There are two sorts of TLS certificate mis-issuing

The fundamental TLS problem is that thereare a ton of Certificate Authorities and all of them can createcertificates for your site and give them to people. When talkingabout this, I think it's useful to talk about two different sortsof mis-issuance of these improper, unapproved certificates.

The first sort of mis-issuance is when a certificate authority'ssystems (computer and otherwise) are fooled or spoofed into issuingan otherwise normal certificate that the CA should not have approved.This issuance process goes through


There are several ways to misread specifications

In an ideal world, everyone reads specifications extremely carefullyand arrives at exactly the same results. In the real world, generallyspecifications are read casually , with peopleskimming things, not putting together disparate bits, and so on.If the specification is not clear (and perhaps even if it is), oneof the results of this is misinterpretations. However, it's my viewthat not all misinterpretations are the same, and these differencesaffect both how fast the misreading propagates and how likely itis to be


Intel

Why I plan to pick a relatively high-end desktop CPU for my next PC

My general reflex when it comes to any number of PC components,CPUs included, is to avoid the (very) highest end parts. This isfor the well known reason that the top of the product range is wherenearly everyone raises prices abruptly. If you want something closeto the very best, the vendor will charge you for the privilege andthe result is not that great a price to performance ratio. Goingdown a step or three can give you most of the benefits for muchless cost. This is


HD usage can be limited by things other than cost per TB

I was recently reading WDC: No SSD/HDD Crossover ( via ),which reports Western Digital data that says that HDs will continueto have a significant price per TB advantage over SSDs for at leastthe next decade (the quoted figure is a 10:1 advantage). I'm perfectlyprepared to believe this (I have no idea myself), but at the same timeI don't think it's necessarily very relevant. The simple way to put itis that a great deal of


The 'standard set' of Unix programs is something that evolves over time

I've recently been writing about how OmniOS's minimal set ofadditional programs has made it annoying to deal with . In the process ofthis I've casually talked about 'the standard set' of programsthat I expect a Unix system to have. In a comment on yesterday'sentry , David Magda provided a comment that is a perfect leadin for something that I was going to write about anyway:

Define "standard set". :) Isn't that one of the reasons POSIX was


Having different commands on different systems does matter

In a comment on yesterday's entry about our frustrations withOmniOS lacking a lot of normal system commands , opk wrote:

As Chris mentions, there are alternatives and on a Solaris system,that means prstat and snoop. And for the vast majority of cases, theyare more than just enough. Maybe they don't have quite so many optionsbut it's unfair to criticize the lack of top and tcpdump if it is justthat you're used to typing those command names on Linux.

I'


Our frustrations with OmniOS's 'KYSTY' minimalism

OmniOS famously follows a principle called KYSTY , where OmniOS itself shipswith minimal amounts of software (and the versions can be out ofdate ). As far as I know, OmniOS CE has continued this practice, which hasan obvious appeal for people trying to maintain an OS distributionon limited amounts of time (especially a LTS version ,where you might be stuck patching old versions of programs thataren't supported upstream any more). All of this is well and good,but in practice the results of this


I've now seen something doing SMTP probing of IPv6 addresses

One of the machines that I run my sinkhole SMTP server on has an IPv6 address.This address is present in DNS, but wasn't directly visible asthe target of an MX record or anything else that would lead it toclearly being associated with email. To my surprise, yesterday amachine connected to my sinkhole SMTP server on this relativelyobscure IPv6 address.

(This machine is the MX target of an old hostname that spammers andother people have latched on to, but the MX target didn'


Understanding what our wireless password protects

I don't have a deep understanding of wireless networking protocols.Usually this is fine and I can get by on broad knowledge andsuperstition. But as part of reading about KRACK , I found myself not sure of howexposed we were in some ways, because I wasn't sure what wirelesspasswords actually protect. Did they only protect access to yourWPA/WPA2 wireless network, or did they also secure data beingtransmitted and received?

(This may sound like a silly question, but Diffie-Hellman


Multi-Unix environments are less and less common now

For a long time, the Unix environments that I existed in had a lotof diversity. There was a diversity of versions of Unix and withthem a diversity of architectures (and sometimes a single vendorhad multiple architectures). This was most pronounced in a numberof places here that used NFS heavily, where your $HOME could beshared between several different Unixes and architectures, but evenwith an unshared $HOME I did things like try to keep commondotfiles. And that era left its mark on Unix itself,