Slashdot Mirror
Ivan Ristic and SSL Labs: How One Man Changed the Way We Understand SSL
An anonymous reader writes: Ivan Ristic is well-known in the information security world, and his name has become almost a synonym for SSL Labs, a project he started in early 2009. Before that, he was mostly known for his work with OWASP and the development of the wildly popular open source web application firewall ModSecurity. While SSL Labs was something Ristic worked on in his spare time, over time it became his main focus. In fact, over the years, the project incorporated a great number of checks that are impossible to perform manually. It's a game changer because, to assess your TLS configuration, you don't need to be an expert. Read the story about the project's evolution on Help Net Security.
I also find SSL labs to be a great tool to evaluate web sites of vendors and company hosted sites.
-- Slashdot, making the Left look conservative since 1997.
Do you mean that you can't recommend it ENOUGH? I know these kind of corrections can seem pedantic, but the omission of a word in this case completely changes the meaning.
(stolen from DaBum) I am dyslexia of borg - your ass will be laminated.
No it does.
Why is it that Google (a company that no doubt employs some very smart people) cant fix google.com (one of the most popular sites on the entire internet) so it gets an A grade from this SSL test?
YouTube (another Google asset) also gets a similarly poor grade.
In fact every Google-owned domain I tested ALL get the B grade. Does Google not have any people on staff who understand SSL security?
A kiwi is a creature that eats roots and leaves.
Shhh... don't tell anyone about SSL Labs. I know next to nothing about security but am now the security expert thanks to this site.
I can test a site, come back and throw around some security jargon about why the site isn't secure, "Oh your cipher suites appear to be incompatible, and your hashing algorithm is out of date" and customers throw money at me to fix it.
I don't even know what half of that stuff means, but if more people know about it, I'll be forced to find real work...
The hairy nosed wombat is a creature that eats roots shoots and leaves
Even though it existed at this time, even SSL Labs did not bother with TLS 1.1/1.2 in the early days! SSL Labs also choked on anything stronger than 1024-bit DHE due to the use of JSSE. Of course both of these problems has been long fixed.
I agree. And punctuation can be somewhat important as well. For example:
Let's eat, grandma.
Let's eat grandma.
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
It's not about what average user of SSL Labs understands about it. That's why it uses just a couple of letter grades to communicate an overview of the findings. The most important part is that ordinary users can go to their hoster or a website owner and ask them why their site gets a 'D'. The people who run those web servers will know more about the detailed findings of SSL Labs and implement them accordingly.
A personal example. I know a thing or two about SSL/TLS but some things on the SSL Labs results page are over my head too. However, when I noticed that my own site got an 'F' (because of some old cyphers that were still accepted) I filed a ticket with my hoster. A week later they had upgraded the entire shared hosting environment and upgraded everything to an 'A'. In one fell swoop many thousands of websites had their security upgraded because I sent my hoster a detailed outcome of the SSL Labs test.
It's okay. The only thing I know about ModSecurity is that I should enable it when I bang out bad PHP.
"So long and thanks for all the fish."
Yeah, simple typo that no one can fix in the year 2015. The book is excellent.
-- Slashdot, making the Left look conservative since 1997.