Links 2016-02-29
Security & Crypto edition
- On the Juniper backdoor, Matthew Green
And while every reasonable person knows you can’t just drop “passive decryption vulnerability” and expect the world to go on with its business, this is exactly what Juniper tried to do. Since they weren’t talking about it, it fell to software experts to try to work out what was happening by looking carefully at firmware released by the company.
- Why I don’t care that Dell installs Rogue Certificates On Laptops, Tom Limoncelli
Every new machine should be wiped and reloaded with your organization’s “standard build”. Having a “standard build” is one of the foundational pieces of infrastructure that your organization is responsible for. It is so fundamental that not having this kind of infrastructure is negligent.
- The Moral Character of Cryptographic Work, Phillip Rogaway
As computer scientists and cryptographers, we are twice culpable when it comes to mass surveillance: computer science created the technologies that underlie our communications infrastructure, and that are now turning it into an apparatus for surveillance and control; while cryptography contains within it the underused potential to redirect this tragic turn.
- The IPv6 Numeric IP Format is a Serious Usability Problem, Adam Ierymenko
While the IPv6 protocol itself is fine, its original designers made some truly bizarre decisions around how to represent numeric addresses.
- How to C (as of 2016), Matt Stancliff
The first rule of C is don’t write C if you can avoid it. If you must write in C, you should follow modern rules.
- Mozilla SSL Configuration Generator
The goal of this document is to help operational teams with the configuration of TLS on servers.