News for hackers. Stuff that matters.

A comment on White hat hacker awarded $2M for fixing ETH-creation bug. Parent comment

Re:White hat hacker awarded $2M for fixing ETH-creation bug by mhitza on Sunday February 13, 2022 @11:01AM (#30322615)
Seems to be because of Fedora hardened policy and your site might be supporting SHA1 for use in signatures. One of the three changes with the default tweaks policy that probably makes sense https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2...

When I set the crypto policy in Fedora to Legacy, which lifts those restrictions, I can visit your website.

Chrome doesn't have this problem in Fedora because it ships with its own SSL/TLS specific things bundled (or something along the lines, didn't care to get deeper in the topic).

[ Parent | on HN ]
Re:White hat hacker awarded $2M for fixing ETH-creation bug by saurik on Sunday February 13, 2022 @11:17AM (#30322757)
Interesting! I had went out of my way to add support for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384--because I consider older versions of Safari critical for my audience--but the way I did that dragged in TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA; I've gone ahead and filtered out SHA1 (so maybe / hopefully this will help).
[ Parent | on HN ]