DNS server (or using a DNS provider) somewhere where there's no request number limit? It doesn't have to be on the same machine or hosting company as your web server.