tombrossman

If they had announced this before the Let's Encrypt[0] initiative it would have been more impressive, but still it is a nice gesture to offer these for the month or two that people are still buying them. I wonder if it is a preemptive move to keep customers from taking their certificates elsewhere, as you will be able to do with the Let's Encrypt certs?

Reading the rest of the announcement, It looks like they are slowly catching up to Gandi.net, who have offered free one year certs and other features (two-step verification and domain privacy) for a while now.

They are a bit behind the curve compared to better Registrars but still light years ahead of garbage like GoDaddy, etc, so good on them for offering this.

[0]https://letsencrypt.org/

Yes, I'm using HTTPS Everywhere as well. That means the demo uses hard-coded http://domain.tld links instead of protocol relative //domain.tld links. Also, https://vector.mapzen.com/ works perfectly so HTTPS support is available but cannot be used due to the hard-coded HTTP links. Fortunately it's an easy fix.

Same here, Firefox 36 / Ubuntu 14.04. The error is because the page is HTTPS and it is requesting assets from an HTTP page (http://vector.mapzen.com/...) "Blocked loading mixed active content".

I'd love to see the demo the rest of you are seeing but not enough to disable this security setting. I'm also using the NoScript add-on but temporarily allowed mapzen.com which had no effect).

I'm always happy to see a site using HTTPS but people need to understand that means no more HTTP assets - this is really basic and cannot be overlooked. If you want HTTP great, stick with it and quit dabbling with HTTPS.

The point about mice is dead on though, I wish I'd bought more of the Intellimouse model as I am on my last one (of probably 3-4 total) and the Comfort Mouse 6000 I bought to replace it is not good enough. The slight lag on middle click is forever annoying.

Look for some of the better engineered Microsoft mice (now all discontinued) on Amazon for an idea of what kind of prices these are fetching. Some are crazy expensive and I suspect it is because people like me still want them.

Edit: Here's a 50-pack for £4500 on Amazon: http://www.amazon.co.uk/Microsoft-IntelliMouse-Optical-1-1-o...

This is a fair point of course, but running it on a second laptop is probably more secure than running it as a mobile app. You wouldn't run it on the same machine you are pushing production code out from, it could be a personal laptop with no access to company systems. I didn't make this point clear in my original comment though.

While this comes too late to help you right now, I recommend looking at running a 2FA app on your laptop or desktop like this - https://github.com/gbraad/gauth so that you are not in this situation again.

Either that or grab a cheap Android handset and use it as a backup. The standard 2FA app on Android needs nothing more than occasional network connectivity to keep the clock in sync. You don't even need a Google account, the app is on FDroid.

Cloudflare is huge and many of us rely on it, so I hope you can easily avoid this predicament in the future - good luck!

I gave up on the idea of keeping coins in a wallet and instead switched to a folding money clip (this one, but many similar are available: http://www.amazon.co.uk/GOLUNSKI-Leather-Branded-Paper-Walle...). They are thinner than regular wallets which I like, and when I start accumulating coins I'll stop in a shop with self-checkout lanes - these usually have a coin tray you can dump them all in. Works for me.

This looks pretty but what's in it for me? The service is proprietary - it's a data silo with some very restrictive T&C's.

They are using Open Street Map for some of it and I'm already a happy contributor to that open platform. Maybe I missed it in the press release reprinted by petapixel.com but I don't see what financial incentive contributors have. Maybe I'm out of touch but saying I'm 'empowered' and that this is 'crowdsourced' isn't that interesting.

Me too, especially when the presentation of the contract indicates that the other party desires information asymmetry (e.g. they look impatient and try to rush you, or they have a huge contract in a tiny scrolling window on their site). You have to be ready to walk away from the deal too, or why bother?

Still, I see some totally one-sided (and what I believe to be unenforceable) terms sometimes and I may sign anyway. For the other party to actually get what they want requires a lot more work than just getting my signature, and I'm firmly in the "Fucking sue me" camp. Classic blog post from Pud that everyone worried about contracts should read: http://pud.com/post/10103947044/fucking-sue-me

What prevents me from using 'Modern' is it requires Android 4.4+, which excludes a hell of a lot of mobile users. I'm okay with dropping XP support but dropping Android 4.3 and earlier is too limiting for me.

You can keep your A+ and add IE8 on XP, plus boost your key exchange to 100%[0], by following Mozilla's TLS docs[1] and sticking with the default Intermediate ciphersuite.

You might also consider disabling server tokens to hide your Nginx version (server_tokens off;) for a bit of 'security through obscurity' and enabling SPDY (listen 443 ssl spdy;) for a performance boost.

Also worth pointing out is the upcoming Let's Encrypt project[2] which will make domain validated certificates free soon.

[0]https://www.ssllabs.com/ssltest/analyze.html?d=brossmanit.co... [1]https://wiki.mozilla.org/Security/Server_Side_TLS [2]https://letsencrypt.org/

Maybe there was a temporary problem with the link but this is working for me just now: https://secure.edirectdebit.com/Open-Rights-Group/Join-us2/D...

The browser isn't broken, this is the expected behavior. When you click a link for a downloadable file, your browser fetches it in the background since there is no page to display.

The problem in this instance is that there is no 'landing page', it's just there on Cryptome in a big list of pages and other downloads. The real issue is Cryptome's spartan UX gives no easy way to handle this, it's either link to the home page with no context, or link to the file directly.

They probably deserve it but the net effect would be to break many sites for many users. One step forward, two steps back.

What privacy-minded users need is a trusted list of root CA's and a (relatively) easy way to instruct their browsers to use only that list. For example, The Hong Kong Post Office is a CA installed in your browser and you can choose to delete or distrust it. Same thing for Turktrust, AOL, etc.

I imagine there are plenty of other CA's which could be distrusted but I don't know enough to make an informed decision and I don't want to start deleting them randomly and breaking my browsing experience. I'd love to see a list curated by a trusted organisation like the EFF or the Open Rights Group, which I could refer to when choosing which CA's to remove from my browser.

Turns out you are right. Asked & answered on the project page today: https://github.com/jmhodges/howsmyssl/issues/44

I really wanted to use it with Ubuntu but it was incompatible with an encrypted /home. The daemon would start at boot and, unable to mount my target directory in /home, would create a new target directory in / and fill that up.

I opened a ticket and their support people seemed confused by Linux, and told me to check the user forums. Since this is a paid product I saw this a poor service and cancelled.

It did look interesting but I got the impression that Linux wasn't really supported - just that a Linux client existed.

First thing I did when I saw that URL was to run it through Qualys' SSL Labs test. Multiple issues, no forward secrecy, weak ciphers, grade set to 'C'. Oh, the irony.

https://www.ssllabs.com/ssltest/analyze.html?d=howsmyssl.com

What is good (and often overlooked) about package updates over HTTPS is that you don't leak metadata about which packages you are updating or installing. Not a big issue with an office suite but still it's an option I would prefer.

Just did a quick 'whois' on the second domain mentioned (COUTURESHOPELA·COM) and see it has never been registered. I bet some enterprising developer could register it in less than one hour and sell it to them for a bit more than $12.

Any takers?

It is no dodgier than the revelation that spy agencies (along with many other organisations) create sock puppet accounts[0] to manipulate public opinion on sites just like this.

Looking at the form I see two boxes left un-ticked by default, requiring manual opt-in, which to me looks pretty good from a privacy perspective. I also see the full name, postal address, telephone number, and registered charity number just below in the footer.

Maybe my definition of 'dodgy' is different from yours, because the only dodgy thing I see is the illegal spying being called out.

It's a free country though, so you are free to be extra cautious and to do nothing and hope the problem goes away some day. Also, I guess I should point out I'm a paid-up member of Privacy International so not exactly unbiased here. So far so good, no drone strikes or black helicopters yet and I sleep well at night.

[0]http://www.theguardian.com/technology/2011/mar/17/us-spy-ope...

I really wanted to like this as it looked promising and I'm already using (or have used) other OVH-backed products like Kimsifi and So You Start, with great results. I set up an account to test it out and ended up cancelling and deleting the account after less than an hour of use.

What went wrong, in chronological order:-

1. 30 character password limit. Not the worst thing ever but it indicates they may not be properly salting & hashing passwords.

2. UK Postcodes fail if you type them normally, you must remove all spaces which you must learn through trial and error - the only feedback you get is 'Invalid zip code'.

3. Credit card details must be entered before you can use anything, and a 'Memorize this card' is checked but disabled, which seems odd.

4. No guaranteed minimum bandwidth for like on other OVH products. In my testing I saw about 19MB/s up and 26MB/s down, so not great but okay for the price.

5. The worst thing for me was really slow disk speed on their VPS's. My plan was to move one from DigitalOcean to RunAbove (very happy w/ DO, but want to mitigate risk by using multiple providers). Running 'dd if=/dev/zero of=iotest bs=64k count=16k conv=fdatasync' several times produced results showing disk speeds of barely 50MB/s. I can do this all day long on the cheapest DO VPS and see 5x those speeds. No comparison.

Still, like I said the other OVH projects I've used kick ass and I will probably try this again in six months or so. But for now, there is absolutely no comparison between RunAbove and DigitalOcean if you are looking for a VPS. For object storage only, you should test read and write speeds and make sure you are happy with the results after considering the slightly lower prices. Not quite there yet for me.

Okay, well good luck with the project then. I think I'll stick with Firefox Hello for now, but I'd love to be able to implement a 'video click to call' button on a website using WebRTC. Much like Skype but using no plugins and with the option to self-host it.

This looks interesting but when I scrolled down I saw the message "Built for Chrome" and I'm left with the impression that this software is for Chrome only. Is that correct? I use Firefox so won't be able to use it.

If the notice is just about the website, I'm left wondering why they would include an advertisement for a browser from an advertising company on the site?

Users that are okay with ads and vendor lock-in already have plenty of bigger and more established options, so I'm still trying to figure out how this service might appeal to me - maybe not at all?

I'm also happy to pay a site for content, but I have to point out that we all pay for both the ads and content.

When you pay directly you cut out a layer of middlemen (the ad company / broker) so I see subscription-based sites as more efficient than ad-supported ones.

This isn't the best way to describe the problem or solution.

Users can be advised to install an ad-blocking plugin for their web browser to protect themselves. Since Google serves adverts from domains other than google.com, users can continue to use the google.com domain for search while at the same time blocking the malware coming from ad networks.

I think it was the version bundled with Google's Chrome browser being referred to, and not the standalone Adobe Flash Player for Linux, which is quite old now.

Curious, why not switch to Chromium instead? You would still want to disable plugins as you do now, but is there an advantage to using Chrome over Chromium once plugins are factored out?

I didn't have an IPTables rule allowing the VPN traffic (UDP port 1194) and so OpenVPN falls back to using 443, which triggered the problem. I looked at the workaround and decided not to bother as I didn't really need a VPN, I was intending to use the machine as an Nginx server only.

I had a herp derp moment recently after installing OpenVPN then discovering that Nginx refused to restart because port 443 was 'bound by another process' or something like that. This looks like a pretty easy workaround.

The Piwik use-case I was referring to is to run it from your imported logs, not the default JS tracking. Because the visitors can't circumvent server logging, you get analytics and also boost page speed.