Elektrine lite

← Feed

Andrew Ayer

agwa@follow.agwa.name

@agwa@agwa.name<br/><br/>Bootstrapped founder of SSLMate (<a href="https://sslmate.com">https://sslmate.com</a>) and DNS Helper (<a href="https://www.dnshelper.com">https://www.dnshelper.com</a>). Making SSL certificates and DNS records easier. <a class="hashtag" data-tag="webpki" href="https://follow.agwa.name/tag/webpki">#WebPKI</a> and <a class="hashtag" data-tag="certificatetransparency" href="https://follow.agwa.name/tag/certificatetransparency">#CertificateTransparency</a> research on the side.

Posts

  • View post

    Install software updates =&amp;gt; bitten by AI-written bugs Don&amp;#39;t install software updates =&amp;gt; pwned by AI-discovered vulnerabilities Uninstall all software =&amp;gt; inner peace

  • View post

    FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies https://www.agwa.name/blog/post/fastcgi_is_the_better_protocol_for_reverse_proxies

  • View post

    Certificate authority Certum is asleep at the wheel, logging certificates to Certificate Transparency logs that are not widely trusted. Certum certificates expiring in 2027 might not work in browsers. There&amp;#39;s really no excuse for this, as Apple and Chrome publish simple JSON files specifying exactly what logs a CA should be using!

  • View post

    New blog post: Certificate Authorities Are Once Again Issuing Certificates That Don&amp;#39;t Work https://www.agwa.name/blog/post/cas_are_issuing_broken_certificates_again

  • View post

    Before I use a third-party Go package, I like to know its transitive dependencies. I can&amp;#39;t just look at go.mod, because it lists dependencies for all the packages in the module, not just the package I&amp;#39;m importing. So I made a little web page that runs `go list -deps` to get the real dependencies of a package: https://sourcespotter.com/deps/

  • View post

    I just released govulncheck-deep, a program that recursively descends deep into archive files, S3 buckets, APT repos, etc. and runs govulncheck on every Go binary that it finds. I run it daily to make sure SSLMate&amp;#39;s production environment stays free of known vulns. There are other tools that do deep vulnerability scanning (e.g. Trivy), but they don&amp;#39;t use govulncheck so they&amp;#39;re overrun with false positives. https://github.com/AGWA/deepscan

  • View post

    New blog post: Why IP Address Certificates Are Dangerous and Usually Unnecessary https://www.agwa.name/blog/post/ip_address_certs

  • View post

    Hey look, another certificate authority trusted ONLY by Microsoft is issuing certificates without validation (1.1.1.1/Cloudflare DNS in this case): https://crt.sh/?sha256=D42B028468E73795365102058CBCD350AD0A0B9CA7073C5362A570C5EC208A92 (h/t Hacker News user JXzVB0iA)

  • View post

    The State of OpenSSL for pyca/cryptography: https://cryptography.io/en/latest/statements/state-of-openssl/ Spoiler: it&amp;#39;s bad.