sdeziel
Joined 10 years ago
Karma
81
Submissions
27
Member since
Nov 2
Recent submissions
Comment · 3 years ago
Comment · 4 years ago
Nice article! However some numbers are a bit off:
The IPv4 overhead is normally 20 bytes but can reach 60 bytes with many options. For TCP, it's between 20 and 60 bytes as well.
Just ran a quick tcpdump on Linux and curl's TCP connection uses 32 bytes TCP headers (12 bytes of options).
Comment · 4 years ago
> AES128 is weird too since 128-bit key ciphers are kind of deprecated unless your target is a fridge magnet.
Why is AES128 preferred over AES256 by browsers then?
https://www.ssllabs.com/ssltest/viewClient.html?name=Chrome&... https://www.ssllabs.com/ssltest/viewClient.html?name=Firefox...
Comment · 5 years ago
> Why can't I select text on that page?
Enabling "reader mode" in Firefox did the trick.
Comment · 7 years ago
From the article: "This drops all ICMP packets. ICMP is only used to ping a host to find out if it’s still alive."
Please stop this non-sense, there are too many ICMP blackholes already.
Comment · 8 years ago
https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198
Comment · 8 years ago
One can always go to about:config and set security.pki.distrust_ca_policy to "2" to distrust Symantec TLS certificates. Reference: https://blog.mozilla.org/security/2018/07/30/update-on-the-d...
Comment · 8 years ago
1.1.1.1 uses anycast so it's effectively being served by any of Cloudflare's point of presences (152 data centers around the world).
Comment · 8 years ago
3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)
4. Don't let your DB host make outbound connections (iptables/ip6tables)
Comment · 9 years ago
Yeah, I quoted the wrong line.
Comment · 9 years ago
> * enforcing SSH key authentication
That cannot be enforced by the server because the key decryption occurs client-side. An alternative is to use Two Factor Authentication.
Comment · 9 years ago
No, you just have to pin the current and future/backup intermediate CAs (X3 and X4) and be done with it.
Comment · 9 years ago
That's why it's nice of Let's Encrypt to publish their current and backup intermediate CAs (X3 and X4) https://letsencrypt.org/certificates/. That's what I pin for my sites.
Comment · 9 years ago
Apache httpd also supports some features that are not available with NGINX. (Easy) LDAP authentication is one of those.
Comment · 9 years ago
LXC (with LXD) or OpenVZ containers are typically shipping full OS in the container. Docker is different in that it typically only have a few processes per containers.
https://snapcraft.io/docs/keeping-snaps-up-to-date#heading--...