Top all-time · #8582
Julien Vehent
Personal blog · jve.linuxwall.info/blogsecuritysystems
Julien Vehent's personal blog at jve.linuxwall.info covers security and systems. Since 2011, 9 different Hacker News readers have linked it 49 times, most often “10 years of self-hosting Linuxwall.info”. No feed was found, so read it on the site itself.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
The only comment is a bare link in a thread on HTTPS requirements, saying 'unless you support both', which suggests the linked post covers serving sites over both HTTP and HTTPS. The post's content is not described.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- 10 years of self-hosting Linuxwall.info2 people · 3 mentions · first linked 2015-03-11
- SHA1/SHA256 certificate switching with HAProxy2 people · 3 mentions · first linked 2015-10-04
- Introducing SOPS: a manager of encrypted files for secrets distribution2 people · 3 mentions · first linked 2015-10-01
- TLS stats from 1.6B connections to mozilla.org2 people · 2 mentions · first linked 2016-08-04
- Investigating SSH authorized keys across the infrastructure using MIG2 people · 2 mentions · first linked 2015-09-13
- Video-conferencing the right way2 people · 2 mentions · first linked 2017-01-18
What Hacker News says?
You can do it with HAProxy by checking for SNI and falling back to a SHA1 cert when the extension is absent. https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...
Comment linking /blog/index.php?post/2015/10/04/SHA1/SHA256-certificate-switching-with-HAProxy
on “WoSign and StartCom: Mozilla’s proposed conclusion”Submitted TLS stats from 1.6B connections to mozilla.org as a story · 71 points
HN discussionThank you for that blog post. I managed to retrieve some of them and add a few attack vectors to my checklist: https://jve.linuxwall.info/blog/index.php?post/2014/09/25/Sh... If you find any more of them, do you think you could publish their checksums?
Comment linking /blog/index.php?post/2014/09/25/Shellshock-IOC-search-using-MIG
on “Everything you need to know about the Shellshock Bash bug”Submitted SSL/TLS analysis of the Internet's top 1,000,000 websites as a story · 63 points
HN discussionUnless you support both via e.g. https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...
Comment linking /blog/index.php?post/2015/10/04/SHA1/SHA256-certificate-switching-with-HAProxy
on “Life Is About to Get Harder for Websites Without HTTPS”Submitted You can't trust the infra; Encrypt client side as a story · 10 points
HN discussionBeen doing it for 10 years, and it's still fun :) https://jve.linuxwall.info/blog/index.php?post/2015/03/11/10...
Comment linking /blog/index.php?post/2015/03/11/10-years-of-self-hosting-Linuxwall.info
on “Your own Debian Mail Server (part II): how to prove you are not a spammer”Submitted 10 years of self-hosting Linuxwall.info as a story · 8 points
HN discussionProjects I care about use a domain I control. It's not that hard to setup: https://jve.linuxwall.info/blog/index.php?post/2015/08/26/Ho... We even do it with just an S3 bucket for go.mozilla.org: https://go.mozilla.org/
Comment linking /blog/index.php?post/2015/08/26/Hosting_Go_code_on_Github_with_custom_import_path
on “Go Packaging Proposal Process”Submitted On the prevalence of XSS attacks in modern web applications as a story · 6 points
HN discussionI wrote some of my thoughts on the topic, and the primary motivation behind SOPS [1] (which uses PGP and KMS): https://jve.linuxwall.info/blog/index.php?post/2015/10/01/In... The initial trust problem boils down to trusting the API that controls the provisioning of your infrastructure. Failing that, you have to ask a human to manually authorize new nodes to retrieve secrets (that's how puppet approves new agent cert…
Comment linking /blog/index.php?post/2015/10/01/Introducing-Sops%3A-an-editor-of-encrypted-file-that-uses-AWS-KMS-and-PGP
on “Ask HN: In a microservice architecture, how do you handle managing secrets?”Submitted Introducing SOPS: a manager of encrypted files for secrets distribution as a story · 4 points
HN discussionSee also https://wiki.mozilla.org/Security/Server_Side_TLS#Haproxy and https://jve.linuxwall.info/ressources/taf/haproxy-aws/
Comment linking /ressources/taf/haproxy-aws/
on “Using SSL Certificates with HAProxy 1.5”Submitted Video-conferencing the right way as a story · 3 points
HN discussionChef maintains a database of all the nodes in your environment. Nodes can search for neighbors and configure themselves accordingly. I wrote a firewall cookbook that takes advantages of Chef's search capabilities to dramatically reduce the maintenance of our firewalls, while keeping the rules ultra specific (inbound and outbound). Check it out: https://github.com/jvehent/AFW/ & http://jve.linuxwall.info/blog/index.p…
Comment linking /blog/index.php?post/2012/11/14/AFW
on “Chef 11 released”Submitted Video-conferencing the right way as a story · 3 points
HN discussionI filmed Pablo's presentation at the last Netfilter workshop. Check it out if you want a long, in depth, presentation of Nftables. 616 MB video: http://jve.linuxwall.info/talks/NetfilterWorkshop2013/NFTabl... (there are more recordings of the NF workshop at http://jve.linuxwall.info/talks/NetfilterWorkshop2013/ )
Comment linking /talks/NetfilterWorkshop2013/
on “The return of nftables”Submitted TLS stats from 1.6B connections to mozilla.org as a story · 3 points
HN discussionCoincidentally, I just gave a talk last tuesday at the Philadelphia LUG on DIY email hosting at home. http://jve.linuxwall.info/ressources/taf/DIY-eMail@Home-PLUG... [PDF, 4.5MB]
Comment linking /ressources/taf/DIY-eMail@Home-PLUG20130212-jvehent.pdf
on “Self-Host Everything”Submitted Introducing SOPS: a manager of encrypted files for secrets distribution as a story · 3 points
HN discussionSubmitted Hosting Go code on GitHub with a custom import path as a story · 3 points
HN discussionSubmitted Automated configuration analysis for Mozilla's TLS guidelines as a story · 3 points
HN discussionSubmitted Shellshock IOC search using MIG as a story · 3 points
HN discussionSubmitted One year at Mozilla Operations Security as a story · 3 points
HN discussionSubmitted SHA1/SHA256 certificate switching with HAProxy as a story · 2 points
HN discussionSubmitted Using Mozilla Investigator (MIG) to detect unknown hosts as a story · 2 points
HN discussionSubmitted You can't trust the infra; Encrypt client side as a story · 2 points
HN discussionSubmitted 10 years of self-hosting Linuxwall.info as a story · 2 points
HN discussionSubmitted Postgres multicolumn indexes to save the day as a story · 2 points
HN discussionSubmitted "A" Grade SSL/TLS with Nginx and StartSSL as a story · 2 points
HN discussion