Woah? A blog post? There hasn’t been one of these in nearly two years! What does it mean? It means I’m back to writing. I’ve simply got too much on my mind to be quiet. Expect some content to come out in the next few weeks (and months). Reverse Engineering Over the past two years I’ve done of a lot of stuff. But I’ll post whatever I legally can on the internet.
So weev had some fun with printers recently. With 6 lines of shell, weev not only trolled hundreds of people from across the Atlantic Ocean, but also showed how screwed IT security is. If any of the affected organizations used even the most basic security measures, all of this could have been prevented. It’s sad that in $CURRENT_YEAR companies still can’t be bothered to implement the simplest of security measures. But this post isn’t about anything Andrew Auernheimer has done, it’s about something worse – the Internet of Things (hereafter referred to as IoT).
As of the time of this post, I am hosting this blog using Ghost. My only issues are that Ghost takes up a lot of memory (52 MB) on my VPS and page loads are slightly sluggish. In the search of a better platform, I realized that there’s still room for improvement in the blogging atmosphere. First, some background knowledge: A Tale of Two Systems As it stands, there are two existing ways that web blogs work.
I recently moved this blog from Lighttpd to nginx. Lighttpd was good for a while, but now that I have plenty of experience rewriting server configuration rules, I feel that I’m ready for nginx. To be upfront, nginx configuration isn’t that hard at all. The only issues I seemed to have was that I was unfamiliar with the terminology or what I wanted to make happen with nginx. For example, when I first started being a sysadmin, I had no clue what a scheme, URI, or the status codes were.
Looks like I got in to the Let’s Encrypt Beta Program. As of now, camconn.cc, files.camconn.cc, and www.camconn.cc now use a certificate from Let’s Encrypt. I had to do some work to make sure everything works with Lighttpd, but so far so good. This included concatenating the cert.pem and privkey.pem together to create a single lighttpd.pem file that lighttpd could handle. I’ll start using the cert with Postfix soon too. I’m now going to start redirecting HTTP requests to HTTPS, as well as fixing links within this website.
Right now, I’m writing an IRC server, and it’s turning out to be incredibly frustrating so far. For example, one thing I’ve had trouble with is MODE commands. The documentation in RFC 1459 is barely enough to understand what’s happening, and answers on SO just leave me more confused. I can’t believe that one of the most popular protocols on the planet has so little documentation. Luckily, Hexchat has a nice Raw Log feature.
I recently watched a talk by Jacob Appelbaum about how Tor does TLS certificates, and how a bunch of users using certificates that expire in 2 hours is suspicious. So I wondered, what does the average TLS certificate look like? And since I’m a programer, I decided to go and gather some data. Thus, I wrote a tool to gather the information I wanted. “Make the data you want to see in the world.” That’s how it goes, right?