Hacker News Reader

Hacker News

Comment by jraph | Hacker News Reader

Parent Full thread

jraph

Has someone ever tried to submit images from Google captchas to Google Images?

An answer like "This is definitely a sign" from Google Images would be funny.

View on HN

I just tried it:

http://www.jaruzel.com/files/streetsign.jpg

Of course if you start googling for street signs a lot, they'll hit you with a captcha for each search, so that you can't ask Google to solve their captchas for you until you solve their captchas.

Now try it with the Speed Limit sign. Does that count as a "street sign" or only ones with street names?!

Your SSL cert is for the wrong domain.

Your https-everywhere is doing it wrong. I don't have an SSL on my personal site (no requirement to). I do have SSL on other domains that share that IP however.

The idea that you have no requirement to is wrong - your site may not have sensitive information but without SSL it can be MITM'd and used as a vector for malware, ad injection, etc.

You argument is valid (somewhat), but I don't think that I attract enough traffic on a constant basis, to invest the time and effort to SSL up all my domains.

So far I've had a less than stellar experience with letsencrypt, so I'm not quite ready to go all free-certs just quite yet. It also requires a rebuild of my web-server[1] which I've been putting off for a very long time already.

---

[1] See my other post in this thread.

Why not just use Cloudflare? They do SSL termination for free, plus you'd get caching to boot.

So long as your site doens't have SSL you shouldn't be linking people to it. You're under no obligation to drop everything and fix your web server security but you should really stop using it until you do.

I'm not expert on this but what I'm seeing is that port 443 is serving up a response when jaruzel.com is requested on that port. While you may not be actively advertising that domain with https URLs, it is valid for clients to request one speculatively.

There isn't a valid cert for that domain and for some reason for server is offering a different one. Presumably you need to unbind 443 from that host header name (this is based on memories of configuring IIS a decade ago).

"port 443 is serving up a response when jaruzel.com is requested on that port"

The only response is a 404, which is exactly what should be displayed (to the best of my knowledge) for a domain that isn't configured for that IP/port when there are other sites utilizing that IP/port.

Oh dear, this hasn't gone very well has it. I'll have another look when I'm home, I thought I was closer to the mark. Thank you for the response.

So...

I have an IP... that IP points to a router, that router port-forwards ports 80 and 443 blindly to a web server, on that web server is a bunch of websites. IIS knows which ones to serve to clients based on a) the host-header, and b) the port.

jaruzel.com:443 is not valid, but because I run an older version of IIS[1], that does not support SNI, the cert is bound to the port, not the host-header. As such any domain name that points to the IP will dump you at that cert if you try to connect on port 443.

Hope this clears up any confusion. :)

---

[1] for um... reasons.

Thank you, I appreciate the detailed response :-)

Complaining about a non-existent SSL cert and then backseat driving the "fix", using words like "you need to", all based on shady memories of configuring IIS a decade ago?

Really?

Just having a chat about it really, sorry it rubbed you up the wrong way.

I'm cool with it. I like these sort of side-bar conversations.

Yes: https://www.blackhat.com/docs/asia-16/materials/asia-16-Siva...

Reply on news.ycombinator.com