Linux: freedom of choice, but if you choose wrong we'll be totally assholes about support

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Linux: freedom of choice, but if you choose wrong we'll be totally assholes about support

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Mr Dog posted:

the problem with ssl is it tries to be all things to all people and generally has way too many knobs on it (much like your mother etc etc)

something that important should be a lot easier to lock down by virtue of not supporting a whole bunch of bogus configurations

also CAs are a loving racket but you knew that already

if you require somebody to be competent and give a gently caress while setting things up to be secure then guess what, 99% of the internet is going to be insecure because the people whose job it is to secure poo poo are, more often than not, doing the absolute minimum possible amount of work they can to not get fired (or "managed out", whatever)

supposedly NaCL is the new hotness crypto-wise, but that's a library for replacing PGP, not SSL, and anyway it uses a totally hardcoded ciphersuite that also happens to be brand new and sorely lacking much of a proven track record so once somebody discovers an attack for it ur hosed

Thats the whole point though is that SSL should be so piss-easy that you don't have to think about it at all. If everyone important got on the same page about this we could have the following worked out in like 2 weeks:

1) Apache/nginx/IIS all create self-signed certificates on the fly whenever a clear text communication would take place.

2) Web browsers accept self-signed certificates without making GBS threads themselves about how insecure everything is.

It kills me that you get no warning from a modern browser for submitting data in cleartext but you get sirens and poo poo if you try to use a self-signed certificate.

# ¿ Nov 19, 2014 01:52

Adbot: ADBOT LOVES YOU

# ¿ May 19, 2025 12:34

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Cocoa Crispies posted:

you still need some semblance of this, like if you are at starbucks and convince somebody that you have a self-signed cert for citibank

We currently don't have warnings about cleartext connections so why do we need them for self-signed connections?

# ¿ Nov 19, 2014 02:00

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pseudorandom name posted:

That's because transmitting data with no security is a valid use case but there's never a reason to use a self-signed certificate because they're vulnerable to MITM.

Somebody actually using a self-signed cert is a reasonable signal that you're the victim of an attack in progress.

It'd be more useful if browsers complained at you before you submit credit card numbers or passwords in the clear.

Cleartext is objectively worse than self-signed. You can man in the middle even easier with cleartext. There is no reason to ever use cleartext.

# ¿ Nov 19, 2014 02:01

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

because one of them is shown as implicitly 'secure' to the user

No, the presentation to the user is:

self-signed <<<<<<<<< cleartext < signed

Which is obviously wrong because its really:

cleartext < self-signed < signed

# ¿ Nov 19, 2014 02:02

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pseudorandom name posted:

Cleartext is known a priori to be insecure, self-signed is just as insecure but gives a completely false sense of security.

The only way it'd be useful is if the browser UI just treated it as being cleartext, except the only time it shows up on the current Internet is when a MITM attack is in progress so browser UIs are even more hostile to the concept.

No it isn't, you're making a strawman argument about some fictional "public at large" character that doesn't exist. You're assuming that there is no way imaginable that a browser could delineate between different levels of security for the end user. Your argument is clearly wrong because you're simultaneously assuming that the public at large knows that cleartext is insecure which I believe strongly is false.

# ¿ Nov 19, 2014 02:06

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

they know. because secure sites have a green lockpad

Right. The browser is designed to seamlessly communicate to the end-user how secure the connection is. That is how it should be. Now go use chrome of FF or whatever and visit these 3 types of sites:

1) cleartext
2) self-signed
3) signed

And you will be able to observe that the browser communicates to you that self-signed is less secure than cleartext which it isn't. If we could get rid of this problem of communicating to users we could configure web servers very easily to encrypt all internet traffic automatically. It would be a trivial detail compared to getting browsers to play along.

Imagine this, red bar crossed out for cleartext, yellow bar with an open padlock for self-signed, green bar with locked padlock for signed. Now we upgrade our servers and all our pages go from red to yellow.

# ¿ Nov 19, 2014 02:12

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

self signed certs are not secure

They're more secure than cleartext. The only metric you could possibly use for declaring them 'not secure' is if your goal is perfect security which flatly does not exist.

Sniep posted:

dude what the gently caress.

most of the internet is clear text and doesnt need to be anything more secure.

encryption exists to prevent people from reading the poo poo you send to a server and get back. i dont care about that when i'm streaming netflix that every video chunk is encrypted or when i browse a public forum that my posts are sent encrypted before they are displayed in clear text.

scaring everyone with a giant red X when you're using normal rear end websites is retarded

It does need to be more secure as it would raise the cost of bulk data collection to the point of making it impossible. It's 2014 there is no reason to use cleartext for any service.

Salt Fish fucked around with this message at 02:18 on Nov 19, 2014

# ¿ Nov 19, 2014 02:16

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Captain Foo posted:

salt fish u dumb

Bruce Schnier and Poul-Henning Kamp are on my side and the NSA is on yours so I think perhaps I am right.

# ¿ Nov 19, 2014 02:22

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

nice appeal to authority fuCker

An appeal to authority is only a fallacy when the person isn't actually an authority.

https://www.youtube.com/watch?v=fwcl17Q0bpk&t=897s

# ¿ Nov 19, 2014 02:24

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

bobbilljim posted:

those self signed certs make it impossible for the NSA to get your data

The point is that *nothing* makes it impossible for the NSA to get your data. You can only increase the cost of getting your data.

# ¿ Nov 19, 2014 02:26

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

christ no one is talking about ssl to secure themselves from the nsa

The NSA's stated goal (publicly stated) is to collect all internet communications. One of their publicly stated methods of doing this is by undermining encryption and encouraging the use of cleartext. SSL directly undermines their ability to do this.

# ¿ Nov 19, 2014 02:30

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Sniep posted:

PROS: Might make the NSA's job harder by 20% to get your data if they are interested in it

CONS: Every grandma who clicks a link in a email and gets a site "and it says citi-bank.com right there, green shield and all, where did all my money go?" "grandma no that dash it's not citi-bank.com its citibank.com you need to look for" "why do they make this so hard?"

That isn't how the NSA collection programs work. They don't have to target you or "want it" they automatically collect it by virtue of it being cleartext. They keep a list of every site you visit in cleartext for example. These lists are kept for multiple months and if you are on a list, for example by googling for tor or tails, then they keep it forever.

Also, your grandma is going to fall victim to cleartext phishing if anything. Every phishing site I've basically ever seen (and I used to admin reseller servers so that is in the hundreds) has used cleartext. Probably 99% of phishing sites use cleartext.

# ¿ Nov 19, 2014 02:37

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

none of this makes self signed certs good

If I connect to web servers via self-signed certs the NSA cannot automatically record which domains I visited without doing a MITM attack which to my knowledge they are unable to automate. How is that moving goal posts? I'm still harping on cleartext < self-signed < signed.

# ¿ Nov 19, 2014 02:40

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Sniep posted:

right and that's because currently there's no way they can cheat out a "secure site"

tell me and tell me honestly you think fraud would go DOWN when all the people trained with the badge now see the badge and go thru with it, because now it's not plaintext and plaintext gets a Big Red X

There isn't a badge. You're inventing a badge. Its a strawman UI design that I'm not going to defend. Interestingly enough your strawman indicates that you understand that browser UI can communicate security to people. Right now they're communicating that cleartext is fine and that isn't okay.

# ¿ Nov 19, 2014 02:41

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

So the entire argument against is literally "we would never be able to train the users!". It's handwaving away a technical solution because the UX is too hard. "Gosh, I just don't know how we'd make the UI, so lets just use cleartext" is actually what I'd expect from a group of OSX users and lazy programmers (IE yospos).

# ¿ Nov 19, 2014 02:57

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

self signed certs are not secure

Okay, so if I post a message encrypted with my self-signed cert you can decrypt it? Nothing is secure, there are just varying costs of breaking in. This is true for all security systems everywhere forever.

# ¿ Nov 19, 2014 03:01

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

the person who made the cert can

Can you?

# ¿ Nov 19, 2014 03:03

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

pram posted:

no theyre good because some youtube guy said they stymie the NSA

"Some youtube guy" okay, you're really showing off your credentials with that one.

# ¿ Nov 19, 2014 03:13

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Keep loving cleartext guys, I just donated 250 dollars to the EFF so I could get one of their sweet hoodies (choose between 2XL and 3XL lol) so gently caress ya'll and gently caress the NSA bring back LF I'm out

# ¿ Nov 19, 2014 03:52

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Notorious b.s.d. posted:

unix desktops, then and now, are plagued by the fact that most of the users mostly want to arrange a bunch of terminal windows. if the graphical ui is half-baked no one really cares, as long as the core task of organizing xterms works out

there are no normal, non-developer users. never have been.

this makes gnome 3 especially laughable because it fails at the one thing that actually has to work. i would rather use suntools (stools?) from 1985.

This is true but only if you add in a browser window with the terminals.

# ¿ May 9, 2015 03:55

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

ahmeni posted:

I swapped my Linux drive into an old laptop to make a headless steambox and loving lol at the new xorg failure startup screen

Why is the youtube logo frowning at me?

# ¿ Aug 30, 2015 05:10

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

ahmeni posted:

it only does it when i has focus in osx so nope

Wow thanks Steve, xeyes works great on Fedora 22

# ¿ Nov 20, 2015 17:52

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

I didn't read any of this thread but I want to say that SUSE sucks poo poo and anyone who uses this trash is a loving idiot. Good lord. I can tell their business model is 1) charge for support 2) make it unusable and ensure every feature of the OS is worse than their upstream so that you have to cut as many tickets as possible.

# ¿ Sep 10, 2020 20:36

Adbot: ADBOT LOVES YOU

# ¿ May 19, 2025 12:34

Salt Fish: Sep 11, 2003; ｍｌｅｍ; Cybernetic Crumb

Time to name our network management daemon. How about WICKEDD with two Ds? HELL YEAH Time to RIP THE CURL and watch my networking fail to come up 30% of the time for literally no reason. Wicked!!!

# ¿ Sep 10, 2020 20:38

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Linux: freedom of choice, but if you choose wrong we'll be totally assholes about support