mdewinter

Olimex is an amazing company. They make great boards, I've got a few that here that last +5 years already. Would recommend them to anyone.

I once wrote on this topic, numeric IP addresses:

https://raymii.org/s/articles/IPv4_Address_Conversion_Tricks...

This "feature" is documented in the inet_aton(3) manpage.

I love the nitrokey stuff. If you want some practical examples, see the articles I wrote on the different models: https://raymii.org/s/tags/nitrokey.html - both HSM, Pro, start (which is a gnuk stick).

Windows only, maybe the title can be changed.

Office 2010 and with the latest version Office 2013 work flawlessly with Crossover on Linux (and Mac): https://raymii.org/s/tutorials/Office_2013_and_2010_on_Linux...

The support of codeweavers is very good and fast as well, the two times I had to contact them.

The bottle system is amazing. It allows you to have multiple wine environments with different Windows versions seperated, so not just one Wine for all. Office 2003 runs on Windows XP, 2013 on a Vista env.

The bottles can be exported to RPM or DEB or shell installer for easy deployment as well. Plus the easy online database with appliations and profiles makes Crossover, for me at least, have a big advantage over bare Wine.

So how does a country technically shuts down the entire internet? Like this or what Turkey sometimes does?

I'm behind https://cipherli.st, together with some friends. IMHO there is no reason not to have HTTPS everywhere, especially now Let's Encrypt exists. I did think and discuss a lot with people on how 'strong' the page is, and if we might want to change that. The page is targeted at sysadmins who I expect to do at least some research before bluntly copy-pasting config files off somewhere, there are enough warnings on the page.

You are free to keep your opinion but the statement that such possibility "still beats the purpose of the HSM though" is not shared by many people.

I'm aware of the FIPS standard, therefore I worded the piece as my opinion. I think it's better to be able to rotate the keys then to restore to the same/other device. Since extraction might lead to decryption. I do also know that software-wise that is an inconvinience and in some cases not possible. Bur still, a device that protects private keys should not give them up. As you say, my opinion.

No, it is not a convenience. It is a manner to mitigate the risk of denial of service one may cause by purposedly destroying or stealing your HSM.

Stealing should be protected by the tamper-protection, thus causing a wipe of the device. In that case you might have a bigger problem, someone has access to your datacenter and racks. In that case a backup is very welcome. (I do find it a hard problem where the two sides, no backup, a backup, both are equally important.

I challenge this statement: I deal with most big-name HSMs (and there are not that many) and none of them can do this. I do know because that is a risk we explicitly check for when evaluating one.

We've had a situation were two different revisions of the same device were not able to load a wrapped key. Support flew in and told us they could fix in in a new firmware in three months, no guarantees. We installed screen recorders and a keylogger, since they were on our production env (audit logging). They did, with undocumented commands, export the key from the device in an unencrypted format and loaded it into the other model so that we could continue our operation. Reviewing the recording and the logs showed that the commands did also work on other HSM's we had. I'm still under NDA so I cannot talk about which brand or model specific.

I haven't looked into that yet, but it is on my list. Thanks for the link.

Author here, do note that device access and access to all previously setup passwords and PINs is required for this to work. It still beats the purpose of the HSM though. The article explains this a bit more in the #Rationale section. Happy to answer questions or comments.

If you have the config or required format for config I'd be happy to add it. Create an issue with the config,, I can do the code then

Not very often, mostly when someone sends a merge request with a new piece of software (like varnish).

That was a spin on the Heartbleed theme and personally, I like it.

Author here, please let me know any comments, issues or anything else.

I'm also behind other projects like an SSL (site) test, a fast one: https://ssldecoder.org/ and a certificate monitoring service (reminds you before expiring): https://certificatemonitor.org/.

Also my personal site describing my adventures in *NIX and cloudland: https://raymii.org/s/, plus a boatload of TLS related articles.

The mozilla guide is also very good, the ability to configure based on your server settings and browser support is a heck of a nice feature. Whenever I have time to learn javascript that's the first thing to implement.

Although, all my projects are open source (https://github.com/RaymiiOrg/) so merge requests are welcome. Ferm GPL believer here.

This is also a nice simple and cheap device running OpenWRT ($25) with Wireless N, 2 100 mbit lan and USB: https://revspace.nl/GL-iNet - http://www.gl-inet.com/.

I've got a about 50 deployed, managing them with Ansible, super nice and cheap. USB powered as well.

This is nice, thanks!

My side project tries to give secure default settings for all major webservers and other software (like haproxy, mysql, mailservers etc): https://cipherli.st/

From the start it has listed the suggestion to set up >SHA256 keys.

If you want to test your site for a SHA 1 cert, you can try my other side project: https://ssldecoder.org/ - you can also use the SSL labs test but mine is faster for just testing certificate type. (And it's open source, so you can use it internally as well).

Mozilla also has a good wiki page for SSL recommended settings: https://wiki.mozilla.org/Security/Server_Side_TLS

My side project tries to give secure default settings for all major webservers and other software (like haproxy, mysql, mailservers etc): https://cipherli.st/

From the start it has listed the suggestion to set up >2048 DH keys.

If you want to test your site for export ciphers, you can try my other side project: https://tls.so/ - you can also use the SSL labs test but mine is faster for just testing ciphersuite. (And it's open source, so you can use it internally as well).

Mozilla also has a good wiki page for SSL settings: https://wiki.mozilla.org/Security/Server_Side_TLS

I see what you did there. Tarsnap is awesome indeed :)

This is a seriously awesome podcast. Consider listening to it, the amount of knowledge combined with two bsd-loving hosts is amazing!

ChaCha20 support is not in Openssl 1.0.2 yet, only an outdated dev branch. When it's in, it'll support it.

How would I detect boringssl?

It also does custom ports and protocols, for example 8443, 465 (SMTP), 994/995(POP/IMAP) etc.

No particular reason. What would you do different?

Known issue. Have to look in to that...

I do have a JSON (plain text, readable json) output endpoint planned, but that will be GET as well. Pull requests are welcome though.

That's a good idea. Chain issues are already reported, but expiry or validation errors should be prominent as well.

My weekend project.

* Tries to give all the information you need instead of a rating.

* Open source, so you can self host it.

* Does the entire certificate chain.

* Allows to paste a CRL/Cert

* Validates the certificate, chain, CRL and OCSP (of every cert in the chain)

* Has easy copy-pastable PEM versions of certs

* Ciphersuite enumeration as an option.

* Fast.

Then shouldn't revocation be fixed?

Do note that you need TLSv1.2 to connect to the website, or plain HTTP.

I just manually converted this article from PDF to Markdown and HTML for easy of copy pasting and archiving.

If you like it, please subscribe to Linux Voice. It is an awesome magazine with an awesome team of people. Subscribe via http://shop.linuxvoice.com/ from just GBP 38 and get future issues straight to your door or inbox! (DRM Free PDF's and more available).