News for hackers. Stuff that matters.

A comment on Github SSL replaced by self-signed certificate in China. Parent comment

Re:Github SSL replaced by self-signed certificate in China by bobcattr on Sunday January 27, 2013 @04:00PM (#5125645)
didn't know of HSTS, thanks.

where would one keep up with stuff like that other than keeping up with new rfc's?

[ Parent | on HN ]
Re:Github SSL replaced by self-signed certificate in China by ivanr on Sunday January 27, 2013 @06:30PM (#5126177)
I maintain a complete guide to SSL/TLS deployment:

SSL/TLS Deployment Best Practices https://www.ssllabs.com/projects/best-practices/

[ Parent | on HN ]
Re:Github SSL replaced by self-signed certificate in China by hnolable on Sunday January 27, 2013 @08:07PM (#5126507)
You may want to integrate some of the advice from here in your HSTS section:

http://coderrr.wordpress.com/2010/12/27/canonical-redirect-p...

It seems even github is susceptible to this. That is, for people who type www.github.com into their browser rather than github.com. They both did the redirect wrong, as well as left off HSTS of https://www.github.com.

[ Parent | on HN ]
Re:Github SSL replaced by self-signed certificate in China by moonboots on Sunday January 27, 2013 @04:11PM (#5125680)
agl's blog is a good source: http://www.imperialviolet.org/
[ Parent | on HN ]
Re:Github SSL replaced by self-signed certificate in China by alistair77 on Sunday January 27, 2013 @04:32PM (#5125768)
OWASP has lots of useful security info, https://www.owasp.org
[ Parent | on HN ]