672 reputation
18
bio website
location Amsterdam, Netherlands
age
visits member for 1 year, 6 months
seen Aug 12 at 20:31

Jul
29
awarded  Popular Question
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@supercat Yes it could, especially if there is a separate process for every TLS session.
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@MaciejPiechotka Again, this is about MTA-to-MTA, not users submitting messages or anything else.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
We're not paranoid, but we're thoughtful. We don't deploy any FOSS software where we haven't found the coding style and visible community indicative of sound practices. We have repeatedly rejected OpenSSL based on this type of evaluation, which has proven to be a great predictor of security failings over almost two decades. We run no small amount of popular software.
Jul
11
revised Why enable SMTP STARTTLS if OpenSSL is dangerous?
added 104 characters in body
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
OpenSSL funding (real or expected) hasn't made a dent in its problems yet. I don't tend to deploy troubled software based on how good I expect it might be in the future.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
I should have clarified that the supposed benefit is MTA-to-MTA opportunistic encryption, as our users don't pass credentials in SMTP.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
"OpenSSL is actually one of the most secure pieces of software around" is laughable. Its track record is much worse than any other FOSS code in our infrastructure, save for the Linux kernel.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
Also, yes I am a high-profile target, but that doesn't necessarily mean I face a different risk balance of 0day exploitation vs passive surveillance.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
Also true: Not using STARTTLS will reduce my chance of exposing security holes to the whole net. Using STARTTLS may prevent snooping by a few entities in privileged positions.
Jul
11
asked Why enable SMTP STARTTLS if OpenSSL is dangerous?
Jul
11
comment Would it be secure to generate random number using AES?
urandom may not be a safe source of random numbers for cryptographic key generation, especially on a system which is only recently booted. More at factorable.net/weakkeys12.extended.pdf and eprint.iacr.org/2013/338.pdf and elsewhere.
Feb
5
awarded  Yearling
Nov
15
comment What is setuid based script root spoofing?
I don't think "bamboozled" means what you think it means
Nov
15
comment Why can SSL certificates not be free of charge?
Your question shows no prior research. "Cryptic numbers" are you kidding? Downvoting.
Nov
15
comment Why can SSL certificates not be free of charge?
They can be free of charge. See startssl.com or cacert.org (I have no affiliation with either)
Nov
15
comment Determining false positives when scanning for live hosts with Nmap
If you want to find out which IP addresses have a real switched-on machine associated with them, you need to investigate at Layer 2, which is the OSI layer where those associations actually take place. If you don't know this, you are not qualified to be doing a security assessment.
Nov
15
answered What is a good way to be alerted of major security patches for software I use?
Nov
15
comment encrypted emails and keyservers
If you actually read "only who has your public key can decrypt it" somewhere, please provide the reference.
May
22
comment SSH says Authentication tried for XX with correct key but not from a permitted host
I think you're in the wrong place. This is not a general and widely-applicable question. It's a bug in your config, or a bug in the SSH daemon. Post your sshd_config and authorized_keys files (censored as necessary) to the OpenSSH (assuming that's what you're using) mailing list, and ask for help there.