sslalready

Yes, most of your links (just like many of IBM's cloud related web services). If anything you, IBM and any potential customers, should be seriously concerned that they begin with http:// in the first place.

What's up with the lack of https and encryption in IBM's cloud? I'm sure your machine learning stuff is great and all but the lack of proper encryption and security measurements makes it a total no-go. How can you expect anybody to take your cloud services seriously when you do http in 2017? I'm asking as someone who had their boss talked into trying out ML stuff one Bluemix by your sales people.

Also new: callback for client cert selection during TLS handshake.

https://github.com/golang/go/issues/16626

I love your tag line here on HN! Some 15 yrs ago I was hired as a UNIX administrator at some larger company. Despite being fresh from school I already had plenty of experience from spending the 90's hacking and programming on whatever UNIX system fyodor or rootshell.com had an exploit for. When the DBA was leaving for vaccation they didn't hesitate in letting me take over his daily routines. On this particular summer day, I had a simple job: dump the production database and load the data into the test environment. I had to make sure the dump was finished before 4pm when the daily production run started (which, FWIW, continued well into the evening). This was an Oracle shop so I believe the commands were mostly "exp" and "imp" -- with the caveat that the imp command would need an additional parameter to select the test database instead of the production one that was the default.

Yeah, you see where this is going. The prod dump finished in time and shortly before leaving work I started importing the data. Then I sat around for a while before I realized I had forgotten about that additional "use the test environment" parameter -- and now I was importing a several hours old dump into the production database while the daily production run was running. I had to call company execs and explain the catastrophe to them, who in turn had to call in the vendor that sold us the system. Those were some pretty scary hours for a 20 yr old kid. Luckily it was just a matter of aborting the production run, reload the prod dump and then reschedule the production run for the day.

The next day I had to start my day at the vendor's place to get some shaming, but also a good piece of advice - "always say destructive things out loud before doing them". Then they continued to tell me stories of people they had worked with who really messed things up, and we all had some good, evil laughs.

Mistakes build experience, and hard learned lessons even more so. You now have a pretty good conversation starter to put on your CV. Personally I'd rather hire someone who was a "removal" specialist over someone who hadn't learned the skill yet. :)

I believe both GitLab and the community in general will come out stronger from this incident. Thank you all for being so transparent about it.

In a team where Node and Golang were the language of choice, we used GitHub private repos for code, TeamCity as the driver for CI/CD and Salt to deploy the Docker images to our different environments running on AWS EC2 instances. I must say I really liked TeamCity and its different integrations with GitHub, build processes (Node/NPM, frontend tooling, ..) and how variables could be shared down with project and releases.

To deploy code with Salt, we had an SSH account on the Salt server configured with a bunch of deploy keys. Each of those had a forced command that would read $SSH_ORIGINAL_COMMAND and forward this information to an agent (running as root) that would execute Salt with the correct arguments, based on information in $SSH_ORIGINAL_COMMAND. This let us use a build step in TeamCity that basically did ssh deploy@mgmt-gateway [env] [project] [version]. Deployments were logged to New Relic and Slack.

In a different team that are fond of PHP we use a private GitLab CE for code management, GitLab CI Multi-runner as the build agent for CI/CD, Ansible for configuration management and code deploys to different environments running on AWS EC2. Like in the previous team, we have configured our .gitlab-ci.yml to pass some arguments in $SSH_ORIGINAL_COMMAND over SSH to a management node that in turns talks to Ansible.

Something I like with having a private GitLab CE instance is that development doesn't stop because your public Git host is DDoSed or have other problems (like the recently discussed one here on HN).

Test and staging servers are shutdown/destroyed off-hours and restarted/recreated by cron jobs that execute Ansible plays which identify eligible EC2 instances via EC2 tags. Production environments with multiple servers are similarly scaled down during off-hours. By simply modifying/removing the "shutdown" tag from the AWS resources, teams are able to exclude their test/staging environments from the scheduled shutdowns, something which is useful for upcoming releases. ;)

In the Node/Golang shop I loved how simple Docker images were and how good it felt to deploy it to isolated containers. Unfortunately, I don't see how that's possible (in a clean way, preferrably without using two images) when both an Nginx process (static file serving, e.g. frontend resources) and a PHP-FPM process needs access to the same code release.

(If you have experience with Nginx/PHP-FPM apps and Docker, feel free to enlighten me!)

Things I'm not entirely fond of about GitLab CI is that:

- each branch in each repo must have a .gitlab-ci.yml that is up-to-date (administrative challenge!)

- it's entirely driven from a git push (though the web gui provides buttons for existing builds to retry/manually execute steps to e.g. deploy code)

GitLab has no support for a centrally managed .gitlab-ci.yml file on a project group and/or project level. There's no way to define variables on a project group and/or project level. There's no way to schedule jobs so that you can execute daily/weekly tests, or to manage jobs (in a user-friendly way via the web gui) that perform cron-like tasks, so you can avoid putting these tasks on the server themselves in /etc/cron.d (which becomes a problem when you restore backups / bake AMIs / do auto-scaling).

I'd love to look more into K8 and Google's cloud offerings, especially since I believe this might be the future and because I believe Google are lightyears ahead of the competition when it comes to security and protecting the privacy of its customers. Unfortunately I'm afraid it's not viable given my team's current investment in Nginx/PHP-FPM apps and various AWS services.

It would be nice if the client was usable without having to register with you guys. Is that something you're looking into?

PS. SSL Labs gives your site an F grade due to CVE-2016-2107.

Cool, thanks for the tip! Will definitely check it out. It's going to be interesting to see how it responds to https://www.emailprivacytester.com

I'll second this. I too went through a whole bunch of Linux distros a few years ago, and found Fedora to provide the best (looks and functionality) experience for me.

Currently dual booting it on one MBA11" 2012 and one MBA13" 2014 (wifi via the proprietary wl driver).

The two things that have kept me from switching completely from macOS to Linux (currently Fedora) all these years have been a good alternative to Mail.app and Sequel Pro (MySQL client).

Are there any good alternatives available on Linux?

Here's an excerpt from a success story posted at https://sourceforge.net/p/openvpn/mailman/message/34991937/

We've implemented 802.1x with dynamic vlan assignment already, meaning that when a user connects either wired or wirelessly they get shunted into the appropriate segment of the network (and potentially into overlapping subnets). This ensures strong segregation based on their identity/certificate. So we really want to plug openvpn into that and allow users a single certificate to always end up in their same segregated section of the network without having to create separate VPN subnets for them.

TLDR: These patches allow OpenVPN to be used in enterprise environments with RADIUS authentication and dynamic VLAN assignments.

FRA made a deal with an entity called Krigsarkivet, a Swedish national archive for military history, to store data they collect in and around Sweden. For like, future research. Naturally they couldn't store this data within the Krigsarkivet's existing archives, so K had to open an archive on FRA's premises. Because this was for future research, the deal was that they were, you know, just to store the data and be done with it. Of course, that's not what happened at all. Instead, they're actively maintaining the archive, meaning that they're effectively using the "for future research" K archive as their own XKeyScore.

OpenSCAD is great for these things. A gasket would be the difference() between two cylinder()s for example. Check this out: https://www.google.de/amp/s/cubehero.com/2013/11/19/know-onl...

Speaking of UX, would you consider improving the look of Markdown rendered text (usually README.md) in the repo browser? On GitHub they look great and it's a pleasure reading Markdown formatted text there. In GitLab it's however not very appealing. Headers, spacing between them and paragraphs doesn't look very good IMO.

Coming from a previous job where we used GitHub and TeamCity, something I miss with GitLab is the ability to create a pipeline that's not connected to a specific Git branch. I'd like to be able to create a pipeline that can be triggered manually, without first having to create a dummy branch to put a .gitlab-ci.yml there. Is that something that's on your roadmap?

That's what he went by on IRC in the early 2000's, yeah. I think a more correct description would be "script kiddie" ;) Despite being considered pretty lame, his company Data Protect managed to attract a few top names in the community. Those years marked the beginning of a (very sad) era where more and more of the really skilled hackers started to sell out to the shady, greedy IC and security industry.

Kind of expected that you would be able to search all of GitHub there but it seems to be limited to selected libraries and your own repos? Also, surprised that C is not supported.. Personally I'm using GitHub's code search to discover dumps of code and docs for random Chinese hardware (SBCs and such). I've found it much easier than trying to find SDKs on Baidu's file sharing site (Baidu Pan).

It's part of the Command Line API which most browsers implement in their dev consoles. http://getfirebug.com/wiki/index.php/Command_Line_API

In at least recent versions of Firefox and Chrome, a reload includes a `Cache-Control:max-age=0` with the request. During a forced reload (e.g. Shift-Reload), both the legacy `Pragma:no-cache` (HTTP/1.0) and the more modern `Cache-Control:no-cache` (HTTP/1.1) headers are sent.

> You should consider the argument you'd make that downloading, possessing, and publishing (if seeding) US government employee credentials doesn't violate the Computer Fraud and Abuse Act.

As usual the rest of the world is not a place within the US. It's a shame some people keep overlooking that.

I can only speculate but there is some prior work in this area, for instance SkyJack (http://samy.pl/skyjack/).

Quote: SkyJack (available from github) is primarily a perl application which runs off of a Linux machine, runs aircrack-ng in order to get its wifi card into monitor mode, detects all wireless networks and clients around, deactivates any clients connected to Parrot AR.drones, connects to the now free Parrot AR.Drone as its owner, then uses node.js with node-ar-drone to control zombie drones.

There is also some info/links regarding DJI's Phantom line of drones on https://github.com/noahwilliamsson/dji-phantom-vision

Quote: The Range Extender is essentially a small Linux system based on OpenWRT which provides a WiFi-network used by the Phantom and the DJI Vision App. It's reachable over SSH at 192.168.1.2 (root / 19881209). The WiFi-network has no security by default and neither the Phantom nor the DJI Vision app supports password protecting it. Additionally, it is required that the network name is prefixed with "Phantom_" in order for the Phantom to find and associate with it.

I think this happens pretty much everywhere a mobile carrier can profit from selling data about who's doing what. For example, Norwegian company Mobiletech.no has API access to the largest, Nordic mobile carriers' billing gateways and can turn an IP address:port pair from an HTTP/HTTPS connection into a MSISDN, sometimes with additional subscriber details. They're working with advertisers and analytics companies to help them count mobile subscribers instead of unreliable, cookie-based visitors. Similarly, mobile carriers in Denmark have been caught injecting HTTP request headers which leaked the subscriber's phone number, phone model, etc to arbitrary web sites. In Sweden, someone used a similar service to blackmail visitors who watched porn.

> FWIW IOS backdoors were already being researched by 2003 [...]

I recall there was a Swede (the grue?) on the Pull the Plug IRC network who was cross-compiling and linking in backdoored object code in Cisco IOS images already back in 2000.

Usage of openssl has been deprecated since OS X 10.7 in favor of Secure Transport and Common Crypto. Furthermore, OpenSSL is not even supported on iOS. See: https://developer.apple.com/library/ios/documentation/Securi...

>> the pair downloaded police and social security files. > What exactly are those? and what would he even want them for?

The mainframe logs show that a dataset containing a copy of the Schengen SIS was downloaded from the hacked mainframe. I don't know if the file was even found on mr Svartholm's computer. The prosecutors just concluded that they couldn't tell what happened with the datat that had been copied out from the system and therefore mr Svartholm probably did something evil with it.

So what's in Schengen SIS? It's a list of personal details for more than 1 million(!!) people that are either wanted by participating states, under surveillance or people that just lost their passports or other identity documents. You can read more here: https://en.wikipedia.org/wiki/Schengen_Information_System#Da...

The government of course would like to claim that the data managed in Schengen SIS is extremly sensitive. Meanwhile they ship this data over the internet with plaintext FTP to various entities participating in Schengen SIS on a monthly basis (updates etc).

>> In a separate trial in 2013, Mr Warg and accomplice were found guilty of breaking into the computer systems of computer services firm Logica, which was doing work for Sweden's tax office and a bank. > Again, why would he hack into a bank knowing so many eyes are on him?

He was completely acquitted of the charges involving Nordea Bank in the Court of Appeals (Hovratten).

Disabling SSLv3 will indeed affect a significant amount of clients in the real world.

I've seen a few commenters here on HN that point out that pretty much everything since Windows XP (ignoring IE6) supports at least 1.0 of the TLS protocols. While that may be correct in theory, in practice it's not.

At a 1MM+ visitors/week site we still see a few percent of our users that regularly connect using SSLv3 across different versions of Windows, including more modern ones such as Windows Vista, 7 and 8(!)

Though I'm not sure why this is the case, antivirus software suites such as McAfee[1] have in the past been known to disable TLS 1.0 system wide in Windows.

[1] http://answers.microsoft.com/en-us/ie/forum/ie8-windows_othe...