Top all-time · #3906
Ivan Ristić
Personal blog · blog.ivanristic.comsecurityweb
Ivan Ristić's personal blog at blog.ivanristic.com covers security and web. Since 2009, 20 different Hacker News readers have linked it 32 times, most often “Enabling DHE ciphers in Apache limits encryption strength”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link Ivan Ristić's blog for its posts on SSL/TLS and HTTPS configuration, including Diffie-Hellman strength, forward secrecy, secure renegotiation, CRIME, and his book Bulletproof SSL and TLS.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Computer security, open source, and continous publishing for geeks.
Most-linked posts?
- Enabling DHE ciphers in Apache limits encryption strength3 people · 3 mentions · first linked 2013-09-09
- SHA1 deprecation: what you need to know2 people · 2 mentions · first linked 2014-09-10
- How Bulletproof SSL and TLS is a living book2 people · 2 mentions · first linked 2015-08-31
- Configuring Apache, Nginx, and OpenSSL for Forward Secrecy2 people · 2 mentions · first linked 2013-08-06
What Hacker News says?
For me, the best part of this release is the fact that the TLS stack has been significantly improved, and is now quite good. The lack of some critical features in Java 7 (e.g., inability to enforce cipher suite order) made TLS effectively unusable. The list of improvements is quite long, actually: - Server Cipher Suite Preference - Strong Server Ephemeral Diffie-Hellman Parameters - Authenticated (GCM) Suites - Hard…
Comment linking /2014/03/ssl-tls-improvements-in-java-8.html
on “JDK 8 Release Notes”Submitted SSL Labs: Stricter security requirements for 2014 as a story · 103 points
HN discussionhttp://blog.ivanristic.com/2013/08/increasing-dhe-strength-o... (I'm not sure Apache even defaults to enabling forward secrecy by default, without which you're not exposed to DH at all).
Comment linking /2013/08/increasing-dhe-strength-on-apache.html
on “How to Protect Yourself from NSA Attacks on 1024-bit DH”Submitted Configuring Apache, Nginx, and OpenSSL for Forward Secrecy as a story · 9 points
HN discussionIts not using the new secure renegotiation. So its possibly vulnerable to https://blog.ivanristic.com/2009/11/ssl-and-tls-authenticati... but more likely they have renegotiation disabled entirely.
Comment linking /2009/11/ssl-and-tls-authentication-gap-vulnerability-discovered.html
on “The Achilles Heel of the Coronavirus”Submitted Significant SSL/TLS improvements in Java 8 as a story · 8 points
HN discussionI'm also a happy user of SSL Labs and reader of Bulletproof SSL and TLS. One very cool thing about the book is that if you purchase the hard copy (I got it from Amazon, for example), they'll email you epub, PDF, and web versions for free. The web version is perfect for reference at work. And the book gets updates too ( http://blog.ivanristic.com/2015/08/bulletproof-maintenance.h... ). Thanks Ivan!
Comment linking /2015/08/bulletproof-maintenance.html
on “SSL Labs in 2016 and Beyond”Submitted SHA1 deprecation: what you need to know as a story · 7 points
HN discussionthen i totally misunderstood how squid bypasses ssl. My understanding is that: After building a TCP connection, the SSL handshake is started by the client and sends which version of TLS it knows. The server then picks a compatible cipher and compression method. and then sends its certificate. This certificate must be trusted by either the client itself or a party that the client trusts(a certificate authority). In t…
Comment linking /SSL_Threat_Model.png
on “Deep packet inspection is dead, and here's why (2017)”Submitted HTTPS mixed content: still the easiest way to break SSL as a story · 5 points
HN discussionThe bigger problem with CentOS (Red Hat) is that they do not support Elliptic Curves, which are necessary for Forward Secrecy. If you're using Apache, you can compile your own from source, using static linking against OpenSSL. That way, you can have the latest versions of both. I have a blog post that describes the process: http://blog.ivanristic.com/2013/08/compiling-apache-with-sta... While you're there, you might…
Comment linking /2013/08/increasing-dhe-strength-on-apache.html
on “SSL/TLS Deployment Best Practices v1.3”Submitted How Bulletproof SSL and TLS is a living book as a story · 4 points
HN discussionReproducing an earlier comment I made on Reddit ( http://www.reddit.com/r/netsec/comments/1mn2nk/ssltls_deploy... ): If you want the short version for Apache, Nginx and OpenSSL: http://blog.ivanristic.com/2013/08/configuring-apache-nginx-... SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !L…
Comment linking /2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
on “SSL/TLS Deployment Best Practices v1.3”Submitted SSL Labs end of year 2014 updates as a story · 4 points
HN discussion> .. for no apparent reason by the WireGuard developers... It's a very weird assertion that the Wireguard devs just threw the software together at random, choosing parameters for "no apparent reason". > What if in a few months ChaCha20 gets proven insecure due to collisions found or easy factorisation? What can WireGuard offer to mitigate that? Shouldn't then also browsers implement only TLS1.3 and ed25519 ciphers b…
Comment linking /2013/09/is-beast-still-a-threat.html
on “Why Not WireGuard”Submitted How to render SSL useless as a story · 3 points
HN discussionLike it or not, sometimes it's necessary to choose the less of two evils. There was a time when BEAST was the best known attack against SSL, RC4 was not thought to be as weak as it is today, and RC4 was the only way to mitigate BEAST server-side. Eventually, even Safari/OSX implemented the 1/n-1 split defense against BEAST, at which point we stopped requiring server-side mitigation for it. EDIT: actually, SSL Labs s…
Comment linking /2013/09/is-beast-still-a-threat.html
on “SSL Labs: Stricter security requirements for 2014”Submitted The SSL Client Test as a story · 2 points
HN discussionDocBook has served me very well. For my books I put together an automated publishing workflow that starts with DocBook and produces output for both print and digital (in my case, PDF, EPUB, and HTML). For context, I wrote and published two books (4 editions) with more than a 1,000 pages combined. My goal was always continuous writing and publishing where everything is fully automated. Conceptually, XML is an excelle…
Comment linking /2022/02/bulletproof-tls-and-pki-is-out.html
on “DocBook 5.1: The Definitive Guide (2020)”Submitted SSL Labs formally recommends removing RSA and RC4 from TLS deployments. as a story · 2 points
HN discussion> SPDY compresses everything, together, by default. So does TLS 1.0 on ~42% of HTTPS servers. [1] > I wish that I liked SPDY. You're welcome to hate SPDY, it's just equally bad as HTTPS when it comes to this particular attack. [1] http://blog.ivanristic.com/2012/09/it-seems-that-it-is-that-...
Comment linking /2012/09/it-seems-that-it-is-that-time-of-year-again-when-julian-and-thai-present-their-most-recent-attack-against-crypto-system-t.html
on “CRIME”Submitted Disabling SSL renegotiation is a crutch, not a fix as a story · 2 points
HN discussionA few of my favoriates from my RSS reader (in no particular order) include: - http://www.kalzumeus.com/blog/ I love reading anything by Patrick McKenzie because he writes about incredibly valuable things, usually focusing on how to make sales, lifecycle emails, running his companies, and other general start-up related information. You might recognize him on HN as patio11 - https://blog.cloudflare.com/ CloudFlare has…
Comment linking /
on “Ask HN: What programming blogs do you recommend to read regularly and why?”Submitted Introducing TLS Maturity Model as a story · 1 points
HN discussionFor those who care about copyright, that URL is not from O’Reilly; it’s a copy of a book-set that O’Reilly used to distribute via CD-ROM – with a nice user interface that used web technologies (even included a search feature). O’Reilly could make it available for free – as they’ve done so for other books such as Apache Security ¹ or Using Samba ² – but they still (as is their right) expect you to pay for the sed & a…
Comment linking /2015/02/apache-security-ten-years-later.html
on “Learn GNU Awk with hundreds of examples and exercises”Submitted Apple enabled BEAST mitigations in OS X 10.9 as a story · 1 points
HN discussionThis blog post http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you... gives some background for this change and discusses dual-certificate deployment as a way to remain warning-free in Chrome and continue to support older (SHA1 only) clients.
Comment linking /2014/09/sha1-deprecation-what-you-need-to-know.html
on “SSL Labs 1.10.31, with SHA1 warnings, is now live”Submitted Enabling DHE ciphers in Apache limits encryption strength as a story · 1 points
HN discussionSubmitted Defending against the BREACH attack as a story · 1 points
HN discussionSubmitted SSL Server Survey: what data are we collecting? as a story · 1 points
HN discussion
