reedloden · HackerTrans

Google only stopped scanning the emails for advertising purposes, as the article states. Google definitely actively scans emails for malicious content (see https://support.google.com/mail/answer/25760?hl=en and https://support.google.com/a/answer/7380368?hl=en).

reedloden

6 anni fadiscuss

https://www.hackerone.com/company/open-source-community

HackerOne has a free offering for open source projects. ^^

Let me know if you have any questions (I manage it). :-)

reedloden

10 anni fadiscuss

Now, that could be a valid issue, indeed, though not sure for how long I care about those devices continuing to work without any valid upgrade path... Using things like HSTS and CSP's `upgrade-insecure-requests` would help here for clients that do support it.

reedloden

10 anni fadiscuss

> There are always practical limitations to site-wide technical changes, and HTTPS Everywhere is no different. Sites and content we consider ‘archival’ that involve no signing in or personalisation, such as the News Online archive on news.bbc.co.uk, will remain HTTP-only. This is due to the cost we’d incur processing tens of millions of old files to rewrite internal links to HTTPS when balanced against the benefit.

Not to be snarky, but haven't people written tools to help with this? This seems like a common issue. I mean, there's `sed` and similar tools, obviously, but something that could go, validate that the link works over https://, and update it. I don't see why that would need to be some monumental amount of work.

HTTPS is more than just privacy. See https://certsimple.com/blog/ssl-why-do-i-need-it and https://www.troyhunt.com/ssl-is-not-about-encryption/

reedloden

10 anni fadiscuss

> Earlier in 2016, the Chromium development team decided to implement a change to Google Chrome, preventing access to certain in-browser features on ‘insecure’ (non-HTTPS) web pages. In practice, this meant that key features of certain products, such as the location-finding feature within the Homepage, Travel News and Weather sites, would stop working if we didn’t enable HTTPS for those services.

I think this shows how valuable it is to use incentives to get people to Do The Right Thing(tm). Perhaps more things should be changed to require HTTPS.

reedloden

10 anni fadiscuss

Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)...

Sure, Apple should ship a fix, but there are ways around it for now.

reedloden

10 anni fadiscuss

https://developer.mozilla.org/en-US/docs/Web/API/RandomSourc... solves that. Just need to tweak the code.

I submitted https://github.com/arik-so/tsa/issues/4 about this issue.

reedloden

10 anni fadiscuss

https://bugs.launchpad.net/ubuntu/+source/git/+bug/1557787 is the tracking bug for this issue. Seems like it's fixed on xenial but not yet in older releases.

reedloden

10 anni fadiscuss

Note that Seafile seems to still be using a very old and EOL'd version of Django that has known security issues (currently v1.5.12, I believe).

https://github.com/haiwen/seafile/issues/1502

reedloden

11 anni fadiscuss

Just use Let's Encrypt. :)

Signed, The guy who marked that bug report invalid.

reedloden

11 anni fadiscuss

Zenefits and ZenPayroll are two completely different companies. Don't let the "Zen" part confuse you. :)

reedloden

11 anni fadiscuss

Ah, so this is why Facebook tries to load Flash on almost every page... Allows them to gather data like this. Always wondered why Flash was "needed".

(another reason to put Flash behind click-to-play and/or push for HTML5 video)

reedloden

12 anni fadiscuss

Yes, Firefox has supported public key pinning for a while now.

You can check the latest status at https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...

reedloden

12 anni fadiscuss

Yet another new crypto protocol... "Yay"

What about when HTTP/2 becomes popular? You'll still have to deal with TLS then unless you deal with TCP connections directly (and bypass HTTP).

reedloden

12 anni fadiscuss

Please read http://www.djm.org.uk/protect-yourself-from-non-obvious-dang... (https://news.ycombinator.com/item?id=8385213).

reedloden

12 anni fadiscuss

Dupe of https://news.ycombinator.com/item?id=8452931

reedloden

12 anni fadiscuss

It's always a good idea to regularly check https://wiki.mozilla.org/Security/Server_Side_TLS and ensure your web servers / load balancers are using the best possible (for your particular users) settings. If you don't have to worry about very old and unpatched WinXP users, going with the "intermediate" compatibility level should be the bare minimum.

Also, don't forget about your clients as well. Things like Ruby and Python each have their own set of SSL/TLS configuration that people always seem to forget about.

reedloden

12 anni fadiscuss

If it's truely unused, you should be using /bin/false instead of /bin/sh. Note that /bin/sh is not always dash in many cases, so just because you are using /bin/sh over /bin/bash doesn't mean you're not vulnerable.

reedloden

12 anni fadiscuss

You can't buy Landscape directly, sadly... You have to pay for Ubuntu Advantage, which is their support offering, which is why it's a ridiculous $$$ per server.

reedloden

12 anni fadiscuss

I have no interest in paying for Ubuntu Advantage. I would happily pay a reasonable amount for just Landscape, but Canonical doesn't offer that. Get your sales guys to fix that, and you'll end up with a lot more Landscape users. Or better yet, just open source Landscape.

comments