@tom_webb We've already blocked whole #amazon, #microsoft and #meta subnets. Amazon particularly is tricky because we still want #letsencrypt to work. Now we're doing manual checks in access logs every time our servers are down and adding malicious actors to iptable blocks. We'll need a weekend hackaton at our selfhosting collective to put preventions in place and maybe come up with some new ideas as well. poisoning those bots seems like an appropriate response.
* The key (example.com.key) * The domain cert (example.com.crt) * The CA cert (chain.crt) * The "full chain" cert (fullchain.crt)
Make sure to use the full chain cert, *not* the domain cert, when setting up your server. Otherwise some services will give you "unknown authority" errors.
Built a bit of intranet tooling in recent weeks. I had #certbot renew our wildcard #LetsEncrypt certificate, but installing it on multiple internal services was a manual process. So I made an #Ansible playbook, but still had to run it manually. When? A cron job was checking the TLS certificate of our intranet every week. If its validity was less than 3 weeks I got an alert via healthchecks.io. Only today I realised that certbot can run the playbook directly as a deploy hook...
Apparently the *.eu.org domain needed laundrying because it's reputation became too bad. So scammers create zillions of insane domain names and obtain *FREE* (for them) certificates for those sites. Usually such sites are not malicious; they're intended to have virusscanners remove detection, eventually for the sub-TLD ".eu.org".
To see this, you may consider opening https://crt.sh?q=eu.org but that will fail because there are WAY too many results.
To restrict the amount of records, try a subdomain name and further restrict output by deduplicating and restricting to not expired, as follows:
»Unsicherheit – US-Kürzungsrausch gefährdet für das Internet wichtige Open-Source-Projekte: Die neue US-Regierung entzieht dem Open Technology Fund (OTF) die Mittel. Von diesem sind unter anderem @letsencrypt, @torproject und @fdroidorg finanziell abhängig. Der OTF hat Klage eingereicht«
Sehr heikel und es petrifft, wenn auch "nur" indirekt, alle Menschen auf der Erde. Der Egoismus eines Irren kann uns alle betreffen!
Instead of relying on the US, the @EUCommission could have spent the equivalent of one or two state dinners on creating an EU based alternative to #LetsEncrypt. They still can :) cc @EC_DIGIT
I don't know how many times I screwed that up in so many mysterious ways - mainly 'cause I was trying *somehow* to not have to run my script as root. It feels strange to run anything as root - you just don't do that, right?
But fine... #LetsEncrypt is pretty easy and awesome. It solves my #Firefox's fear of my little VM. I like to see machines getting along.
#LetsEncrypt certificate expiration notices will stop, so I set up #RunZero to monitor for expiring TLS certtificates. I ran into an issue with Chromecast's super short-lived certificates and got around that by using custom queries. Want to follow along? Check out my recent-ish blog post#Security#Cybersecurity"
Het is meestal onmogelijk om nepberichten (e-mail, SMS, ChatApp, social media en papieren post - zie plaatje) betrouwbaar van echte te kunnen onderscheiden.
Tegen phishing en vooral nepwebsites is echter prima iets te doen, zoals ik vandaag nogmaals beschreef in https://security.nl/posting/881655.
(Big Tech en luie websitebeheerders willen dat niet, dus is en blijft het een enorm gevecht).
Je ne connaissais pas l'Open Technology Forum et l'USAGM, organismes qui participent au financement de Letsencrypt, mais aussi @torproject, @fdroidorg, OpenVPN, Tails, Lantern ou @quad9dns (9.9.9.9).
Un décret trumpien vient remettre tout ça en question...
@Datenproletarier das stimmt so nicht. Es gibt auch noch Unternehmen wie ZeroSSL oder Buypass die auch ACME kompatibel sind. Aber ja auch diese gehören evtl. zu US Unternehmen auch wenn ZeroSSL in Wien ansässig ist aber zu Assa Abloy bzw. deren US Tochter HID Global gehört. Buypass kommt aus Norwegen, gehört aber irgendwie einem kanadischen Unternehmen.
Aber ja eine echt unabhängige ggf. vom Sovereign Tech Fund finanzierte europäische Alternative wäre sinnvoll. Eigentlist ist alles vorhanden, man müsste es nur zusammensetzen und finanzieren. @sovtechfund
