all 16 comments

[–][deleted] 6 insightful - 1 fun6 insightful - 0 fun7 insightful - 1 fun -  (0 children)

Thanks for the update. It's good to know where things are.

[–]Vaxthrul 6 insightful - 1 fun6 insightful - 0 fun7 insightful - 1 fun -  (1 child)

Thanks for everything. Glad you're putting so much effort into this, we really need a good platform for discussion.

[–]magnora7[S] 4 insightful - 1 fun4 insightful - 0 fun5 insightful - 1 fun -  (0 children)

Well, thank you for posting all the content you've been posting! People like you are what will make this site work.

[–]i_cansmellthat 3 insightful - 1 fun3 insightful - 0 fun4 insightful - 1 fun -  (1 child)

The patreon donation seems to be set at $1, wasn't able to change it to one time donation or to change monthly amount. I maybe missing a simple solution, a bit sleep deprived at the moment.

Edit: Nevermind, drank some coffee and figured it out!

[–]magnora7[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (0 children)

Glad you figured it out! Thank you so much for your support! You are awesome, i_cansmellthat :)

[–]Priest 3 insightful - 1 fun3 insightful - 0 fun4 insightful - 1 fun -  (0 children)

It'll come together, it's a great idea so keep up the good work.

[–]Jesus 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (7 children)

Are you ok with the Comodo CA certificate, comodo CA is known for spying and doing other shady stuff. Just wondering?

[–]magnora7[S] 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (6 children)

Are you talking about our SSL cert? who would you get the cert from? We just went with something free. I don't know that the cert really matters all that much, but we can always change it if you can show me why it's worth changing. We just needed to enable https because that's how the code is designed, that's all. I've never heard of comodo before, do you have a link that explains the shadiness?

[–]Jesus 4 insightful - 1 fun4 insightful - 0 fun5 insightful - 1 fun -  (3 children)

They've been plagued with fraudulent cert issuing problems since at least 2011, here's a article about it;

Comodo was bought recently by Francisco Partners who also counts among its investments companies like SonicWall, which produces SSL proxy boxes, and NSO Group, which produces government spyware, among other cyber-surveillance upstarts. Last time we heard, Francisco Partners was trying to flog Pegasus-developer NSO for about a billion bucks.

(At one point, Francisco Partners owned Blue Coat, another SSL proxy box shifter, but sold that to Symantec.)

The concern is that HTTPS certificate-issuing authorities, such as Comodo, are trusted by browsers: that's essential because website owners buy SSL/TLS certs from outfits like Comodo, and the browsers need to trust Comodo in order to verify whether or not a certificate used by a HTTPS website is legit.

If there is some kind of future collusion between Comodo and one of Francisco's spyware makers, such as the creation of trusted root certificates for SSL/TLS interception gear, then people with these surveillance devices on their network could have their encrypted web traffic silently snooped on. This kind of equipment is usually sold to enterprises to monitor staff or websites, but it could potentially be used by governments and other organizations to spy on netizens.

As Liverpool, England-based security consultant Kevin Beaumont Tweeted:

>>As a security community we have built solutions that rely on every CA being trustworthy. That needs to change. The model is broken.
>>— Kevin Beaumont 🐿 (@GossiTheDog) October 31, 2017

Comodo has issued 91 million certificates to more than 200,000 customers worldwide and claims top spot in the CA market. However, its record operating its CA alongside other businesses wasn't spotless: in 2016, it was accused by Google of crafting a Chrome knockoff that undermined user security, repeating behaviour the US Department of Homeland Security criticised in 2015.

A certification issuance blunder in November 2015 resulted in the company withdrawing incorrectly-issued certificates, and it lost a trademark stoush with popular free CA LetsEncrypt last year.

Francisco Partners has appointed former Entrust COO Bill Holtz as CEO of Comodo CA, and SonicWall CEO and president Bill Conner as chairman. Comodo founder Melih Abdulhayoglu remains as minority owner and board observer.


[–]magnora7[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (2 children)

Hmm that's very interesting. Thanks for bringing this to my attention. I'll have a talk with our sever guy in a few days and see what he thinks of the situation.

[–][deleted] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (1 child)

It looks like CloudFlare's SSL certificate issued by Comodo... it is issued to "sni87098.cloudflaressl.com". Our SSL certificate on the server that is also being used should say "LetsEncrypt" or something but I'm not sure how to check that with CloudFlare on.

But Jesus makes some good points. Maybe there's a CloudFlare alternative we could find.

[–]magnora7[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (0 children)

Yeah it's definitely something to consider. I'll talk this over with our server guy and see what he says, because he's great with netsec stuff.

[–]necaremus 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (1 child)

the only problem with self-signed certificates is, that you have to accept them manually.

for anyone not knowing what the fuck a certificate is this looks "shady". ..but there really is no technical/security issue with self-signed certificates.

a lot of "big" ca issuers have been regarded as "not trustworthy" or at least "shady" in security minded communities. (i don't really know much about this topic, to confidently state something... i just know things are somewhat shady...)

... don't know if a self-signed certificate would be an option for this domain, i wouldn't mind :)

[–]magnora7[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (0 children)

Interesting, thanks for the extra thoughts

[–]Mike 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (1 child)

Are you looking to integrate the RES equivalent into the site itself?

[–]magnora7[S] 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (0 children)

Eventually, yes.