konklone

That's right, but the root cert is not sent by the server (in my case). More importantly, SHA-1 isn't a problem for root certs, as their signature is not used to verify their integrity.

It's a roundup of last week's news, and (hopefully) better all-around explanation and background for people with less technical knowledge. It also points people to another tool I made, https://shaaaaaaaaaaaaa.com, to actually do the SHA-1 check.

I added links to both papers to the bottom, and removed the "we'll probably need to upgrade" to SHA-3 sentence fragment.

> Another way to think about SHA2 and SHA3 is that it's entirely possible that SHA3 could fall before SHA2 does. They are unrelated algorithms.

Very good point, though I would expect SHA2 to see far more research on weakening it. It's been around a lot longer, and its wider deployment makes it a much higher value target. (Is SHA-3 supported anywhere right now?)

a) This is great. Also, a friend linked me to Expedited SSL yesterday and I link to it in the bottom of this post.

b) I think its SHA-1 scanner is mistaken - it flags my site as using SHA-1, but it's SHA-2 in every cert in its chain: https://www.expeditedssl.com/simple-ssl-scanner/scan?target_...

SHA-256 is a form of SHA-2.

They can be seen in the Chrome discussion thread, complaining to Google that the timeline is too aggressive. But they're a good company, and I imagine they'll update as soon as they can.

@tptacek - I tried to include enough detail to make it clear that a SHA-1 forgery isn't as trivial as a brute force. That you'd have to "coax a Certificate Authority" into issuing you a targeted forgery, and that that's what the MD5 team did.

The SHA-3 mention at the very bottom was in the spirit of "all things are broken eventually", not a specific comment on SHA-2 (though my understanding is that there are some conceptual weaknesses that have been identified). I don't think I've confused the issue there, but if I see confusion I'll definitely update it.

A .deb package sounds like a terrific idea!

Mark Nottingham, who's chairing the working group, and has been at this stuff for a while, has a blog post about this: https://www.mnot.net/blog/2014/01/04/strengthening_http_a_pe...

Chrome and Firefox will still insist on TLS for HTTP/2. In addition, the HTTP/2 spec does mandate that any implementation must support TLS 1.2 and up, and it must support forward secret ciphersuites.

http://http2.github.io/http2-spec/#TLSUsage

It's much more important than that. Yes, the protocol says it's only for errors/deviations. In practice, the changes can be more substantial.

The vast amount of legal, scholarly and media attention to an opinion happens on release day. When words change after release day, the public deserves to be immediately clued in to that -- even if many/most of them end up being typographical.

This is the NYT article that drew a lot of attention to the practice: http://www.nytimes.com/2014/05/25/us/final-word-on-us-law-is...

I think this is such a great example of a small bit of tech that completely changes the dynamic of how we understand the Court's work.

The NYT spent a whole high-profile article highlighting the issue of a silently shifting court record. This completely removes the "silently".

I'm so glad you noticed it :) do you work in the field, what got your notice?

Man, I love this thing.

For extra beauty, turn on the pencil (it can stay the default color, black) and click-drag it across the canvas any which way while there are colors interacting.

It's fascinating to watch the darker colors quickly give way to light ones.

We could also do PRs accepted, or issues closed, or other things a little less squishy than commits. But either way - it'll probably be fine.

Don't underestimate how much work Twitter has to do with a global namespace. Brand protection complaints and negotiation, conflict resolution, allowing renames, allowing reuse of abandoned names...it's not trivial, and unlike the Internet (where every registrar deals with a piece the userbase), they centralize all that labor.

I wonder if even that's feasibly secure though, when you have stuff like http://esprima.org that can let you fully parse the entirety of the JS on the page.

It's better to assume the console has 100% root (client-side) privileges.

This isn't related to the topic - the practice under discussion, while terrible, has nothing to do with the Internet at all.

This is a terrifying story, and I'm very glad Hiroshima wrote it, because I didn't have two factor auth turned on with my domain provider. Now I do!

It seems like if he'd had 2FA turned on with GoDaddy, this may not have happened. So rather than use @gmail.com addresses to register for things, as he recommends, just turn on 2FA with your provider. And if your provider doesn't support it, leave them and tell them why.

The admonition to use a @gmail.com address was annoying enough that I actually put up a response blog post just on this point: https://konklone.com/post/protect-your-domain-name-with-two-...

Yeah, I disagree with Naoki's conclusion. I'm pretty sure he just didn't have 2FA turned on with GoDaddy (which I understand - I didn't think to turn 2FA on with my provider until I read his story).

The admonition to use a @gmail.com address was annoying enough to me that I responded with a blog post: https://konklone.com/post/protect-your-domain-name-with-two-...

I've heard good things about self-hosted, open source Piwik: http://piwik.org/

Ditto. This interview needs to make HN's front page, but not like this.

interesting, I didn't know about that. You still end up having to do a toString override to properly suppress the 'undefined' return value though:

    window.__defineGetter__('help', function () {
        console.log('I\'m here for you'); f = function() {}; f.toString = function() {return " ";}; return f;
    });

But __defineGetter__ would let the execution of the command work in other places than the JS console, so that's cool.

it's actually a super tiny amount of JavaScript, you'd be surprised what you can do without something like jQuery bulking things up.

And there are some exceptions! The CFPB, in particular, has a number of extremely talented young people doing awesome work and in-house development for them -- and they open source a great deal of work: https://github.com/cfpb

There are lots of non-US examples here: http://government.github.com/community/

This is a great discussion of the issues involved, and should be required for anyone seriously trying to critique or criticize healthcare.gov.

I'm also a fan of Tom Lee's post (referenced by Phil) about the easy and hard problems of healthcare.gov, complete with a pretty good party planning analogy:

http://sunlightfoundation.com/blog/2013/10/05/easy-problems-...

Yeah, I use this myself a lot, especially when I'm in places with bad wifi.

I mentioned this in a separate comment, but I can use this as inspiration to try out Piwik (http://piwik.org), and see if it can replace Google Analytics.

I use Chartbeat for real-time-y stuff and alerts, which it's exceptional at. I think Piwik may have a harder time replacing that one, but I'll certainly try it.

I've been told Piwik (http://piwik.org) is very good. I'll give them a shot. If they're good enough, maybe I'll replace Google Analytics with them - then at least I own all the data myself.