y0ghur7_xxx

> How can they efficiently do that?

The web server sends a Signed Certificate Timestamp in the TLS Handshake¹. The browser will check that.

Apache support is coming², and other web server vendors are probably working on it as well.

¹https://tools.ietf.org/html/rfc6962#page-13

²https://httpd.apache.org/docs/trunk/mod/mod_ssl_ct.html

That's cert pinning. I think you are talking about something else.

> At some point browsers will stop allowing certificates that are not logged through CT

Makes sense. So to be sure nobody issued a cert for one of my properties I would have to check regularly on CT logs to be sure that only certs requested by me are issued. But in that case, if someone requests a cert for one of my properties, and that cert was not requested by me, what do I do?

Do I tell mozilla and google that "someone issued cert id 4d8effdd25 for my nextcloud installation (or my forum where some rebellious users meet up sometimes) to mitm me, but it was not me". Will they belive me? And it will be probably to late anyway, because propagation to a CT log can take up to one day, so they got data on all the traffic for a whole day.

A bit OT, but there is a thing about CT that I keep asking me and I can't seem to find an answer: Say I use a letsencrypt certificate for my nextcloud installation on my home server. Now say that the german police is investigating on me. They call up the BSI and tell them "hey, can you please issue me a signed cert for nextcloud.y0ghur7.xxx so we can mitm this guy? And please, don't log it to the CT, so nobody will ever know"

I will probably never know, because BSI is a trusted CA in all browsers and other http clients so they don't complain (and I am not looking at what certificate the server sent me every time I open my nc page), and nobody else will ever know that that certificate was released. Am I right? So what does CT buy me?

I don't understand the problem: mozilla is basically saying "we need to track you, otherwise gmail/yahoo/hotmail thinks we are sending spam". But if that's the case, isn't the problem the to aggressive spam filtering of gmail/yahoo/hotmail? _Or_ mozilla is really sending spam. But knowing them I don't think that's the case.

So the real problem here is that everyone is using gmail/yahoo/hotmail, and those providers have broken spam filters. They should fix them.

ubuntu 16.04.3 uses dnsmasq 2.75

I don't know, but using face detection to better analyse travellers seems even creepier that logging mac addresses from phones.

It's probably even less that 1 in 60 * 24, because usually a freezes is requested during business hours? So 1 in 60 * 8?

Yes they work. The only thing you have to watch out for is the timing for the assertions with

    .waitForElementVisible('[name="main"]', 10000)

otherwise you sometimes check for a value in a field, but the field is not there yet, and the test fails.

That's the only gotcha we found we have to be careful about.

Just to get an other datapoint: we used to build tests for selenium with selenium ide too, but quickly found out that the used selectors for the elements often had to be manually tweaked, and so we switched to http://nightwatchjs.org/ for our tests, and write them by hand.

Tests are more reliable now, and devs are happy with it. Based on my (limited) experience, selenium ide is not something that is absolutely needed. It's a fine piece of software, but devs can do fine without.

> I recently had to replace a new TP-link router because some wireless devices refused to get a IPv6 address

What's the advantage of having an ipv6 home lan? I think for a home network the 192.168.0.0 subnet should be more than enough. Or am I missing something?

But ShareX does not have an image editor, like Greenshot. Which is the whole reason we are discussing alternatives to paint. Or am I wrong and someone implemented one?

ssh is something that most users see as a secure protocol, and that uses tofu. maybe we could use the same auth mechanism inside a lan for http?

Yes I agree. But I see that as an exception. The Captive Portal is ONE thing that needs to be secured and be accessible inside the LAN of a public wifi hotspot. I see that as a special case, and public HS providers can work around that (using a domain for the CP they own and got a cert for). But imho that does not mean that browsers should throw security warnings at users for everything else inside their home lan. At least until we have a solution that works for everyone. And

- depending on an external service for your internal home stuff, or

- installing a self signed CA on every device you own

is not a solution.

Until we have something we can replace the status quo with, we should not deprecate it.

That's exactly what I did, but I can't point you to a howto or something like that. I just bought a vlan capable switch and a pfsense router and set everything up.

> On the other hand it's very common to use Wifi in public transport (at least here in London for the tube), airports, trains and hotels. Few people consider security when using these hotspots, making sure that SSL is enabled for all pages would be an improvement.

But do you use LAN services on that network? I think you will use that public hotspot to check facebook, hn, search something on google and stuff like that, not connect to some service in the local network of the hotspot.

> if your lightbulb has malware and your router doesn't yet, then using HTTPS while talking to the router is pretty important.

I agree. So what's the solution you propose?

- Using a self signed CA that you have to install on all your devices?

- Using a trusted by default CA, that makes your internal-only devices depend on an external service (the CA)?

Or something else?

I'm not saying that encrypting the traffic in a LAN is useless. I'm saying that https and the current CA system is not the solution.

Well it's my lan, and I can decide what I trust and what not. For example in my home network I have different vlans: one for things i reasonably trust, and one for the chinese webcams and iot lightbulbs. If my router has malware, even if i talk to it over https I'm screwed anyway, I don't think that is something I can fix with https.

> most people will primarily use LAN services in public Wifis

[citation needed] - I would say most people will primarily use LAN services in private home/corporate networks. But I don't have a citation either.

It's different use cases. Maybe one needs the warning, the other one not. But putting the warning on everything and overload the user with them is not the right solution.

Using a self signed CA is a pity, because installing it on every phone, tablet, laptop, tv, pc, ... is cumbersome in a home network, and making all hosts public and depending on an external CA for local resources to not get scary warnings can not be the right solution either.

I hope lans are exluded? I'm scared that I will get security warnings everywhere in my lan.

- when I log in to my webcams it says the connection is not secure

- when I log in on my nas it says the connection is not secure

- when I log in on my router it says the connection is not secure

- when I log in on the web interface of mythtv it says the connection is not secure

- when I log in on my self hosted gitea instance it says the connection is not secure

- when I log in to my self hosted nextcloud it says the connection is not secure

- when I log in to the configuration page of my toaster it says the connection is not secure

All these things are on my lan, and on most things there is no way to install a tls cert on them, nor would I want to do that.

Firefox already nags me that the connection is not secure when i enter a username and a password in any of those sites.

This may be unpopular on an US-centric site like HN, but the US looks more and more like they want to isolate themselves from the rest of the world: very strict immigration policy, travelers molested by TSA on airports, ...

These conferences where people around the world meet should start to be hosted somewhere else. Not in the USA anymore. Somewhere in a country that welcomes people instead of treating all of them like possible threats.

Just organize All Hands in Berlin next year. Or Barcelona, or Munich, or Stockholm, or Amsterdam, or whatever. Just not the US anymore. Americans don't want foreigners on their soil. Or at least everything looks that way from the outside. Let them be that way.

the only reason we use a java applet, is because javascript has no api to access a smartcard reader. unfortunately this project can not solve that use case.

If you want to know what happened by watching the video yourself, here it is: https://youtu.be/Er7qPv8jsZo?t=3920

"A letter from 22 Republican senators urging Mr Trump to withdraw played a major role in the decision, Axios said."

This is not just Trump.

there is something i never understood, maybe someone can help me: what makes wire better than xmpp? why do we need yet another protocol for chat?

> It's odd how neither this post, nor the spec, nor GitHub's "Mastering Markdown" help page[1], nor the more complete "Basic writing and formatting syntax" page[2], mentions the fact that GitHub treats every newline as a hard break.

Well, actually it does say that "Hard line breaks are for separating inline content within a block."

https://github.github.com/gfm/#hard-line-break

So two spaces at the end of the line for a <br>, and an empty line for <p>.

> I completely disagree with this. Public key pinning has some well known problems that make it very dangerous to implement at scale

I don't know what you are commenting on, because the author of the linked article suggests we use Trust On First Use, not HPKP.

Sorry, when I said "if you can do without it", with "it" I meant the application access layer, not the vpc.

> hide :27017 behind a firewall with only your app's DB access layer talking to it?

Because if you can do without it, why bother? Developing an access layer costs time and money. If you can leverage the DB features to do what you need, you can make you stack simpler and more maintainable.

> I don't think this is a bad thing. Instead of a third-party you trust (or rather, your user-agent trusts) vouching that Google's indeed Google, it's now Google vouching for itself, and you trust them by the virtue that they're Google.

I'ts like a self signed certificate.