full-disclosure - Secure HTTP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Mar 24 15:43:10 2006
From: kenneth.d.ng at gmail.com (Kenneth Ng)
Subject: Secure HTTP

On 3/24/06, Valdis.Kletnieks@...edu <Valdis.Kletnieks@...edu> wrote:
> Do the frikking SSL correctly on port 443 like the RFCs intend rather
> than cooking up some half-assed proxy scheme to work around it.
>
> <insert standard "if I had a nickle for every time somebody proposed a
> partial solution for the wrong part of the problem instead of doing it
> in the well-understood correct way in the first place, I'd be long since
> retired" speech here....>

You would be more than rich.  You won't believe the number of
"security improvements" I've had to knock down.  One application had
all the ports reassigned to all non standard ports.  When I asked why
such a brain dead thing was done, they said it was for security, and
that "it would be too much work to find these ports".  Then I showed
them nmap with the port identification option.  Their jaw dropped to
the floor.  They had *NO* security.  Anonymous ftp world writable,
http with no id or password allowing web page updating, telnet with no
id or password.  Needless to say, a redesign was required.