Hostile HTTPS interception on the modern web is now increasingly costly and risky
One of the things that HTTPS is vulnerable to is a state level actorarmed with enough money that is willing (and able) to compromise a CA and get certificates issued for sitesthat they want to run a MITM attack against.This is nothing new; it is the core security problem of SSL on theweb , namely that any of the hundreds of CAs that aretrusted by your browser can generate a certificate for anyone.
Technically, that is still the case. All of the trusted CAs in theworld can
Memory-safe languages and reading very sensitive files
Here is an obvious question: does using modern memory safe languageslike Go, Rust, and so on mean that the issues in what I learnedfrom OpenSSH about reading very sensitive files are not all that important? Afterall, the fundamental problem in OpenSSH came from C's unsafe handlingof memory; all of the things I learned just made it worse.As it happens,my view is that if you are writing security sensitive code youshould still worry about these things in a memory safe language,because there
Browsers are increasingly willing to say no to users over HTTPS issues
One of the quiet sea changes that underpins a significant increasein the security of the modern HTTPS web is that browsers areincreasingly willing to say no to users. I happen to think thatthis is a big change, but it's one that didn't really strike meuntil recently.
There was a time when the fundamental imperative of browsers wasthat if the user insisted enough, they could go ahead with operationsthat the browser was pretty sure were a bad idea; attempts to changethis back in the days
One example of why I like ZFS on Linux
Yesterday evening, my office workstation blared notifications atme of SMART errors onone of my HDs. The disk is old enough by now for this not to be toosurprising (and it's a 1 TB Seagate, which we've had some problemswith ), but still, a disk issue is neverexactly welcome, even if all of the data on it is mirrored. Sincewe've seen SMART errors be not really a problem before, I did theobvious and easy thing to test the situation
Illumos's ZFS prefetching has recently become less superintelligent than it used to be
Several years ago (in 2012) I wrote How ZFS file prefetching seemsto work , which discussed how ZFS prefetchingworked at the time. As you may have guessed from the title of thisentry, things have recently changed, at least in Illumos and otherthings built on the open source ZFS code (which includes the verylatest ZFS on Linux ). The basic changeis Illumos 5987 - zfs prefetch code needs work , which landed in mainstreamIllumos in early September of 201
Today I learned that a syslog server can be very silent on the network
Let's start with my tweet :
TIL that a UDP based syslog server can be soquiet that it falls out of switch MAC tables, causing syslog msgs toit to flood everywhere.
We have a central syslog server that peoplerunning 'sandbox' machines point their serversat to aggregate all of their syslog data at a single point (and offindividual servers). Mostly because we're old fashioned, it usesthe plain old UDP based method of syslog forwarding where clientmachines simply fire UDP packets in its
A limitation of tcpdump is that you can't tell in from out
Suppose that you are running tcpdump on a network that'sexperiencing problems , on a machine which youknow is supposed to be sending out broadcast ARP requests. When youdo something that provokes an ARP request, you see two or three ARPbroadcast packets from the machine in close succession (but not back toback; timestamps say there's a little bit of time between each). Thatsounds okay, doesn't it? Or at least it's not too crazy. There's aplausible
My theory on how network loop caused the problem we observed
Yesterday I described how a network loopon an wiring closet leaf switch in our port isolated network causedreplies to the gateway's ARP requests to usually disappear (althoughnot always). This is a fairly weird and mysterious symptom, but asit happens I have a wild theory about why (or how) it did.
The big characteristic of a port isolated network is that in factmost unicast traffic is supposed to disappear if you try to sendit out. Hosts inside the port isolated network are only allowed to
Things I learned from OpenSSH about reading very sensitive files
You may have heard that OpenSSH had an exploitable issue withsome bad client code (which is actually two CVEs, CVE-2016-0777 and CVE-2016-0778).The issue was reported by Qualys Security, who released afascinating and very detailed writeup on the issues .While the direct problem is basically the same as in Heartbleed,namely trusting an attacker-supplied length parameter and thensending back whatever happened to be sitting in memory, Qualys
Network loops can have weird effects (at least sometimes)
Today we had a weird network problem on one ofour most crucial networks, our port-isolated user machine network ; this is the wired network used to connectlaptops, most machines in people's offices, and so on. The onlyfailure we could really see was that when the gateway firewall sentout a (broadcast) ARP request for a given IP, it would not see the(unicast) ARP reply from your machine. If your machine did somethingthat caused the gateway to pick up its MAC,