tombrossman

Curious, should those of us using their Linux PPAs disable them until this is sorted? The idea of re-using disabled package names is out there now and I wonder how long it is before someone malicious tries this. Is this an unreasonable concern?

The simple 'Barcode Scanner' app on Android handles it easily. Here's a screenshot of the output: http://i.imgur.com/ELXvBqu.png

Failing that, just use an online reader and upload the PNG image of the QR code. Your pass rate should be 100%.

This is a good guide: https://scotthelme.co.uk/hpkp-http-public-key-pinning/

I had a difficult time getting it to work without throwing errors for either Nginx or SSL Labs tests and it was down to good old single vs. double-quotes. Copy-pasting the output from a policy generator is not at all guaranteed to work well.

Here's a template you can use, substituting EXAMPLE for your certificate hashes (and optionally the report URI). Tested and working on Nginx and multiple third-party validators:

add_header Public-Key-Pins 'pin-sha256="EXAMPLE"; pin-sha256="EXAMPLE"; max-age=86400; report-uri=" https://report-uri.io/report/EXAMPLE"';

I think the "always" is from Apache, and if I'm reading the site correctly it is an example of a header value being returned. An example Apache directive from https://cipherli.st/ would be:

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

That said, when I test an Apache site I've set up using that same directive I don't get the "always" so I'm not sure where it's coming from (in the example).

I see a surprising number of tutorials on blogs recommending 4096bit keys and I do wonder if people know just how much extra load that is. A properly set up HTTPS site with 2048bit certs will be pretty fast - about the same as HTTP and your time will be better spent optimizing other things like images.

For anyone curious about how much slower try "openssl speed rsa2048 rsa4096" for a quick benchmark. The results are ugly.

This is great and it comes just as several Dutch AVRO stations discontinue streaming, so I am actively looking for replacements. AVRO streams were 256kbit, and no talking ever - perfect!

You can find a decent list of streaming classical stations here, but many have occasional announcements and some do news breaks with extended talking. http://www.listenlive.eu/classical.html

For the simplest and lightest-weight streaming on Linux try Radio Tray (https://bitbucket.org/carlmig/radio-tray) which might be in your repos already.

Where's the announcement on Symantec's website? This links to a marketing blog promoting a different service.

There's a PDF in the third link going to Symantec's website, is that meant to be their official announcement? There are some pretty hefty conditions on this 'offer' and I wouldn't be surprised to see many opt to integrate Let's Encrypt into their hosting platform.

Look at this garbage, it's hardly appealing:

  Program requirements
  To participate in the Encryption Everywhere program partners must meet the following requirements:
   Be a partner in the Symantec Website Security Partner Program
   Agrees to an annual sales commitment
   Be a Hosting Provider or sell to a Hosting Provider who has at least 200,000 websites under management
   Enable DNS authentication
   Commit to execute regular campaigns to achieve agreed upon upsell targets
   Participate in quarterly marketing and business planning
   Bundle encryption into web hosting packages
   Provide first-level support to your customers
   Provide marketing and implementation support to your resellers, if any

EDIT: Here's Symantec's page offering DV certs, with prices starting at $399: https://www.symantec.com/ssl-certificates/ I don't see any free ones there, did I overlook them?

I have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct.

I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: https://developer.mozilla.org/en-US/docs/Web/Security/Public...

Can someone explain why it is not possible to simply ignore Canonical's aberrant behaviour and carry on as before? They aren't a court nor do they have any law enforcement powers, it's just a company expressing a preference.

Canonical: "We require that you remove all trademarks entirely even if using them wouldn't be a violation of trademark law."

The rest of the planet: "Go pound sand."

Isn't this a more logical response than submitting to their request? Are developers concerned that Canonical will haul them into court for an expensive legal battle, regardless of who is right? This can happen I suppose, but I am not seeing the down side to ignoring their demands.

My recommendation is to look beyond the free alternatives and consider how inexpensive paid certificates have become. These can be issued for lengths up to three full years and cost well under $10USD/year. Multi-year discounts bring three year certificates price to under $20USD.

Think about how much time it is going to take you to learn how to deploy and maintain your 'free' certificates and remember time is money. What do you make an hour? Is that more than the cost of a paid certificate?

I have used these certificates - https://cheapsslsecurity.com/comodo/positivessl.html - on multiple sites and it is very fast and easy. Other vendors sell them too and are likely just as good. Gandi do them too (at a slightly higher cost) and are the fastest method for me, though this may be because I have all my domains there already: https://www.gandi.net/ssl/standard?currency=USD#single

Don't waste hours chasing down free certificates when paid ones are so cheap now. Use Let's Encrypt only if you need lots of certificates and the paid options become prohibitively high.

Exactly, they've automated the issuance of free certs and revoking takes extra work. $25 sounds high (sub-$10/year certs with unlimited free revocation & re-issuance are easy to find) so it is a money maker for them but so what?

People think nothing of using the freemium model which gives you a basic product for free, and charges you for extra features. It's exactly what StartSSL are doing here.

I don't particularly like or use StartSSL, but much of the criticism of them sounds totally invalid to me. Paid DV certs are dirt cheap people, shop around!

One cool trick I learned was how you can take a normal remote control and view the IR light flashing when looking at it through your mobile phone camera. It's useful for determining if the batteries are still good in the remote, for example.

How does HTTPS help circumvent firewalls? I wasn't aware this was a feature. My understanding is that a firewall blocking file-sharing sites would do so whether the site was HTTP or HTTPS.

My point is that by using HTTPS, these sites have demonstrated a higher level of proficiency with security tools than many more popular mainstream sites. I agree the scammy fake download buttons are a problem though, but that's what ad-blockers are for...

Pirates that don't pay attention to security don't last very long, so I would tend to agree with that statement.

Try a quick survey of the most popular pirate sites and see how many support HTTPS. You might be pleasantly surprised.

Pi-hole is great and I had no trouble setting it up, but I couldn't continue using it as it constantly triggered NoScript's ABE (Application Boundaries Enforcer) which blocks scripts served from a LAN address. This is for a good reason, and it may be possible to white-list the Pi in the ABE settings, but I didn't have a good enough understanding of the implications to feel comfortable just allowing it or disabling ABE.

Strange, I get the same thing too despite the domain being among those whitelisted. I don't know how 'self' cannot equal securityheaders.io for a request to that domain.

I remember a while back when I was first using this I had a really difficult time getting it to work for a site I was doing. In the end, I had to remove all references to 'self' as a source and use the domain instead (even though these should be one and the same).

Underwater speakers exist (think synchronized swimming or a PA system at a public pool). The sound quality isn't super but voice quality is good. Is it possible the pool was equipped with one?

Well I'll say it then, you really should unfollow more people. To a point, the more you unfollow the better the signal to noise ratio improves. You just have to find that point.

It isn't crude or destructive at all because you will see those good quality tweets from people who are heavy users. You will see them when others who you still follow retweet the good ones. Your feed should be a solid mix of tweets you curated by following interesting people, and tweets those people curated for you by retweeting.

It can be a bit awkward to unfollow people you know because there is that social pressure to 'follow back' but this idea is worth it for the positive results.

To give a specific example, try unfollowing all local media outlets (newspaper, TV, radio) and instead follow one or two reporters whose feeds you find interesting. You will still see all the interesting local news and you avoid all the marketing and fluff that pollutes the media outlets' Twitter feeds.

I read every single Tweet in my feed every day and it only takes a few minutes. There is usually a ton of interesting and relevant stuff in there. I couldn't do this before, when I was following too many people.

GitHub does have that popularity and mind-share going for it, so I can see why people might not care to leave and create a new account at GitLab. The primary concern is the license which could be identical at either platform so that's a non-issue.

The primary difference is that GitLab (referring to CE, the 'Community Edition') is completely portable and self-hostable. That means if things change later or the platform host gets a legal challenge or takedown request, you are free to say 'go pound sand' and take your data and platform elsewhere. You are not at the mercy of the platform provider.

For a classic example of a community effort where the rules were changed after a great many users altruistically gave of their time and effort see CDDB, also known as Gracenote[0]. And as I typed my original comment, this thread[1] was on the HN front page with some choice comments illustrating the difficulty of doing a 100% clean export of your data from GitHub.

Google has a great initiative, humorously called the 'Data Liberation Front'[2] which makes sure users can easily export all their data in a useful format if they want to take it elsewhere. I used it when I closed my Google accounts and I can report it works perfectly. I see no comparable effort by GitHub. Users like me check for this early and it's absence is always a red flag.

Hope that answers your question and if my assumption that you don't want to use GitLab because of the friction of creating yet another online account is incorrect please clarify what your real reason is.

[0]https://en.wikipedia.org/wiki/CDDB

[1]https://news.ycombinator.com/item?id=11054011

[2]https://en.wikipedia.org/wiki/Google_Data_Liberation_Front

Can I make a suggestion? It looks like this is aimed at open-source users and it might be a better fit over on GitLab (https://gitlab.com/).

It's a great idea to create this repository of information, but putting it in GitHib's proprietary silo is a turnoff to some potential contributors. It isn't wrong to use GitHub, it's just better to make GitLab the default choice for FOSS (and especially crowd-sourced!) projects.

Either way good luck with it, I like the idea and as I'm already running Ubuntu I may try the PPA and see if I can generate some useful data to contribute.

NoScript users, this is one of those rare sites that is never going to work even after temporarily whitelisting everything. Try youtube-dl, it works perfectly once you get to the individual video pages and have a URL. https://rg3.github.io/youtube-dl/

I can't complain about the lack of functionality since I'm using a very restrictive add-on, but I hope that helps other NoScript users.

144 comments as I type this and I can't believe no one has mentioned OVH yet. I'm a happy customer of DigitalOcean, AWS, and OVH and my default choice for a while now has been OVH. DigitalOcean beats everyone in ease of use and UX, and AWS obviously has huge potential for scaling, but OVH consistently beats DigitalOcean in VPS performance and they include DDOS protection as standard.

Test for yourself, fire up similarly sized VPSs at both DigitalOcean and OVH and benchmark them running identical tests. The DigitalOcean VPSs are pretty fast but the OVH ones consistently perform better for both CPU and disk speed.

OVH supports startups just like the rest of the companies mentioned elsewhere in the thread too - see https://www.ovh.com/en/dlp/ for info. I have no affiliation with any of these companies except as a customer.

NB if you use a dash cam, realize that it can also be used to very precisely calculate your speed in exactly the same way. Good if you are fighting a speeding ticket you didn't deserve, bad if you get into a wreck and were speeding.

Yeah, mine is a shameless copy of the Plaintext Offenders Tumblr (http://plaintextoffenders.com/) which I've known about for years, but I wish I had spotted the HTTP Shaming one earlier as I would have saved myself time and submitted the local sites there instead. Oh well.

There is (of course) a Tumblr site for sites that do this[0]

I found a bunch of local websites including utilities and email providers that do this[1] and seem completely unaware of the risk. Emailing them to explain the problem didn't help much as the vast majority simply ignored me. Hopefully this will make it into all the mainstream browsers soon because not protecting sensitive data with HTTPS is really inexcusable in 2016. It's not like it costs a lot of money to do.

[0]http://httpshaming.tumblr.com/

[1]http://insecure.org.je/

And yes I see the irony in having an HTTP site for this, but at least Tumblr does a proper HTTPS form post action...

You are presumably willing to trust the first-party website for content and it is not a big stretch to trust the third-party content they chose to include as well. Not much difference between trusting them to serve jQuery themselves (which they must source from a third-party initially) or link to it directly at the third-party site, for example.

There is also https://github.com/r4vi/block-the-eu-cookie-shit-list which blocks far more, even the unobtrusive ones. Think of it as AdBlock Plus with the 'acceptable ads' feature disabled.

Asked and answered in this recent BBC iPlayer video, "The Town That Took On The Taxman": http://www.bbc.co.uk/iplayer/episode/b06ygl19/the-town-that-...

I agree these are under-used but they face the same issues as the other methods like putting the data in text near the image on a web page or presentation slide. These fields, same as all Exif metadata, can be overwritten or removed by anyone with access to the file. The data can be faked by someone intending to deceive, or it could disappear when posted to big sites like Facebook or Twitter who routinely remove Exif data by default (presumably to protect the majority who don't understand how GPS tagging works on mobile phone photos, etc).

Once the photo metadata is gone, it is too easy for others to claim it is an 'orphan work' and avoid liability under copyright law. At the opposite end of the spectrum, people like me who release most images as CC0 are annoyed that that license tag was stripped from the metadata, preventing others from freely reusing them. I use and rely on Exif tags a lot but they are fragile and you cannot rely on them staying embedded with your images once they hit the web.

It's not using an A record, it's using a CNAME:

  host blog.lacour.me
  blog.lacour.me is an alias for silvrback.herokuapp.com.
  silvrback.herokuapp.com is an alias for us-east-1-a.route.herokuapp.com.
  us-east-1-a.route.herokuapp.com has address 54.83.3.141