Hacker News Reader

bracewelon Go has added Valgrind support

This is mainly actually for testing constant-time code, rather than doing proper memory tracking (see https://www.imperialviolet.org/2010/04/01/ctgrind.html for a slightly out-of-date description of this technique).

bracewelon Go has added Valgrind support

Author of the linked CL here: we added this mostly so that we could abuse the memory initialization tracking to test the constant-time-ness of crypto code (similar to what BoringSSL does, proposed by agl around fifteen years ago: https://www.imperialviolet.org/2010/04/01/ctgrind.html), which is an annoyingly hard property to test.

We're hoping that there are also a bunch of other interesting side-effects of enabling the usage of Valgrind for Go, in particular seeing how we can use it to track how the runtime handles memory (hopefully correctly!)

edit: also strong disclaimer that this support is still somewhat experimental. I am not 100% confident we are properly instrumenting everything, and it's likely there are still some errant warnings that don't fully make sense.

bracewelon What it means to see a 'bad' certificate in TLS Certificate Transparency logs

There is a fifth, incredibly common, (arguably) non-malicious possibility.

You don't control the entirety of your web stack, and your hosting provider, or DNS provider, or someone else, has decided to be 'helpful' (either blindly, or due to some misconfiguration somewhere along the line) and issue a certificate on your behalf, as they are able to intercept CA validation traffic at the DNS, TLS, or HTTP layer.

bracewelon No Radical Changes in GNU Project

ah yes, I remember personally lying to congress and pushing false narratives in the media. oh wait, no, that wasn't me was it...

bracewelon Let's Encrypt Root Trusted by All Major Root Programs

Note that CABF bylaws require a simple majority of browsers to vote positively for a ballot for it to pass, regardless of how CAs vote.

bracewelon What It Costs to Run Let's Encrypt

> CA/SSL specification does not change weekly...

The draft ACME specification does though.

bracewelon Let's Encrypt now fully supports IPv6

DNSSEC is enforced at the resolvers.

bracewelon Let's Encrypt now fully supports IPv6

Yup.

bracewelon Reflections: The ecosystem is moving

Google did not write the HTTP/2 spec.

While Roberto Peon is one of the authors (and a core developer of the preceding SPDY protocol) saying that HTTP/2 is some Google invention is a bit of a punch in the face to the IETF and the two other authors who do not work at Google.

bracewelon Learning from Tay’s introduction

It allowed users to bypass Twitter blocks by tweeting at the bot while tagging users that block them, which seems pretty bad and was abused very quickly. Also it's a violation of the Twitter TOS.

bracewelon Uber Engineering Bug Bounty: The Treasure Map

> paltry $15k

The tech/security community is crazy.

bracewelon Going Fast Slowly

> The two CVEs against Varnish were both utterly bogus "trophy-hunter" CVEs in my opinion. (But don't take my word for it, judge for yourself.)

> CVE-2013-4484: Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.

bracewelon Political Correctness Killer for Social Media

Dope watermarks.

bracewelon Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision

Guh, until CF/FB can provide some data that shows users with no upgrade path are genuinely going to be effected by this, and not connections MITM'd by some crappy AV or other random middlebox the LV proposal seems like a pretty silly idea...

https://www.cabforum.org/pipermail/public/2015-December/0064...

bracewelon Android NDK: GCC is now deprecated, everyone should be switching to Clang

waits for RMS to get mad

https://gcc.gnu.org/ml/gcc/2014-01/msg00247.html

bracewelon Public Beta: December 3, 2015

Many hosting providers are choosing to integrate LE into their products directly so even if you don't get shell access you will still be able to get a cert. As far as I know both Plesk and cPanel are also working on official plugins for their software.

bracewelon Sustaining Digital Certificate Security

>Symantec performed another audit and, on October 12th, announced that they had found

>an additional 164 certificates over 76 domains and 2,458 certificates issued for

>domains that were never registered.

bracewelon Let's Encrypt is Trusted

The backend and client are both very large, very different projects that share a small crossover (the ACME protocol) and were written by two different teams.

I can't speak exactly to why Python was chosen, but it should be noted this isn't intended to be the be-all-end-all in terms of clients. There are already a number of other independent clients that have been developed for various different purposes.

bracewelon Let's Encrypt is Trusted

The general availability period hasn't begun yet, but you can still sign up for the beta program here -- https://docs.google.com/forms/d/15Ucm4A20y2rf9gySCTXD6yoLG6T...

bracewelon Let's Encrypt is Trusted

A quick look at all the certificates Let's Encrypt has issued so far can be found using Comodo's CT based crt.sh tool.

https://crt.sh/?Identity=%25&iCAID=7395

bracewelon Let's Encrypt is Trusted

This is something we entirely plan on doing, in fact we currently submit all issued certificates to a number of CT logs (which can be viewed here https://crt.sh/?Identity=%25&iCAID=7395).

Unfortunately the best candidate, at least for us, for supplying SCT receipts to end-users, via x509v3 extensions in OCSP responses, is currently not fully supported in Golang.

bracewelon Let's Encrypt is Trusted

ISRG, the org behind Let's Encrypt, is hiring! -- https://letsencrypt.org/jobs/

bracewelon Our First Certificate Is Now Live

Either wait for the certificate to expire, register a new certificate for the domain with another CA which LE will see and can then be used to prove ownership, or ask the originally issuing CA to revoke the certificate which will remove the need for the challenge completely.

bracewelon Our First Certificate Is Now Live

Boulder (the CA backend) has two solutions to this problem

a. if we know of an already existing certificate for the domain that is being authorized you must prove control over both the server and the key used in the existing certificate

b. validation is done over multiple paths to confirm results, an attacker would need to be able to hijack connections from all of our validation servers in order to cause miss-issuance (servers which would move over time)

Currently (a) is mostly implemented but (b) needs quite a bit more work before it can go live.

bracewelon Our First Certificate Is Now Live

That's the relatively simple case, but there are a number of corner cases that make the process much more complicated.

See https://github.com/letsencrypt/acme-spec/pull/97 for a discussion of why this was scraped from the ACME specification proposal.

bracewelon Our First Certificate Is Now Live

The major problem with this is that the IETF validation working group hasn't come up with a definite procedure for deciding what the apex of a domain is, and how to validate control over all subdomains above it yet.

bracewelon Miyazaki's Beautiful Anti-War Dreams

The post seems a little confusing, Howl's Moving Castle was in fact written by Diana Wynne Jones 18 years before the Studio Ghibli adaptation.

bracewelon Let's Encrypt Launch Schedule

All the services provided by Let's Encrypt will be completely free, including revocation.

bracewelon Lucene: The Good Parts

sigh HTTPS mixed content... really?

bracewelon Show HN: Self decrypting scripts using Bourne and gpg

also on github: https://github.com/rolandshoemaker/raziel