Tinned_Tuna

@JourneymanGeek I don't think so, they'll just hand the responsibility down the chain to the comms providers, much like they did with internet connection records (ICRs)

Which is entirely implementation dependant.

If you advance any pointer past the end of the memory it refers to, then read or write at that pointer, then a segfault may occur.

Each of those algorithms can be implemented correctly or incorrectly. Whether or not you get segfaults is down to how buggy your implementation of an FSM model is.

@user2284570 They do. There are several algorithms that can be used to implement FSMs. FSMs are a mathematical object that must be modelled in a computer.

@user2284570 Whether or not an arbitrary program segfaults is down to the implementation, not necessarily the algorithm it is implementing.

@zack6849 Don't ask to ask, just ask. Someone'll be along eventually.

@Lamia I think both are important, but forensics could be more lucrative. Most companies just want rid of malware, whereas assigning liability is usually quite a high priority

@Xander thanks :-)

@Aria Good, cheers :-)

So, one could reasonably deploy HSTS without HPKP and not require a back up/offline key in case of loss or compromise?

This is partly why I'm a little confused, my reading of the specs indicates that HSTS and HPKP are separate. HSTS just makes sure that the connection is over TLS, where as HPKP makes sure that an expected public key is seen. However, a few places seem to use HSTS and pinning as if you can't get one without the other.

Isn't that HPKP, not HSTS?

That is, clients aren't going to freak out seeing a different key.

@Aria That's fine, but HSTS doesn't imply any form of key pinning, right?

Very quick question: If I enable HSTS, then lose access to the private key, what happens to clients? Do I just need to provision a new key on the same domain, or do clients pin the key?

Ah ha, it appears to be known as suffix-MAC, and this particular variation is definitely broken.

I've been given a scheme, and I was wondering if there's a name for it (aside from "broken"): pastebin.com/vDLL0GDH

@RоryMcCune Go Go gadget Go!

Alternatively, have I lost it :-p

@ThomasPornin Am I thinking of Astronomical Time (abbreviation unknown)?

(I may be mis-remembering)

UT0 is based on measurements of distant quasars and so on.

iirc, GMT is slowly drifting out of sync with UT0.

@RoryAlsop nah

UT0's where it's at.

a deep-fried toroidal piece of dough

Oh wow. That's something to behold.

Yea. I totally agree that Fx's is poor.

*That the message you showed on Fx is very unclear.

With Chromium, I think the message is perfectly clear. I agree that the Fx on that you showed is very unclear.

Oh, it's the term used when everyone wants to leave their mark on a project, so they try to change something. It came from an observation that, when building a bike shed, the most lengthily arguments were over irrelevant things, such as the colour.

I think changing Chromium's wording would be basically bike shedding at this point.

I can't comment on IE

it needs to be something like "insecure connection: {primary reason, easily understandable},\ndetails: {cipher suites, cert details, etc}"

Yea, it looks like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is the "broken" bit

huh

what's that all about?

"(null)" ??

@raz oh yea, "SSL/TLS won't cut it"

Good morning !

I mean, I know it's pretty bad, but I doubt that the (in)security of TLS is a serious threat, as opposed to say, the developer themselves.

> SSL/TLS won't cut it

@raz that question is quite bizarre

Also took the opportunity to put AES-128-GCM as the preferred mode because I likes me some tiny improvement in performance.

ehn, I just uni-laterally disabled DH in favour of elliptic curve DH.

Although, I suppose, comms, downtime management, change control, etc. could easily spiral.

... isn't it just locate and upgrade the 2 affected servers?

Has anyone used nmap's ssl-enum-ciphers?