The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,481 other followers

Archive for the ‘Security’ Category

The hard part of a crypto specification: make it safe and misuse resistant.

Posted by jpluimers on 2021/10/19

Great quote from a while back:

[WayBack] Filippo Valsorda on Twitter: “Here’s a secret: it’s not that hard to put together a crypto specification. What’s hard is to make it safe and misuse resistant. What needs to be “battle tested” is the security devex, not the narrow happy path, and blaming the developer when it breaks is not battle testing.”

From the same thread:

–jeroen

Read the rest of this entry »

Posted in Development, Power User, Security, Software Development | Leave a Comment »

Kristian Köhntopp on Twitter: “Modaler Filter für Veloziraptoren… ” (0 factor authentication)

Posted by jpluimers on 2021/10/08

[WayBack] Kristian Köhntopp on Twitter: “Modaler Filter für Veloziraptoren… “

–jeroen

Read the rest of this entry »

Posted in Authentication, Power User, Security | Leave a Comment »

Teams, hats and colours

Posted by jpluimers on 2021/10/06

I learned a few new things a while ago, but still have a hard time to get the association between colours and meanings right.

Colours:

  • white: friendly / sanctioned / by permission
  • black: enemy / unsanctioned
  • red: attacks by permission
  • blue: defends by permission

Based on these tweets and links:

 

–jeroen

Read the rest of this entry »

Posted in Development, LifeHacker, Power User, Security, Software Development | Leave a Comment »

Solved: ‘Answering Yes to “You have an older version of PackageManagement known to cause issues with the PowerShell extension. Would you like to update PackageManagement (You will need to restart the PowerShell extension after)?” hung my Visual Studio Code.…’

Posted by jpluimers on 2021/10/04

From a while back: [Archive.is] Jeroen Wiert Pluimers on Twitter: ‘Answering Yes to “You have an older version of PackageManagement known to cause issues with the PowerShell extension. Would you like to update PackageManagement (You will need to restart the PowerShell extension after)?” hung my Visual Studio Code.… ‘

After clicking “Yes”, the the only thing visible was this notification that had an ever running “progress bar”:

Notifications - Powershell - Source: Powershell (Extension)

Notifications – Powershell – Source: Powershell (Extension)

The first part of the solution was relatively simple: restart Visual Studio code, then the original notification showed, and after clicking “Yes”, the “Panel” (you can toggle it with Ctrl+J) showed the “Terminal” output (yes, I was working on [Wayback/Archive.is] PowerShell script for sending Wake-on-LAN magic packets to given machine hardware MAC address, more about that later):

Read the rest of this entry »

Posted in .NET, Communications Development, Development, Encryption, HTTP, HTTPS/TLS security, Internet protocol suite, Power User, Security, Software Development, TCP, Visual Studio and tools, vscode Visual Studio Code, Windows, Windows 10 | Leave a Comment »

One of the Let’s Encrypt’s Root Certificates expired today (and their corresponding intermediate yesterday); how is your infrastructure doing?

Posted by jpluimers on 2021/09/30

Last weekend I published 5 days before the Let’s Encrypt’s Root Certificate is expiring!

It basically was a post trying to amplify the [Wayback/Archive.isLet’s Encrypt’s Root Certificate is expiring! message by [WaybackScott Helme .

Yesterday and today, he is maintaining a Twitter thread on things that have broken.

Quite a few things have, including some versions of curl, on which a lot of infrastructure relies (the certificate for it got fixed later on 20120930), see:

Two important starting points in his thread:

  1. [Archive.is] Scott Helme on Twitter: “🚨🚨🚨 5 minutes until the Let’s Encrypt R3 intermediate expires 🚨🚨🚨 29 September 2021 19:21:40 UTC”
  2. [Archive.is] Scott Helme on Twitter: “🚨🚨🚨 30 minute warning 🚨🚨🚨 IdentTrust DST Root CA X3 Expires: Sep 30 14:01:15 2021 UTC… “

If you want to check from one of your own clients, try [Archive.is] Scott Helme on Twitter: “I’ve created a test site to help identify issues with clients. If you can connect to https://t.co/bXHsnlRk8D then your client can handle being served the expired R3 Intermediate in the server chain!… “

[Wayback/Archive.is] https://expired-r3-test.scotthelme.co.uk/

Note that neither SSLabs, nor Cencys, nor CertCheckkerApp do show the expired certificate, only the new one:

Yes, I know the pluimers.com web server is rated B from a TLS perspective. Will be working on it, but I’m still recovering from rectum cancer treatments, and have an almost 1.5 year backlog to get through.

–jeroen

Posted in Communications Development, Development, Encryption, HTTP, https, HTTPS/TLS security, Internet protocol suite, Let's Encrypt (letsencrypt/certbot), Power User, Security, Software Development, TCP, TLS, Uncategorized, Web Development | Leave a Comment »

 
%d bloggers like this: