Also my personal site describing my adventures in *NIX and cloudland: https://raymii.org/s/, plus a boatload of TLS related articles.
The mozilla guide is also very good, the ability to configure based on your server settings and browser support is a heck of a nice feature. Whenever I have time to learn javascript that's the first thing to implement.
Although, all my projects are open source (https://github.com/RaymiiOrg/) so merge requests are welcome. Ferm GPL believer here.
One of the things I noticed was that there is no rationale listed for the ssl_session_tickets disablement.
I assume your concern is something like https://www.imperialviolet.org/2013/06/27/botchingpfs.html which for most general use cases you're correct in saying that it should be disabled, but, it definitely deserves a nuanced explanation.
Aha, I remember now. I was puzzled by what this comment meant at first. This isn't the first time I've come across this site!
I recall being annoyed by this, too. Fortunately, uBlock Origin[1][2] came to my rescue back then. It's a great adblocker which requires minimal configuration out-of-the-box, but also offers a bunch of Power User options for the more discerning Internet user. One such option is a point-and-click tool[3] that allows you to block arbitrary elements loading on a given site, which I promptly used to obliterate this image on first sight. :-)
I know it may not be too interesting or relevant but it would be nice to have similar configurations for common/popular enterprise tools/platforms such as F5, Cisco, Juniper etc.
I see so many badly configured systems as part of the day job that it certainly would be great to help start socializing good configs.
PS. even for something like Tomcat (which changes features on minor versions?!?), it's hard to find good configs. I have a whole bunch of notes on things like this and happy to share if someone wants to codify it.
22 comments
[ 5.4 ms ] story [ 63.2 ms ] threadI'm also behind other projects like an SSL (site) test, a fast one: https://ssldecoder.org/ and a certificate monitoring service (reminds you before expiring): https://certificatemonitor.org/.
Also my personal site describing my adventures in *NIX and cloudland: https://raymii.org/s/, plus a boatload of TLS related articles.
The mozilla guide is also very good, the ability to configure based on your server settings and browser support is a heck of a nice feature. Whenever I have time to learn javascript that's the first thing to implement.
Although, all my projects are open source (https://github.com/RaymiiOrg/) so merge requests are welcome. Ferm GPL believer here.
I'd remove that to prevent confusion as it did with me ;)
I assume your concern is something like https://www.imperialviolet.org/2013/06/27/botchingpfs.html which for most general use cases you're correct in saying that it should be disabled, but, it definitely deserves a nuanced explanation.
Nice content, nonetheless.
I recall being annoyed by this, too. Fortunately, uBlock Origin[1][2] came to my rescue back then. It's a great adblocker which requires minimal configuration out-of-the-box, but also offers a bunch of Power User options for the more discerning Internet user. One such option is a point-and-click tool[3] that allows you to block arbitrary elements loading on a given site, which I promptly used to obliterate this image on first sight. :-)
[1] Chrome - https://chrome.google.com/webstore/detail/ublock-origin/cjpa...
[2] Firefox - https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin...
[3] https://github.com/gorhill/uBlock/wiki/Element-picker
(I did open an issue about this.)
I see so many badly configured systems as part of the day job that it certainly would be great to help start socializing good configs.
PS. even for something like Tomcat (which changes features on minor versions?!?), it's hard to find good configs. I have a whole bunch of notes on things like this and happy to share if someone wants to codify it.