Here's a fun PoC I built thanks to Ben's dataset. I don't want to ruin the surprise, so just try this command. (It's harmless.) ssh For the security crowd: don't worry, I don't have any OpenSSH 0day and even if I did I wouldn't burn them on… »

Quick and dirty annotations for Go stack traces

When, like RRDNS, you have tens of thousands of goroutines stack traces become meaningless quickly. You know that a listener goroutine is stuck, but what's special about it? My trick is passing a recognizable integer to the goroutine when starting it. Read more details on the CloudFlare blog. Quick and… »

Technical notes: convert a partition image to a bootable disk image

I decided I will blog short technical guides when I do something undocumented. These are probably of zero interest to the blog followers and are just meant for Google. If they annoy, tell me and I'll get a wiki or something. I am moving a machine off Linode (old style… »

Setting Go variables at compile time

The tl;dr is that the Go linker -X option is awesome. Read about it on the CloudFlare blog. Setting Go variables from the outside | CloudFlare Blog (archive)… »

Go has a debugger—and it's awesome!

godebug is a clever Go debugger that rewrites the source of your program on the fly to enable breakpoints and stepping. Read about it on the CloudFlare blog. Go has a debugger—and it's awesome! | CloudFlare Blog (archive)… »

How Plex is doing HTTPS for all its users

This week Plex, a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user's servers. This is actually pretty interesting. Background A quick overview of the Plex architecture to understand why this is different from the average HTTPS deployment. The server is… »

Logjam explained

Logjam is a downgrade attack against the TLS protocol itself which exploits EXPORT ciphersuites. I wrote a long explanation of how the attack works and its background (what Diffie-Hellman is and how exactly it's used in the TLS handshake) on the CloudFlare blog. Logjam: the latest TLS vulnerability explained | CloudFlare… »

The unofficial Chrome SHA1 deprecation FAQ

Chrome is visually penalizing long-lived SHA1 HTTPS certificates. The information about it is a bit scattered around so I'm writing this to provide a complete and hopefully correct overview. Just give me the tl;dr If your certificate is expiring after Dec 2015 and: it's signed with SHA1, or one… »

The sad state of SMTP encryption

This is a quick recap of why I'm sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it. SMTP SMTP is the protocol that mail servers talk between them to deliver mail. Standardized in 1982 it used to be, unsurprisingly, 100%… »

Komodia/Superfish SSL Validation is broken

If you are on the ball already and just want the new vulnerability, scroll to the "client side SSL verification" section. tl;dr The Komodia/Superfish proxy can be made to allow self-signed certificates without warnings. Recap Some Lenovo laptops shipped with Superfish preinstalled - an ad injecting software. How… »

Make your own Superfish infected VM

Hello, a quick post to allow everyone to play along at home with this Superfish thing. (In case this isn't clear: this post is for security professionals only) Disclaimer: sleep deprived and exhausted. Been working on Badfish for 16 hours now, expect inconsistencies. If you don't know what this is… »

So I lost my NAS password

I got my WD My Book World Edition II NAS out of the closet. The reason it went in the closet is that I locked myself out of SSH access, and in the meantime I forgot most of its passwords. Still, I need a NAS, so let's get it back… »

scrypt all the things!

If you take away only one thing from this post let it be this: If you have a human password, scrypt it. The reason passwords suck is because humans are terrible at generating and storing entropy. (That and password reuse, but that's another story.) And the reason that's a problem… »

PSA: enable automatic updates. Please.

I want you to do a quick inventory of all the boxes, VPS, servers etc. you have root on. Ok, now tell me, when is the last time you updated the one you almost forgot about? Is it vulnerable to ShellShock? Is it vulnerable to Heartbleed? Go patch it now,… »

"The Heartbleed Test" @ OWASP / NYU Poly

OWASP invited me to give a talk at NYU Polytechnic on Tue, June 24th 2014 about the story behind the test, how it worked and how it scaled from zero to performing 200 millions tests the first two weeks. Recording and slide deck are available. /* * * CONFIGURATION… »

Salt & Pepper, please: a note on password storage

Everyone will tell you that the best practice for password storage is [sb]crypt with random salt. Ok, we got that and even maybe got everyone to agree. But let me bump that up a notch: do you know what pepper is? The concept of peppering is simple: add a… »

On and encrypted private key uploading

One thing in particular of attracts a lot heat recently: they support uploading your encrypted key on their servers. This usually is pointed at as a mortal sin. Well, here is my private key, the untouched output of gpg --armor --export-secret-keys | gpg --armor --clearsign. -----BEGIN PGP… »

Why Go is elegant and makes my code elegant

This is a enthusiast blog post. I'm not even gonna speak about how concurrency comes easy with Go. Honestly, I'm not good enough to speak about it. I'll just speak about how using Go in my everyday programming makes me happy. Go has elegance, good tools and has had the… »

My remote shell session setup

It's 2014 and I feel entitled to a good experience connecting to a remote server, instead the default still feels like telnet. After searching for quite a long time, I finally built my dream setup. These were the requirements: I want a single window/tab/panel of the terminal I'm… »

Native scrolling and iTerm2

tl;dr See the bullet points for the supported programs and the last paragraph for installation. Something I always wanted is native touchpad/mousewheel scrolling in all my terminal programs. MouseTerm hacks that into the OS X Terminal, but I am a iTerm2 user. I tried and gave up researching… »