Slashdot Mirror


User: roman_mir

roman_mir's activity in the archive.

Stories
0
Comments
16,118
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 16,118

  1. Re:firefox doesn't really make it easy for the use on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: -1, Redundant

    It is in the name: ERROR.

    Show a WARNING - Self Signed Certificate.

    The language is important if you want any kind of security adoption for many sites.

    You better tell me what can really be done about this:

    SSLInsecureRenegotiation on

    which presents a MITM possible attack with any type of certificate, self signed or not.

  2. Re:Self-signed certs are vulnerable to MITM on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: 1

    This is not an error of ssl or of http, this should come with a warning from a browser, no question, but my users will know the site and the cert.

    I completely disagree that this should come with a label 'Error'.

    It should come with some label like: 'Warning, the certificate is self signed, you better know what it is'.

    However you skipped completely the part of my post, where I am talking about the real issue:

    SSLInsecureRenegotiation on

    which is in itself prone to MITM type of attack, regardless of whether the cert is self signed or authorized centrally.

  3. Re:firefox doesn't really make it easy for the use on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: 1

    It's not an error, it should be a warning. My users will know the site and the certificate number and this IS how I want the site to work, I don't need a CA or an OpenID to do this, it's not wrong to do.

    And it is a million times better than sending plain text over any line any day.

  4. Re:firefox doesn't really make it easy for the use on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: 1

    But this is not an ERROR, this is by design and should come with some warning. But an error? No, if the user knows the certificate and the site this is just a warning.

  5. Re:Self-signed certs are vulnerable to MITM on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: 0, Redundant

    It is a configuration choice, not an error, and by the way this directive:

    SSLInsecureRenegotiation on

    has to be turned on, in case you didn't notice a huge portion of my comment, it already is a problem that can lead to a possible MIM attack but if I don't have it on, then IE does not work and FF 3.5 and probably earlier versions don't work on Linux distros and maybe on Windows (I didn't check.)

    It is better to run a https site than http, whether the script is self signed is another matter, but it's not an error, especially given what kinds of clients people still use.

  6. Re:Self-signed certs are vulnerable to MITM on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: 1

    It is still not an error of SSL or of the site, it is a configuration choice.

  7. firefox doesn't really make it easy for the users on Firefox Extension HTTPS Everywhere Does What It Sounds Like · · Score: 5, Interesting

    Firefox itself does not really make it easy for the users or for admins to use https everywhere.

    I just made a small site, it's for a business, that runs everything through https, I redirect http to https completely. Firefox 3.6.3 on Windows had no problem running the site. IE on windows couldn't open the encrypted pages, Firefox 3.5 on any GNU/Linux distro couldn't open them either, to fix this, I had to add this to /etc/conf.d/ssl.conf : SSLInsecureRenegotiation on

    That fixed the IE and FF3.5 on Linux problem.

    Here is the description of this flag from apache mod_ssl directive description page:

    SSLInsecureRenegotiation Directive
    Description: Option to enable support for insecure renegotiation
    Syntax: SSLInsecureRenegotiation flag
    Default: SSLInsecureRenegotiation off
    Context: server config, virtual host
    Status: Extension
    Module: mod_ssl
    Compatibility: Available in httpd 2.2.15 and later, if using OpenSSL 0.9.8m or later

    As originally specified, all versions of the SSL and TLS protocols (up to and including TLS/1.2) were vulnerable to a Man-in-the-Middle attack (CVE-2009-3555) during a renegotiation. This vulnerability allowed an attacker to "prefix" a chosen plaintext to the HTTP request as seen by the web server. A protocol extension was developed which fixed this vulnerability if supported by both client and server.

    If mod_ssl is linked against OpenSSL version 0.9.8m or later, by default renegotiation is only supported with clients supporting the new protocol extension. If this directive is enabled, renegotiation will be allowed with old (unpatched) clients, albeit insecurely.
    Security warning

    If this directive is enabled, SSL connections will be vulnerable to the Man-in-the-Middle prefix attack as described in CVE-2009-3555.
    Example

    SSLInsecureRenegotiation on

    The SSL_SECURE_RENEG environment variable can be used from an SSI or CGI script to determine whether secure renegotiation is supported for a given SSL connection.

    I wonder if there are other ways of making this work with my other directives:

    SSLEngine on
    SSLCipherSuite HIGH:MEDIUM:!aNULL:+MD5

    SSLVerifyClient none - I am thinking about switching it to 'require' right now, but will have to test all browsers with it again, but have to do it I think.

    Oh, and getting it all to run together with apache httpd with mod_ssl + mod_jk + apache tomcat is quite a hassle.

    But most unfortunate thing about FF is how it treats the self-signed certificates. It shows it as an SSL ERROR, to which exceptions must be made for the user to be able to enter the site. Can FF developers think about this fact for like longer than a second? It is not an error to run a site with a self-signed certificate, it is a configuration choice and it provides an important role to the site: encrypted traffic for login and for the data transferred to and from the client.

    Why is FF showing this to the users as an error? This is not an error, this is by design and it is a special case of usage. Who is not frustrated by the browser treating self signed certificates as if they are some sort of a disease? They provide an important role - a way to secure communications between the server and the browser.

    Can this be looked at, because I am SURE this prevents various sites from using encrypted traffic in the first place and it is a BAD thing, not a good one. All traffic needs to be encrypted, but especially user name/password traffic shouldn't be sent around in plain text.

    Name it what it is: an exceptional case of using security to encrypt traffic, a case where the site may not necessarily be what it wants to be seen as, but at least the traffic is actually encrypted. It's terrible if someone comes to your site just to see: SSL ERROR on it, OF-COURSE admins don't want THAT message to be shown on their sites, why do you think so few sites do security properly?

  8. Re:I've been dealing with this for years. on Falsehoods Programmers Believe About Names · · Score: 1

    Hey, it's an excellent reason not to fill out tax forms at all.

  9. Re:there are entire classes of society on In Ukraine, IT Freelancing Under Threat · · Score: 1

    I am half asleep, so missed a line there:

    0-100,000 -> 100% of all sales taxes are returned
    100,001-200,000 -> 1/2 of the paid sales taxes are returned
    200,001 and up -> no taxes can be returned

    and

    government's role is set to do justice+punishment+military enough only to prevent an invasion + government is no longer allowed to run the economy, so it is no longer controlling the money supply, the gold standard is restored to the pre-1913 levels.

    prices will go down, not up.

  10. Re:there are entire classes of society on In Ukraine, IT Freelancing Under Threat · · Score: 1

    0-100,000 -> 100% of all sales taxes are returned
    100,000 -> 1/2 of the paid sales taxes are returned

    and

    government's role is set to do justice+punishment+military enough only to prevent an invasion + government is no longer allowed to run the economy, so it is no longer controlling the money supply, the gold standard is restored to the pre-1913 levels.

    prices will go down, not up.

  11. Re:there are entire classes of society on In Ukraine, IT Freelancing Under Threat · · Score: 1

    Here is a simple one, so you can understand it.

    0-$100,000 - sales tax is completely returned if the claim is made, effective sales tax:0%.

    $100,001-$200,000 - 1/2 of sales tax is returned if claim is made.
    $200,001 ... - nothing can be claimed and no refund can be returned.

    Simple enough for you to get?

  12. Re:there are entire classes of society on In Ukraine, IT Freelancing Under Threat · · Score: 1

    NO, that's bullshit! You spend your money, the guy who has an income but does not spend money does not get taxed, instead he invests that money.

    So do you, you can invest your money. My example of how much is returned is just that - an example, whatever the actul brackets are, it's all up to discussion, but the main point - people need to be able to save money to invest and income tax stops that.

  13. Re:there are entire classes of society on In Ukraine, IT Freelancing Under Threat · · Score: 1

    You would take nothing that involves no income tax, that's your problem.

    It is totally possible to have a working system, a progressive tax refund for the 'poor', just like now, everybody would pay sales tax and then....

    0-15,000 - no sales tax, so return all money paid in sales tax on that amount
    15,001 - 30,000 - return 2/3 of the sales taxes paid on that amount.
    30,001 - 50,000 - return 1/2 of the sales taxes paid on that amount
    50,001 - 75,000 - return 1/3 of the sales taxes paid on that amount.

    75,001 ..... - cannot get any sales taxes back.

    This is only an example of how that would be working just fine, you can't see it because you are blind to the entire possibility.

  14. Re:there are entire classes of society on In Ukraine, IT Freelancing Under Threat · · Score: 1

    Can you please use more than half of a single neuron in your head to try and understand that the poor can apply for tax refunds, do you get it? Do you understand that if a poor person is too poor to pay taxes, he should be able to apply for tax refund? If the fact that the person is poor makes that person want to give up personal information to the government for a tax refund, he/she should do so.

    We should have NO INCOME TAX, we should have FLAT SALES TAX and then poor people should be able to file for a tax refund at the end of the year.

    Done, your issue is done, out of the door, gone, bye bye.

  15. Re:Know when on Employee Monitoring · · Score: 4, Insightful

    putting people to prison for downloading porn, even child porn, what a fucked up society.

  16. it falls where it wants to on Where Does IT Fall Within Your Organization? · · Score: 1

    It wonders around, mostly aimlessly, but sometimes it falls on the ground here or there.

  17. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 1

    As I said multiple times, the government has a role: justice department, a system to punish for transgressions against individuals and companies and a small military.

    All of this can be and used to be maintained with just some sales taxes before income taxes where pushed in by certain interests. Some say that this 'punishes the poor', if the poor want to get their money back, they would only have to sell their privacy to the government for that money, so they could file income tax returns and get their tax money back that they paid for the year.

    As to the roads, I believe the greatest mistake of US is the entire idea of the Fed being involved in economics and thus in building roads. The Fed has abused this particular power to no end. It must be responsibility of local/regional governments to build roads. The poor want their sales taxes, so they'll give up their privacy to the Fed, does everybody really not care about their privacy so much that they are willing to sell that for the roads? I think roads are responsibility of those, who drive on them, so in my economy all roads are private and belong to cooperatives.

    Protecting the environment is about judging/punishing - anyone found guilty of destroying individuals/public resources/environment gets financial and criminal charges brought up against them. If government should be able to do at least something right in their limited role, it should be the justice system.

    Pure scientific research that is not profitable for the next quarter must be sponsored like all things artistic - through charity, donors etc.

    Epidemic control through private hospitals cooperation.

  18. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 1

    I answered your cheap shot, because it was the only thing I disagreed with you on. There were quite a few Oil spill stories on /. where I said repeatedly: corporations must not be what they are - namely they must not provide the kind of limited responsibility that allows people to get away with murder, literally or figuratively speaking.

    I have no magic thinking, I don't see a reason why government should set laws that would prevent it from doing its direct responsibilities: justice and punishment for any transgressions, which can involve financial, punitive and criminal charges, and allowing people to hide behind the corporate status is a mistake.

    I am for three things to be provided by the government: working Justice and Punishment system and a limited military to protect the borders.

  19. Re:you're a freeloading parasite on In Ukraine, IT Freelancing Under Threat · · Score: 1

    Sales taxes was quite enough to sustain the US federal government before income tax was implemented, that's first. Secondly, if it wasn't for the government intervention into economies of the world, there would be no need for any 'airport security'. Thirdly, all of that security is just a theater, it's not real.

    Gold can come down in price if inflationary policies of government will stop, good luck with that.

    Lastly, the only measure of value of fiat money is price of items that you want to buy, and this has nothing to do with government buying back debt, which they WILL do by printing more money.

  20. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 1

    If a person is in bad economic shape, while the taxes are on sales instead of income, that person should be able to sell his privacy to the government for a tax refund.

    I do not subscribe to the camp: no sales taxes on necessities.

    I believe that if you want help in not paying sales taxes, you should get it if you qualify, but to get it you have to actually file your income tax papers, and that must be the only reason in the world to file those kinds of papers.

  21. Re:you're a freeloading parasite on In Ukraine, IT Freelancing Under Threat · · Score: 1

    why would I blame the government? The reason for gold prices to go down would be a good working economy and the government is doing everything to destroy a good working economy, should I be thanking them for destroying economy so that fiat money would become as useful as paper they are printed on?

    I don't blame governments, dude, I just can't stand people who do not understand economics of the long term (like a bit longer than 20 years; let's start with at least 150 year economic lessons?)

    Gold going down in price would mean that investments could be made into something else, like a business, what you are suggesting is some sort of a fall by 90% or such in a very short term, do I understand you correctly? If that was to happen, we would all benefit, including me, from some sort of a economic miracle.

    Ron Paul holds 50% of his savings in gold and he is a libertarian and he works in the government like nobody else does - to his own detriment. If he succeeds in fixing economy through sane government policies, then he loses his investments in gold. The reason why he still holds that gold is because he knows how little the chances of him succeeding are.

  22. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 2, Interesting

    Sales Tax to me seems like a great way to get back that capital your stealing for your country.

    - I have no idea what you said there.

    BTW I don't think the time period before Income tax really represented the situation we face today.

    - definitely. The economy now is in a different shape, on one hand enough time has passed for some new innovation to kick in, on the other hand the small business has fallen pray to the government created monopolies, who then moved production to Asia. It was a time before Keynesian ideas came to power in governments that government must force economy into debt/consumption death spiral. Today the income tax is a much more deadly weapon to economies and entire countries due to wars that states shove down people's throats with income tax money.

    Money is not printed frivolously and the government has broken up monopolies in the past who says they won't do so in the future.

    - Standard Oil was not a monopoly by the time it was broken up and AT&T and the rest were government created monopolies in the first place. One hand makes them, the other destroys them, that's productive. Monopolies are government creations through free money/regulations that kill off competition, through income taxes that kill off small competition and through tax breaks that favor government created monopolies.

    I'm sorry but we will never have a system that doesn't require some sort of favors to get the job done it's how politics work. It was like that before income tax and will be like that forever.

    - government has no place in economy, that's the only way to make that idea work.

    So avoid what you can legally it's your right to do so, but shoving money under the bed and hoping you'll be OK because you've got capital is pointless. Just look at Greece.

    - you are incredible, you know that? Greece is doing exactly what I am against: government borrows money to give out all of the handouts for all of the government workers, who have amazing standards of living, except all of that is done on borrowed money.

    Greece has no way in hell to pay their debts, never mind Germany getting them an impossible deal on cheap lending, of-course if Germany is so interested to keep France in the Union, they think they have no chance but to give Greece money to bail out the French bankers, who gave Greece the loans that could never be repaid in the first place. You are 100% clueless about what you speak there.

  23. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 1

    Wow, if I have conscience you should play "fair"?! :) You crack me up. Why don't you go and tell that to the government that prints money and gives it to their friends - the monopolies in all industries? You crack me up, why don't you say that to the government that uses income taxes to wage wars?

    Sales tax was plenty enough at least for the US government to work with before income taxes appeared due to the anti-saloon movement as well as a war effort in the beginning of the twentieth century. Sales taxes can even be made 'fair' not to 'punish the poor' as they say, because if you are poor enough that you want government intervention, you won't mind sharing your personal information with a government to get a tax reimbursement then.

    I absolutely hate income taxes, but I pay a some of that too unfortunately, but I am working on making sure I never have to sometime in the future. I pay sales taxes and property taxes in enough places to make sure my 'conscience' doesn't bother me, but trust me on this: my conscience is absolutely not bothered by not paying taxes, my conscience feels better whenever tax paying can be avoided.

  24. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 2, Insightful

    I kind of doubt that; what you're advocating will create a gigantic power vacuum where the government used to be

    - at least the US government was not always occupying that place, at least not before the beginning of the twentieth century.

    The best economic development, the biggest increase to overall quality of life for all people, including the most poor came with the industrial revolution, with the capitalism.

    Before capitalism there was no way to put together enough money and resources to start mid-size businesses. You are proposing a false choice: either government provides money to start a small business or the government does not provide money and small businesses do not start.

    This is ridiculous, government does the exact opposite to helping small businesses to start, they tax income. When your personal income that you are not spending on consumption is taxed, you cannot save money to invest and to start a small business.

    Yet another problem that government creates is inflation through printing money that is not backed up by production. You are again not understanding economics. Production is the only valuable thing, consumption is not. Any moron, any fool, any idiot, any dunce can consume.

    Consumption is the easiest thing to do. Production is hard and production is the only real measure of economy. If you produce nothing and only consume while borrowing/printing money, you are growing the trade imbalance that will eventually crash you.

    After the second world war the Keynesians thought that US economy will be worse of once the soldiers come home, because there would be such huge unemployment. The real economists - Austrians, understood that a huge supply of working force is an important instrument needed to start production, they also knew that women would come home from factories, this is how it worked out and economy boomed because of so much labor and no minimum wage laws, pretty much everybody who wanted had a job. Production begot consumption, it does not work the other way around. iPad did not exist, then it was produced and then consumption of iPad started, that's how it works.

    Sales tax would be plenty enough for any government to maintain a justice department, a punishment system and a minimum military needed to protect the state.

    The objection is often that sales taxes 'punish the poor', well, this is a very simple thing: if you are poor enough that you feel you must get some help from the government, do actually file your income tax papers and if you qualify, get the sales taxes returned to you, but you are exchanging it for the government getting into your private life.

  25. Re:It worked to stop Al Capone on In Ukraine, IT Freelancing Under Threat · · Score: 1

    I am anti-government getting into economics and passing moral judgments. The government has a role: justice system, punishment for crimes and minimum required military to keep foreign enemies at bay.

    Government trying to control the economy is the only reason economy is dying now. Government creates the monopolies in the first place, then monopolies take over the government.