theartisan changed the topic of #rubygems-trust to: Current Status: drafting requirements. please leave comments on http://goo.gl/ybFIO :: Logs at http://irclog.whitequark.org/rubygems-trust
billdingo-afk is now known as billdingo
<tarcieri> *crickets*
<drbrain> huh, well, rubygems-openpgp-ca.org fixed their HTTPS problem
<drbrain> well, for www., no-www just goes to HTTP
<kseifried> I'm so glad every uses ssl/tls correctly
<kseifried> the sad thing is he's on EC2 and it's so easy to do right there
<dstufft> SSL is hard ok
<drbrain> kseifried: www. is on EC2, no-www is godaddy
<kseifried> ..?
<kseifried> that's... makes no sense
<drbrain> I know
<kseifried> dstufft, : agreed. which is why you use ELB and use amazon defaults and you're done :P
<drbrain> let alone that no respectable rubyist would use godaddy for a new site
<drbrain> the no-www is a landing redirect
<dstufft> Doesn't ELB require a CNAME
<drbrain> I don't know why they don't use the heroku landing redirect
<dstufft> which you can't do at the apex :V
<kseifried> why does ahh its served via heroku
<kseifried> no wonder it's fubar
<drbrain> it's fubar by design
<kseifried> heroku seems to have some real ssl "challenges"
<dstufft> eh
<dstufft> https://crate.io/ is now on heroku
<dstufft> SSL is fine
<dstufft> Basically the only problem is you can't CNAME the apex with most providers
<drbrain> not heroku, the person who set up their DNS this way in the first place
qmx|away is now known as qmx
<drbrain> let's use HSTS but not have SSL enabled for one of our hostnames!
<kseifried> well sort of. heroku allows BEAST/renegotiation attacks which is not ideal
<dstufft> So you're stuck using some sort of redirect on the apex, or using DNSimple/another provider that either allows you to CNAME the apex
<dstufft> kseifried: too bad you gotta pick between BEAST/Lucky 13 and RC4 now :(
<dstufft> whateve the RC4 attack is called
<kseifried> hahaha yah
<kseifried> TLS FTW!
<drbrain> dstufft: you're missing out on the third option
<drbrain> TLS that few browsers support
<dstufft> drbrain: well there's ciphers that aren't RC4 that aren't BEAST/Lucky 13 vuln too
<dstufft> just again few browsers support
<dstufft> :/
<dstufft> I'm not even giving a fuck about TLS right now because I've just spent 2 weeks trying to convince people that spidering random external urls from PyPI is a bad idea
<dstufft> and i'm still getting people arguing with me
<drbrain> hehehe
billdingo is now known as billdingo-afk
<kseifried> I'm always amazed at what terrible things, security wise, people will argue for doing
<kseifried> I can understand arguing against security, people think it's a chore
<kseifried> but like "no,. we should inject random vials of blood into our body. something good might happen!"
<kseifried> anyone here used raidcall BTW?
<tarcieri> drbrain: o_O
<tarcieri> drbrain: needs more HSTS, wtf?
<tarcieri> re: rubygems-openpgp-ca.org
<tarcieri> derp
<tarcieri> kseifried: hahaha
<kseifried> no really.
<tarcieri> dstufft: there's not a real RC4 attack... yet
<tarcieri> dstufft: I expect it will be coming quite soon
<drbrain> I submitted one-shot MDNS patch to ruby's Resolv today, it has a small security hole
<kseifried> tarcieri, : they said the same thing about 3des/md5 and speak and spell Elmo
<tarcieri> dstufft: but yeah, basically we're all fucked
<drbrain> it doesn't do the "local network" checks ☹
<tarcieri> kseifried: haha yeah it's definitely coming
<drbrain> unfortunately there's no portable way to discover what your local network is ☹
<tarcieri> kseifried: it needs someone to adapt djb's research into a practical attack though
<tarcieri> kseifried: right now it's just a theoretical attack
<kseifried> the problem is someone may have done it
<tarcieri> that said INDCCA2 security has been broken, time to move on
<tarcieri> to AES-GCM
<tarcieri> or something
<tarcieri> but Adam Langley says don't use AES-GCM
<tarcieri> *shrug*
<kseifried> the problem is not all attacks get nicely written up and publicized :P
<tarcieri> I should ask him what he thinks now
<tarcieri> asked on Twitter
<tarcieri> kseifried: yeah, well, the academics released their research yesterday. We probably have a few days ;)
<tarcieri> until the Internet melts
<drbrain> more likely to melt from people getting those 2**32 packets
<tarcieri> haha
<kseifried> which one is this?
<tarcieri> err wait
<tarcieri> that's not it
<tarcieri> fucking djb, names everything slides.pdf o_O
<drbrain> heh
<drbrain> there's an RC4 exploit where if you have enough RC4 streams you can recover the first 256 bytes
<tarcieri> heh
davidbalber|away is now known as davidbalbert
<tarcieri> see also:
<drbrain> ah, 2**24 for high probability
<tarcieri> seriously though, uhh... the guy running the OpenPGP CA isn't using HSTS?
<tarcieri> wat?
<tarcieri> and he wants to run a CA?
davidbalbert is now known as davidbalber|away
<drbrain> tarcieri: on http://www. there's HSTS
<tarcieri> o_O
<drbrain> tarcieri: yesterday the SSL cert was invalid though
<tarcieri> this does not bode well
<dstufft> just dont think about it so hard
<drbrain> tarcieri: for some reason www. is heroku but no-www is godaddy (which doesn't respond to HTTPS)
<dstufft> it'll be ok
<tarcieri> derp?
<tarcieri> before I ever announced a CA I'd probably point someone like Rustle League at it
<tarcieri> and be like
<drbrain> I don't consider people respectable if they buy a domain from godaddy
<tarcieri> "do your worst"
<tarcieri> lol
davidbalber|away is now known as davidbalbert
<tarcieri> hahaha
<tarcieri> seems good bro
<kseifried> honestly at this point I think... we need to start using AES256 and NIST needs to run nextgen-AES starting like right now
<kseifried> and nextgen-SHA
<drbrain> it must be interesting to be a cryptographer
<tarcieri> kseifried: I'm using XSalsa20 + Poly1305 ;)
<drbrain> "I'm going to invent this really secure thing that most likely has a fundamental flaw humanity just hasn't discovered yet"
<tarcieri> kseifried: I will probably use Blake2 instead of SHA3 too
<kseifried> I hope this leads to Johnny Mnemonic data couriers
<tarcieri> FOR SPEED
<kseifried> cause that would fucking rock
<tarcieri> hahaha
<tarcieri> Fire Upon the Deep style xor pad sneakernet
<kseifried> and honestly at this point a courier with a few hundred TB in their head will be faster than the inet anyways
<tarcieri> once you get the XOR pads to all parties
<tarcieri> you're good
<tarcieri> and you can split them apart Shamir style
<tarcieri> so no one person holds the full pad
<tarcieri> until they all rendezvous
<kseifried> yah
<tarcieri> lulz
<tarcieri> save that for post-quantum crypto ;)
<kseifried> I sitll .. I mean I get for links how it works
<kseifried> but like ... for email? I don't get it
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
qmx is now known as qmx|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
workmad3 has joined #rubygems-trust
workmad3 has quit [Ping timeout: 260 seconds]
havenwood has quit [Remote host closed the connection]
billdingo-afk is now known as billdingo
_whitelogger has joined #rubygems-trust
qmx|away is now known as qmx
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
qmx is now known as qmx|afk
davidbalber|away is now known as davidbalbert
qmx|afk is now known as qmx
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
davidbalbert is now known as davidbalber|away
billdingo is now known as billdingo-afk
billdingo-afk is now known as billdingo
davidbalber|away is now known as davidbalbert
qmx is now known as qmx|away
billdingo is now known as billdingo-afk
davidbalbert is now known as davidbalber|away
davidbalber|away is now known as davidbalbert
qmx|away is now known as qmx
bradland has joined #rubygems-trust
bradland has quit [Client Quit]
bradland has joined #rubygems-trust
workmad3 has joined #rubygems-trust
bradland has quit [Quit: bradland]
workmad3 has quit [Ping timeout: 240 seconds]
qmx is now known as qmx|away
havenwood has joined #rubygems-trust
davidbalbert is now known as davidbalber|away
qmx|away is now known as qmx