Hacker News Reader

pquernaon RethinkDB needs a new home

The Apache Foundation doesn't "make" projects successful or failures, it provides a home. The foundation doesn't employ developers or really allocate resources for a specific project. It is a "home" with a legal structure, IP structure, some infrastructure, a recurring conference for community events, etc.

I think most people misunderstand the ASF. It is not meant to be the home for every software project. It is meant to be the home for projects that care about community and long term stewardship. By long term, I mean, more like 100 years than the next 10 months.

It has successful projects, and failures. Maybe it should be more vocal about the successes, but Apache isn't. The foundation isn't flashy. It isn't "hip". It shouldn't be. It's supposed to outlast the corporations we think about today as giants.

(I'm an ASF member)

pquernaon Ask HN: Who is hiring? (October 2016)

ScaleFT | SF | Software Engineer | ONSITE

ScaleFT is a software security startup. If you already know about Google's BeyondCorp papers, then you will understand where we are going. We have created a new model of device attestation with ephemeral certificates for SSH & RDP, to provide authentication, authorization and user management.

We are looking for full time Staff Engineers in San Francisco.

# Client Engineer

This role is primarily in Go, but there is a mix of platform specific C, ObjectiveC and C#. Generalists & systems people have fun here.

The ScaleFT client software encompasses our ScaleFT Server Agent (sftd), our command line tools (sft), and our native client user interfaces on macOS, Windows, Linux, ChromeOS and FreeBSD. Our client software is how our customers interact with the ScaleFT platform, with the goal of make managing cloud infrastructure safer and more secure. This client software integrates our platform’s certificates into the native operating systems cryptographic stores (eg, Keychain on macOS).

https://www.scaleft.com/careers/staff-engineer-client/

# Backend Engineer

This role is primarily in Go. This role is focused on adding features and scaling the ScaleFT platform, which we sell as both a SaaS and on-premise. Experience with PKI is a major plus:

https://www.scaleft.com/careers/staff-engineer-backend-servi....

If you are interested, shoot me an email paul.querna@scaleft.com

pquernaon WoSign and StartCom: Mozilla’s proposed conclusion

Completely Agree!

When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.

pquernaon WoSign and StartCom: Mozilla’s proposed conclusion

Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code:

CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets

HSTS Preloading: https://hstspreload.appspot.com/

more: https://www.chromium.org/Home/chromium-security/security-faq...

pquernaon WoSign and StartCom: Mozilla’s proposed conclusion

While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting:

> no longer accept audits carried out by Ernst & Young (Hong Kong).

To reject audits from E&Y.... It makes me wonder about the transparency and trust we put in the auditors as being a key part of CA validation process.

pquernaon An Important Message About Yahoo User Security

Does NSA tapping Google's fiber count: http://www.bbc.com/news/world-us-canada-24751821

pquernaon Companies and Billionaires

Short answer to your question is "Private Banking":

https://en.wikipedia.org/wiki/Private_banking

You have a specific account manager, who you know, and is in communication with you about that Jet purchase. Yes, it probably is a wire, but maybe to an escrow, depending.

pquernaon Continuous Intrusion – Why CI tools are an attacker's best friends (2015) [pdf]

In any larger environment or company, assertions like "everyone's keys have a strong passphrase" are basically impossible to make.

Multi-Factor into the VPN or SSH bastion is a good idea to look at.

pquernaon Ask HN: Who is hiring? (September 2016)

ScaleFT | SF | Software Engineer | ONSITE

ScaleFT is a software security startup. We have created a new model of device attestation with ephemeral certificates for SSH & RDP (today), to provide authentication, authorization and user management.

If you already know about Google's BeyondCorp papers, then you will understand how it works quickly.

We are looking for full time Staff Engineers in San Francisco.

# Client Engineer

This role is primarily in Go, but there is a mix of platform specific C, ObjectiveC and C#. Generalists & systems people have fun here.

https://www.scaleft.com/careers/staff-engineer-client/

# Backend Engineer

This role is primarily in Go. This role is focused on adding features and scaling the ScaleFT platform, which we sell as both a SaaS and on-premise. Experience with PKI is a major plus:

https://www.scaleft.com/careers/staff-engineer-backend-servi...

If you are interested, introduce yourself with an email to careers@scaleft.com, or I'm pquerna on freenode or gophers slack.

pquernaon Reimagining the future of routers

As deployed, most OpenStack SDNs will use OVS or similar software on top of a (xen,kvm) Hypervisor, connected to some kind of central controller, which just maybe would look kinda like OpenFlow. But all of this is running as an overlay on top of a much more traditional network.

This is very different than a TOR switch or core-router running OpenFlow. Only a few places are running more than a couple thousand VMs in a single SDN, and its nothing like what is being discussed above.

pquernaon TOTP SSH port fluxing

Neat project. What we've been doing is using provider (software) firewalls for whitelisting IPs at the bastion level.

In AWS we have a security group just for the Bastion inbound, and adding/removing IPs to that on-demand to allow access. I kind of assumed this was standard practice by now?

pquernaon Senate Passes Bill Exposing Saudi Arabia to 9/11 Legal Claims

From Wikipedia:

>> The 9/11 Commission stated in their final report that the "9/11 plotters eventually spent somewhere between $400,000 and $500,000 to plan and conduct their attack"

Still a non-trivial amount of financial support.

pquernaon Senate Passes Bill Exposing Saudi Arabia to 9/11 Legal Claims

That is a massively simplification and frankly very wrong.

Several of the 9/11 Hijackers enrolled in flight schools:

https://en.wikipedia.org/wiki/Hijackers_in_the_September_11_...

https://en.wikipedia.org/wiki/Planning_of_the_September_11_a...

And were otherwise supported to operate inside the US for many months.

pquernaon Show HN: ScaleFT, Login to Servers Using Google Apps Auth

co-founder here, happy to answer any questions!

We've been working on making ephemeral client certificates easy to use, and bridging SSH & RDP to things like Google Apps authentication is an example of what you can do once you get to make new identity attestations every few minutes.

pquernaon Rethinking PID 1 (2010)

sshd and apache2 for example both support systemd socket activation -- whether distributions actually do that is up to the distros. CoreOS for example runs sshd via socket activation.

pquernaon Rackspace Interview Process

I don't expect a candidate to have STAR response out of the box at all.

I would ask each part of STAR, directly to the candidate.

The goal is to actually understand what the candidate did, less what "we" did.

- Tell me about a time there was a production outage?

- What was your role in the team? Were you on call?

- [ questions about what happened ]

- How was it fixed? What was your part in this?

- What did your team change afterwards?

- How do you think about production outages now based on this one?

pquernaon Rackspace Interview Process

I wrote this article in 2014, but left Rackspace a year ago.

The STAR answering format is the single clearest thing I'll take with me as a good interview practice.

It keeps both the interviewer and interviewee honest and on track. I find it helps figure out what a person actually did: Yes, a whole team shipped X, but what was your role in it? Tech Lead? What did that mean there? Responsibilities and how did that turn out?

pquernaon How We Saved $132k a Year With an IT Infrastructure Audit

It depends on the CDN, but for example Fastly calls what the op was suggesting "origin shield": https://docs.fastly.com/guides/performance-tuning/shielding

pquernaon Amazon bans the sale of rogue USB-C cables

Just happened to us this weekend, exact same situation.

I wonder if it is because USPS Weekend delivery isn't the normal "route" person, and they just don't try to get into multi-unit mailrooms?

pquernaon Performance and Usage at Instagram

If you are building a new app, I'd really suggest checking out gRPC:

http://www.grpc.io/

The combination of an HTTP/2 stack w/ protocol buffers and libraries in everything you'd write a mobile app in is a powerful combo, and its a pretty high development velocity environment.

pquernaon Secret Memo Details U.S.’s Broader Strategy to Crack Phones

Aassuming this was real, Apple would store the private key in Keychain[1]. Keychain is encrypted with your login password generally, and can have an ACL to only allow iTunes.app as an allowed application without further user prompting.

[1] - https://developer.apple.com/library/mac/documentation/Securi...

pquernaon Glibc getaddrinfo stack-based buffer overflow

For example, Node.js still has test case failures when running on musl on Alpine Linux:

https://github.com/nodejs/docker-iojs/issues/44#issuecomment...

Most apps will work out of the box, but you can see in that issue 1+ year of various people debugging and fixing issues to just get existing test cases to pass.

pquernaon Parker Conrad Steps Down as Zenefits CEO

David Sacks joined Zenefits about 13 months ago, so I presume while as COO he is somewhat responsible, it seems far more likely his opinions being different from Conrad is what led to Conrard's removal.

pquernaon Some OS X Applications Vulnerable to MITM Attacks

Right, the ability for an attacker to change an XML file like this could be considered two separate issues.

Things like this is why The Update Framework (TUF) Specification was created:

https://theupdateframework.github.io/

The specification covers exactly this kind of attack and has signing of all of the data about an update:

https://github.com/theupdateframework/tuf/blob/develop/docs/...

But, as far as I know, there isn't an implementation of TUF that works with ObjectiveC and all the other parts of Sparkle, to actually update an OSX application.

pquernaon Posting successful SSH logins to Slack

(disclaimer, I'm a co-founder of ScaleFT)

If you are interested in a commercial solution in this space, check out ScaleFT. Besides the dynamic SSH certificates, we also track both SSH keys used and access events, which you can then pull via an API across all your machines. We also have a Slack notifier, though It needs a little love & cleanup.

We're currently in what I could best call a beta: https://www.scaleft.com/

pquernaon Before Growth

I think the right initial metric is “do any users love our product so much they spontaneously tell other people to use it?”

Many larger companies use "Net Promoter Score", as a way of telling this:

https://en.wikipedia.org/wiki/Net_Promoter

Of course, like Agile, there are Consultants, a methodology and books, but there is some truth in asking your customers if they would promote you to another person.

pquernaon OpenSSH: client bug CVE-2016-0777

The main issue identified by Qualys is a more generic memory disclosure bug:

https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-077...

This means they are basically able to dump the memory of just the running `ssh` process -- eerily similar to Heartbleed.

This means private keys stored by the `ssh-agent` process, outside of the `ssh` process connecting to an Evil Server(TM) are not affected.

This is because the protocol used between SSH Agent and SSH client does not transfer the entire private key, rather the SSH client asks the Agent to do a signing operation on it's behalf.

pquernaon Non-Unique SSH Host Keys Ed25519 on Hetzner

A SSH private key is just some bytes. Once you have access to it, you have access to it forever in the future. RSA doesn't care if you are an "authorized employee".

A static SSH key for a single human is already risky over a long time period, but for a key that is shared between multiple humans... wow.

pquernaon The Architecture of Open Source Applications: Nginx

Hi, I'm one of the main authors (along with others, it is a community driven project) of the Event MPM for Apache.

On Benchmarks and timelines: I agree that 2.2+ was not widely available for many years due to the update cycle of linux distributions, but at the time nginx wasn't in the distros... so it become a thing where people would yum install apache2, get a 2-5 year old version, and they would benchmark that against an ngnix from their latest dev download.

The original work for the Event MPM started around 2004:

http://mail-archives.apache.org/mod_mbox/httpd-dev/200411.mb...

The version in 2.2 was mostly focused on Keep-Alive requests. Apache 2.2.0 was first kicked out on December 1, 2005.

To go beyond Keep-Alive requests, is a set of features/patches called "Async Write Completion". Much of this work was done in 2006-2007 by Graham Leggett:

https://mail-archives.apache.org/mod_mbox/httpd-dev/201510.m...

Timing wise, most of that work did not find its way into a stable release until 2.4, which came out February 17, 2012. This is the date the article references.

pquernaon Inside the Sony Hack

This is very different than the Target hack -- we have become numb to credit card focused hacks -- we all know the drill, we just get a new card in the mail a few days later, and the banks are pretty good at detecting fraud: http://www.nasdaq.com/article/credit-card-fraud-and-id-theft...

To me both Sony and Ashley Madison are part of a very different type of hack, that we are just starting to understand.

They leak massive amounts of personal information, and this personal information can and does ruin lives. This article outlines much of the emotional turmoil that Sony employees went through, and in Ashley Madison, there were suicides as a result:

http://money.cnn.com/2015/09/08/technology/ashley-madison-su...

You can rotate your credit card number, but rotating your real life is not possible.

I don't see a way out. Going anonymous might be possible for living on the internet, but you cannot be anonymous to your employer.