I'm pretty sure Shakespeare didn't say that.

So, someone submitted a 'bug' to Mozilla.

As some of you may know, in the next year, the new mass surveillance law in the Netherlands is going into effect.

Another fun fact is that the dutch security agencies/government have their own CA (Certificate Authority) for SSL/TLS certificates.

The new law says that the AIVD (dutch NSA/GCHQ equivilant) is allowed to hack into systems through obtained certificates and also that they're allowed to INTERCEPT TRAFFIC THROUGH OBTAINED PRIVATE SSL/TLS KEYS.

So someone actually had the fucking balls to submit a fucking issue to Mozilla saying that the Dutch State certs shouldn't be accepted anymore when the new mass surveillance law gets into place.

This person deservers a fucking medal if you ask me.

Me: Let's grab something for dinner!
GF: Sure, but let's go somewhere safe
Me:

"Oh, he is asking that much money for this website? I will create that for only $250 with WordPress. He is just trying to use you"

You fucking wanker. What you don't understand is that you are pushing the companies to a fucking black hole that they won't be able to recover from.

He shows an example of a website which takes 30 sec to load. It's full of hundreds of dreadful plugins. He chose the shittiest stock pictures to make it look "pretty".

When I point out his fucking shite website takes this long to load, he says if the company wants to make the website fast, they will need buy the premium plan of CloudFlare. WHAT THE FUCK are you even talking about?

Not only that, the example website, doesn't even have any SSL. He is saying that the other company didn't want to pay for the SSL. Ever heard of fucking StartSSL or LetsEncrypt?

It's people like you who is responsible for making half of the web an insecure, slow, low-performance space which is prone to hacking.

WordPress was made for blogging. KEEP IT THAT WAY. Stop trying to make your high-performance CMS or eCommerce website with this shite.

When you're about to do a payment and the payment form is loaded without an SSL connection/certificate... Come on, it's 2017...

Yes please.

So I got the job. Here's a story, never let anyone stop you from accomplishing your dreams!

It all started in 2010. Windows just crashed unrecoverably for the 3rd time in two years. Back then I wasn't good with computers yet so we got our tech guy to look at it and he said: "either pay for a windows license again (we nearly spend 1K on licenses already) or try another operating system which is free: Ubuntu. If you don't like it anyways, we can always switch back to Windows!"

Oh well, fair enough, not much to lose, right! So we went with Ubuntu. Within about 2 hours I could find everything. From the software installer to OpenOffice, browsers, email things and so on. Also I already got the basics of the Linux terminal (bash in this case) like ls, cd, mkdir and a few more.

My parents found it very easy to work with as well so we decided to stick with it.

I already started to experiment with some html/css code because the thought of being able to write my own websites was awesome! Within about a week or so I figured out a simple html site.

Then I started to experiment more and more.

After about a year of trial and error (repeat about 1000+ times) I finally got my first Apache server setup on a VirtualBox running Ubuntu server. Damn, it felt awesome to see my own shit working!

From that moment on I continued to try everything I could with Linux because I found the principle that I basically could do everything I wanted (possible with software solutions) without any limitations (like with Windows/Mac) very fucking awesome. I owned the fucking system.

Then, after some years, I got my first shared hosting plan! It was awesome to see my own (with subdomain) website online, functioning very well!

I started to learn stuff like FTP, SSH and so on.

Went on with trial and error for a while and then the thought occured to me: what if I'd have a little server ONLINE which I could use myself to experiment around?

First rented VPS was there! Couldn't get enough of it and kept experimenting with server thingies, linux in general aaand so on.

Started learning about rsa key based login, firewalls (iptables), brute force prevention (fail2ban), vhosts (apache2 still), SSL (damn this was an interesting one, how the fuck do you do this yourself?!), PHP and many other things.

Then, after a while, the thought came to mind: what if I'd have a dedicated server!?!?!?!

I ordered my first fucking dedicated server. Damn, this was awesome! Already knew some stuff about defending myself from brute force bots and so on so it went pretty well.

Finally made the jump to NginX and CentOS!

Made multiple VPS's for shitloads of purposes and just to learn. Started working with reverse proxies (nginx), proxy servers, SSL for everything (because fuck basic http WITHOUT SSL), vhosts and so on.

Started with simple, one screen linux setup with ubuntu 10.04.

Running a five monitor setup now with many distro's, running about 20 servers with proxies/nginx/apache2/multiple db engines, as much security as I can integrate and this fucking passion just got me my first Linux job!

It's not just an operating system for me, it's a way of life. And with that I don't just mean the operating system, but also the idea behind it :).

the end of an expensive era

I'm really not much of a drinker, but last night I was apparently.

I thought I played video games until I passed out on the couch and was carried to bed.

This morning, my laptop reveals to me that I had an idea for a web app last night because I made a very misspelled, yet highly detailed to do list for the app, a very blank index file, and 37 open tabs of what looks like research for certain web features.

Project seemed to be some sort of organization thing with a lot of really random and unrelated features like "fruit meterr that scales different fruits you earn" (what does that even mean??) and "sassy bill reminder".

I'm closing out all the tabs I had opened, when I see the tab showing the domain name I chose and bought. I even got the SSL certificate and email domain purchased.

Drunk me seemed to have been really excited about this idea 😶

"Using HTTPS is only useful if your page has a login. Just use HTTP."

Started talking with someone about general IT stuff. At some point we came to the subject of SSL certificates and he mentioned that 'that stuff is expensive' and so on.

Kindly told him about Let's Encrypt and also that it's free and he reacted: "Then I'd rather have no SSL, free certificates make you look like you're a cheap ass".

So I told him the principle of login/registration thingies and said that they really need SSL, whether it's free or not.

"Nahhh, then I'd still rather don't use SSL, it just looks so cheap when you're using a free certificate".

Hey you know what, what about you write that sentence on a whole fucking pack of paper, dip it into some sambal, maybe add some firecrackers and shove it up your ass? Hopefully that will bring some sense into your very empty head.

Not putting a secure connection on a website, (at all) especially when it has a FUCKING LOGIN/REGISTRATION FUNCTION (!?!?!?!!?!) is simply not fucking done in the year of TWO THOUSAND FUCKING SEVENTEEN.

'Ohh but the NSA etc won't do anything with that data'.

Has it, for one tiny motherfucking second, come to mind that there's also a thing called hackers? Malicious hackers? If your users are on hacked networks, it's easy as fuck to steal their credentials, inject shit and even deliver fucking EXPLOIT KITS.
Oh and you bet your ass the NSA will save that data, they have a whole motherfucking database of passwords they can search through with XKeyScore (snowden leaks).

Motherfucker.

I ranted about this guy before who thought he was a security expert while hardly knowing what the word is probably. Today I met him again at a party.

Holy fucking shit, this guy.

"we use the best servers of the netherlands"
"we use a separate server for each website and finetune them"
"we always put clusters under servers, that way we have a fallback mechanism"
"companies mostly use bv ssl certificates"
"you're on call for a week? I'm full-time on call. Why I'm drinking alcohol then? Because fuck the clients hahaha"

😥🔫

My first day in a Linux admin and security course. I went all confident and cocky waiting for some bullshit like "type in your term: ls, cd, pwd, see you tomorrow"
Suddenly the teacher starts to configure lampp, then jumps to bind, and thirty minutes leater , when everyone has their ssl keys under control, I was still struggling to correctly forward my mate. The rest of the day was smooth and easy for those who finished their servers, and there I was, unable to find my own ass in the middle of that mess made of bad assigned permissions and wrong placed addresses. Even worse, he came to me when I asked for help, took my chair and fixed everything in one beautiful single bash line. I started to ask "what's this? Where is that? Is it a config file or a directory?" And with all his patience he keep telling me the obvious answers that where right there at the screen but I couldn't see. Took me two weeks to catch his pace, and another two weeks to understand fully his classes. He never said a word about my terrible first day (first couple weeks). When course finished, I saw he was going to teach a really hard security module, and I signed up without hesitate.

Sometimes I just randomly start installing a new vps, configure the server, put a random sub domain on it, forward nginx with SSL, print something random on the page and then just remove the thing again.

Solely because I enjoy installing servers/configuring them.

Am I weird? 😅

The train tracks are protected😂

Dude was way ahead of his time!

"The customer reports that port 21 is closed on our FTP site. They said that port 443 is open, and wonder if they can use that instead."

"They are entering the wrong server name. Our FTP server is ONLY an FTP server. Port 443 is not open on our FTP server.

Please verify that they are entering `ftp.xxxxxx.com`

Our FTP site supports FTP/SSL if they are concerned about security."

"Customer responds that they would rather use port 443 to send files."

"I'm sure they would. I'd also like to enter our building on the west side when the temperature is below 10º, but there are no doors on the west side, so that's not going to happen, is it?"

Motherfucker. It's two thousand fucking seventeen. You can get a free ssl certificate for any website.

Then WHY are there still some fucking websites which contain login portals, sensitive information or anything that SHOULD be protected in transit WITHOUT FUCKING SSL?!

I hope that the people who manage those sites and are AWARE that they can get a free cert but don't do that die in agonising pain.

This really fucking pisses me off.

On another note, EVERY site should have SSL, it's free anyways and protects your visitors from a range of threats.-

Took yesterday off to sort out a new passport.
Today on the stand:

Manager: "So we've been trying to get app X running on a dev environment for client X but we couldn't expose it to them"

Me: "Well yeah it's a dev environment if you want to give them one give them access to staging"

Manager: "Oh well we're still going to give them access to dev because they asked for it. It's due for 10am but we couldn't get it to run. You have to get it running since we edited the config files"

*accessing dev environment*
half of config files is missing, random files committed to the repo, SSL certs manually edited, eth0 down and found swan vpn installed.

never taking a day off again.

One of our clients deploy their own server app. So this happened after a prod deployment. (4am)

*Cellphone rings while sleeping*

Client : we need you on the conference call now. URGENT!

*Gets on conference call*
*Client explain the problem*
*Explaining to the client that the problem is in their side (https connection not working, either network or certificate problem)*
*Client doesn't believe it and pushes me for a fix that I have no control on*
*4 hours later in a heated conversation*

Client : ok problem is on our side. We used our SSL certificate from staging with production and thought it would work.

Me :

Fuck stupid client.

Sorry:

Boss: client want to white label the solution.

Me: ok. They just need to create A record and send as SSL certificate and I will do it.

Client : here is your SSL certificate.

Me: spend whole night to make the transfer and setup server and check whole solutions one by one for reference to our company.

Next day wake around 2 pm to 100 whatsapp message, call from client and noss.

Turns out client IT team revoked the certificate without informing and the product stop working for all people.

Me: go to back to sleep.

*Downloading a linux iso (distrohopping YAY) because the download stopped last night*
*200kbs instead of the 5mbs last night*

*sets up a subdomain for downloading iso's*
*enables SSL*
*downloads the iso to my server*
*copies the iso to the directory of the iso subdomain*
*starts downloading the iso from the server*

5mbs YAY

I am weird 😆

At work:

"I do not get your concerns over ssl, it works fine when we use ie"

"What do you mean by xss? A regular use would not even try ans attempt something like that"

"We need to keep the txt file with the passwords there, its an internal project, the public would not even attempt to reach our site, just put them back"

Ah the many stories that I have from this place. It is an otherwise good place to work at tho, but oh well...

Me on a daily basis tho

(The PM is pretty technical)
One day:
Me: Could you create this subdomain?
PM: Sure, just a sec.
Me: Ohh and could you add a letsencrypt cert? (one click thingy)
PM: Why would you need that on this kinda site...
Me: Well in general for security...
PM: Nahh.
*walks away*

Next day:
(referring to my internship manager/guider as Bob)
Bob: Hey... we have a new subdomain!
Me: Yup!
Bob: Wait why is there no letsencrypt certificate installed...?!?
Me: Well, the PM didn't find that neccesary...
Bob: (Oo) of course it is... are we going for security by default or what?
Me: Yup agreed.
Bob: *creates cert and sets everything up in under a minute*

It wasn't a high profile site (tiny side project) but why not add SSL when you can for free?

On call part 3: I'M BACK ON THE CAL FROM YESTERDAY FOR THE LAST 6.5 HOURS AND THEY'RE JUST DOING WHAT I TOLD THEM TO DO YESTERDAY. Is it because I'm female? Does having boobs mean I don't know how ssl works and that I can't possibly know about networks? I'm seriously about to just hang up and tell them to deal with it on their own.

Cup is there because it expresses my mood.

Your resume:
Git
SSL
Vue
Angular
React
Node
Spring boot
MySQL
MongoDb
HTML
CSS
Java
Javascript
Bootstrap
Cassandra
Hive
Hadoop
Block chain
GraphQL
Kubernetics
Jenkins
Azure
GCP

Interviewer:
Sorry, we need someone who knows AWS

Had to give a 15 min presentation on web development. I somehow turned it into me giving a 1 hour lecture on ssl and end to end encryption to a bunch of accounting students 😅

By learning the basis of things instead of just using them.
for example I learn cryptographic algorithms behind ssl instead of just using it.

Following a conversation with a fellow devRanter this came to my mind ago, happened a year or two ago I think.

Was searching for an online note taking app which also provided open source end to end encryption.

After searching for a while I found something that looked alright (do not remember the URL/site too badly). They used pretty good open source JS crypto libraries so it seemed very good!

Then I noticed that the site itself did NOT ran SSL (putting the https:// in front of the site name resulted in site not found or something similar).

Went to the Q/A section because that's really weird.

Saw the answer to that question:

"Since the notes are end to end encrypted client side anyways, we don't see the point in adding SSL. It's secure enough this way".

😵

I emailed them right away explaing that any party inbetween their server(s) and the browser could do anything with the request (includingt the cryptographic JS code) so they should start going onto SSL very very fast.

Too badly I never received a reply.

People, if you ever work with client side crypto, ALWAYS use SSL. Also with valid certs!

The NSA for example has this thing known as the 'Quantum Insert' attack which they can deploy worldwide which basically is an attack where they detect requests being made to servers and reply quickly with their own version of that code which is very probably backdoored.

This attack cannot be performed if you use SSL! (of course only if they don't have your private keys but lets assume that for now)
Luckily Fox-IT (formerly Dutch cyber security company) wrote a Snort (Intrustion Detection System) module for detecting this attack.

Anyways, Always use SSL if you do anything at all with crypto/sensitive data! Actually, always use it but at the very LEAST really do it when you process the mentioned above!

if you were code, you wouldn't compile

I wouldn't catch you if you were the last exception in my code

your brain is so tiny, indexing it would make no significant performance gain

you are so embarrassing, I can only go out with you in SSL

if you were a pointer I'd move to java

Why the hell do people make websites with VALID SSL certs redirect BACK TO HTTP? What the fuck is wrong with them?!

So I did a rookie mistake this week. Connected a webapp for a client using Nginx and installed the SSL cert for the site. I decided to activate the firewall of the server because hey security. All was well. Went home feeling like I am the shit.

Next day I find out I can't log in to the server over ssh. Only to find out that I had forgotten to allow SSH through the firewall.

I had basically locked myself out of the server. 😞

I hate Wordpress. I hate Wordpress. I hate Wordpress.

Wordpress can take a big shit on itself and crawl into a deep dark hole far away from all that is good.

Who even uses Wordpress? Bloggers? Come on, let’s be honest, they’re using more intuitive sites like weebly, wix, and square space. So WHAT is Wordpress for? I’ll tell you, it’s just to FUCKING TORTURE PEOPLE.

So, being the “techy guy” of the family, a relative contacts me asking for some help with their website because they need to install an SSL certificate but they don’t know how to. I tell them I’d gladly do it because, sure, they’re family and how long can it possibly take to install a certificate? I’ve done it before!

Well, I get to work and log into the sluggish Wordpress dashboard and try to use a plugin that would issue a LetsEncrypt certificate because they are free and just as good as any other SSL. But one plugin after the next I keep getting errors about how my hosting wouldn’t allow it.

So I contact GoDaddy (don’t get me fucking started) and ask them about the issue. The guy tells me it’s “policy” to only be able to use GoDaddy’s certificates. How much do they cost? Oh, how about $100 a year?! Fuck you.

I figured out the only way to escape this hell was to ask them to open an economy Linux hosting account with cPanel on GoDaddy (the site was formerly hosted on a “Managed Wordpress” account which is just bullshit for not wanting to give you any control over your own goddamn content). So now I have to deal with migrating the site.

GoDaddy representative tells me that it should only take 20 minutes for me to do this (I’ve already spent way too much time on this but whatever) so I go forward with the new account. I decide I should migrate the site by exporting a backup and manually placing everything on the new server. Doesn’t it end up taking an entire hour to back up a 200MB site because GoDaddy throttled the processing speed?!

So, it’s another hour later and I’ve installed all the databases and carried over all the files. At this point, I’m really at the end of my rope and can’t wait to install the certificate and be done with this fuckery.

I install the certificate and finally get ready to be on my way, but then I see it. A warning. A warning from my browser telling me the site is only partially secure. It turns out the certificate was properly installed but whoever initially made the site HARDCODED ALL THE LINKS to images, websites, and style sheets to be http instead of https.

I’m gonna explode.

I swear, I’m gonna fucking explode.

After a total of 5 hours of work, I finally get the site secure by using search and replace on every fucking file.

Wordpress can go suck a big one. Actually, Wordpress can go suck the largest fuckin one in existence and choke on it.

TL;DR I agree to install an SSL certificate but end up with much more work than I bargained.

Eh ehe hehe he eh ehehe

On top of burnout, codebase issues, spec issues, burnout, the product butt that keeps on crapping, burnout, burnout, loathing for my employer... My local Apple SSL cert expired. I can’t finish this and push it anywhere for testing. I can’t even run my own specs anymore. And I don’t have permissions to make a new one. I can’t do anything at all.

Ehe he hehe

Deadline is in two days, and I’m just sitting here laughing quietly to myself. I might finally be going crazy

I found a loose bit of tangle, started to pull, and the world decided it was time to fall apart. Reality said it’s time to go. And I wasn’t even a good screwdriver dev. Byeee ~

Android and Full Stack dev here. Also first post.

No boss, i won't call that client to tell him how to configure ssl for his Outlook.

What's your favorite console ? I love my switch, it is portable, has great games and HOMEBREWS.
I've been wanting to start making stuff on it for a while but didn't want to get banned, finally it's possible so here it is my first project : a Devrant client for switch !
It took me a bit cause i was unexperienced with the platform and there are a few technical issues i had to workaround ( like no support for ssl rn and devrant api is only https :/ ) but nevertheless it's here. I'm happy now.

Securely delivering your food with certificatew

😐😓 oh shit!

Totally forgot 😳

Happy birthday Lets Encrypt 😁🤓😆
(just about a week late... 😅)

In 2018, while working in Tokyo for a Fukuoka-based startup, one of my co-workers insisted that he wanted an SSL certificate installed on his local dev machine, but he didn't know how to do that. So I created and self-signed one for him. When our CEO came to visit our Tokyo office from Fukuoka, the coworker proudly showed him how his browser would display that green lock icon when visiting localhost:3000. This apparently impressed my CEO, because a few days later the coworker was invited to work at the HQ in Fukuoka while everybody else at the Tokyo office (incl. me) was let go.

This coworker would also only copy whole open source repositories, foo/bar/g all occurrences of the project name with our company name, and tell our CEO that he wrote that code.

I don't know how to deal with this bullshit.

Security for 2017: Because SSL has nothing to do with security, and just Google's way of increasing it's monopoly...

6:38pm, Tasklist for today:

- Debug website #1 - DONE
- Debug website #2 - DONE
- Launch a new website on a new domain - DONE
- Install SSL - DONE
- Test e-commerce section - DONE
- activate HTTP/2 for that domian (first time, once it worked it felt rewarding) - DONE
- set up 30 emails on said domain, send out emails on how to reset their passwords - DONE
- play Half life for 40 minutes - DONE
- Download GOT S06E09 - DONE
- cater all emails from clients... - DONE

proudest and most productive day of my life, really

made a password sniffer in python it was really easy how many of you took #100DaysOfCode i took the challenge 8 days today every day i am doing one project what do you think of the sniffer? it currently doesn't support SSL response but working on that right now this is good

After struggling for weeks with SSL settings I finally asked @linuxxx for help.

Guess what, he made it work in about 5 minutes!

He was ahead of his time 😎

HOW FUCKING HARD CAN IT BE TO NOT STORE PASSWORDS IN CLEARTEXT AND THEN PROCEED TO SEND ME AN UNENCRYPTED EMAIL WITH THE PASSWORD IN IT??? THE SITE HAS A PREMIUM FUCKING SSL AND SAFETY CERTIFICATES YET THEY STILL DON'T COMPLY TO THIS? FUCK YOU! IF IT WASN'T FOR THAT I HAD TO ORDER A NEW SCREEN FOR MY BROKEN PHONE, YOU COULD'VE SUCKED BETTER THAN ME + VACUUM CLEANER.

Sorry abt that. But for real, mytrendphone stores passwords in plain texts and waves a fucking safety certificate in your face...

That moment when your entire application goes down ...

Because someone forgot to renew the SSL certificate. Of course.

Me: You need TLS since your users submit confidential data on your website.
Boss: Our hoster has an SSL-Domain
Me: Yeah. But you need TLS not your hoster...
Boss: *confused*

Shakespeare quotes 😶

Launched my own GitLab today with fully functional SSL/TLS <3 loving it

Me: ssl conn cannot be esrablished. Cert is not signed

Sr. Dev/architect: what url are you calling?

Me: dns_name:port

sd/a: yeah, I know that. But what is the url?

Me: *how the f... Did you get 'sr' and 'arch' titles, man???*
Me: why does it matter?

Sd/a: certificates depend on a url. Our LB selects a cert according to a request url

me: *buddy, I like you but I no longer look at you with respect like I used to before today...*

I showed a friend of mine a project I made in two days in Docker and Symfony php. It is a rather simple app, but it did involve my usual setup: Nginx with gzip/cache/security headers/ssl + redis caching db + php-fpm for symfony. I also used php7.4 for the lolz

He complained that he didn't like using Docker and would rather install dependencies with composer install and then run it with a Laravel command. He insisted that he wanted a non-docker installation manual.

I advised him to first install Nginx and generate some self-signed certificates, then copy all the config files and replace any environment-injected values (I use a self-made shell script for this) with the environment values in the docker-compose files.

Then I told him to download php-fpm with php 7.4 alpha, install and configure all the extensions needed, download and set up a local Redis database and at last re-implement a .env file since I removed those to replace them with a container environment.

He sent an angry emoji back (in a funny way)

God bless containerized applications, so easy to spin up entire applications (either custom or vendor like redis/mysql) and throw them away after having played with them. No need to clutter up your own pc with runtime environments.

I wonder if he relents :p

So we send a quote out to a client to update his website to make it compliant with the new privacy guidelines: SSL encryption, removing external libraries, removing Facebook Plug-ins, all that stuff. We didn't get a response.

On Monday, he called in a panic. "The website does not work, fix immediately!"

I check out the server, what do I see? An SSL cert installed the Friday before... Client decided to do it himself, on a Friday, without testing. He broke something, but cannot tell me exactly what he did.

And somehow he thinks all that is my fault :D

First lecture of computer networks. Let's shove all of these abbreviations with their meaning, and possibly a associated port number in one 1.5 hour lecture:

HTTP, HTTPS, FTP, FTPS, SFTP, TCP, IP, UDP, ISP, DSL, DNS, LAN, WLAN, WDM, P2P, TELNET, PGP, TLS, SSL, SSH, MIME, SMTP, POP3, IMAP, IANA, DHT, RTT, DHCP

I really feel sorry for students who didn't have previous knowledge about this stuff..

I bypassed SSL certificate verification because that goddam certificate had some flags which my JVM did not understand and threw errors. Still in prod after 10+ years 🤐

The IT head of my Client's company : You need to explain me what exactly you are doing in the backend and how the IOT devices are connected to the server. And the security protocol too.

Me : But it's already there in the design documents.

IT Head : I know, but I need more details as I need to give a presentation.

Me : (That's the point! You want me to be your teacher!) Okay. I will try.

IT Head : You have to.

Me : (Fuck you) Well, there are four separate servers - cache, db, socket and web. Each of the servers can be configured in a distributed way. You can put some load balancers and connect multiple servers of the same type to a particular load balancer. The database and cache servers need to replicated. The socket and http servers will subscribe to the cache server's updates. The IOT devices will be connected to the socket server via SSL and will publish the updates to a particular topic. The socket server will update the cache server and the http servers which are subscribed to that channel will receive the update notification. Then http server will forward the data to the web portals via web socket. The websockets will also work on SSL to provide security. The cache server also updates the database after a fixed interval.

This is how it works.

IT Head : Can you please give the presentation?

Me : (Fuck you asshole! Now die thinking about this architecture) Nope. I am really busy.

We have 1 guy managing everything. He develop our CMS, customers email client, manage our network, servers, domains (our own domain servers), billing system, SSL certificates... In short: everything (as well as bugs). The entire company relies on 1 guy, pretty much.
Brings the phrase "all for one, and one for all" to a whole new meaning.

(Instant Message)
Client: Are you there?
Me: Yes speak please.
(Why don't you just leave the message? It's not like having a phone call…)
Client: The contract is ready. I'll send it to you.
(Waited for an akaward 10 minute…)
Client: ???Can you receive it???
(Omg are you doing SSL handshake or what? Just send the file!)
Me: Yes I can pleasre send it to me thank you so much.

So after promoting Flutter to the clients (for whom cross plateform solution are perfect match) for almost a year, today I finally got the first ever Flutter App contract. I believ e time for Flutter is really coming. Wish me luck!

I spent about 5 hours rewriting an in company C# toolbox because I thought it's connection to a Web API was broken. 5 FUCKING HOURS.

Only to then see I was using port 80 for HTTPS...

I've been training a client for a few months now to not use Slack for sharing passwords and other secure materials.

I really thought I had made great progress. I even had him using a password manager. Then out of nowhere he sends the wildcard SSL key pair to me and a handful of other devs in a Slack thread.

At least we aren't storing important information like medical records. Oh wait, that's exactly what we're doing.

Let's Encrypt-- Opinions?

Serbia. $600/month for

- full stack
- angular dev
- java spring boot backend dev
- jenkins
- ci/cd pipelines
- jira
- unit integration E2E tests
- kubernetes
- docker
- graphql
- postgres
- sql queries
- aws
- microservices
- deployments
- scala
- kafka
- maven/gradle
- bsc or msc cs degree
- in depth knowledge of
-- observables
-- design patterns
-- jwt and how it works
-- ssl certificates
-- solid principles

There is more but i forgot the rest

Fucking IT and their self signed corporate proxy SSL bullshit getting in the way of anything that needs to verify SSL requests,
Fuck you for making my day a slow and miserable day and having to resort to forcing rest apis and SDKs to work over HTTP instead, all in the name of “Security”.

Holy shit getting ssl is easy these days.o.o

ssl isn't free if you have to buy a domain

Had a configure issue on a site running through CloudFlare hosted at WPEngine. Support on chat guy says "can I take a look at your setup" so I screenshot him! He says they're are new ways to point to WPEngine whilst using SSL so I say OK and he points me to a support article which seems accurate. He then says now I want you to change two records so I say ok (not thinking) which I do (stupidly)

Result site no longer reachable.

What do I do now? He says very seriously "you need to wait 24-48 hours for the DNS to propogate"

"Your joking it's a huge site with 20k visitors per day with advertisers on it"

"I'm sorry there is nothing I can do until the DNS YOU changed has propagated"

"I changed?" "Yes you changed the CloudFlare settings"

"You told me to!"

"Is there anything else I can help you with?"

My security knowledge is so bad. But I don't know where should I start.😖
My coworkers know about this, so I don't get involved on related topics.🤤
Last time I asked same question, someone gave me link, and it all about DIY welding metal tubes into a security door.🤦‍♂️
Any better suggestion?

Does anyone know a provider for webhosting with this needs?

- decently priced (~4€/month)
- domain included
- email stuff included
- no analytics/cookie stuff from the provider (that's the point of change)
- easy sftp access
- ssl included

Me: I need an SSL certificate.

Support: No problem. Just fire up your command line and generate one via OpenSSL.

Me: I'm on Windows.

Support: Ok, so what you do is code a Linux command line from scratch that will run in Powershell. Next, compile OpenSSL from your favorite of 60,000 versions available. Now, just fire it up and you're all set.

Me: Goodbye everything I've ever enjoyed doing in my free time.

I'm a "published" freelance dev!

Last night I made my first web application available to the internet. It's an internal enterprise management system for a small non-profit.

It's running on a single $6 a month digitalocean droplet, and the domain is $12 a year, so yearly cost for them is absolutely rock bottom.

It's written in asp.net 6.0 razor pages, nginx reverse proxy, certbot for HTTPS certificates, fail2ban for ssh protection (ssh login is via ssl keys), entity framework with MySQL.

The site itself has automatic IP banning based on a few parameters like login spam, uses JWT tokens, and is fully secured.

All together, it's a lot of value for about $100 a year.

Really long SSL cert name

Anyone ever seen those expert level explanations in brackets?

Any clue for this?

My company compromises SSL certificates in the name of "security". I can't even use Gmail because Google has identified my intranet as a malicious network executing a man in the middle attack. So they break security in the name of security.

About browsers and whole SSL CERT thing...

Most likely everyone here noticed, that https site with broken certificate will throw these big red warnings, in your face and there is so much wording like "ITS NOT SECUREEEE" or "ITS HACKEDDD" almost like it was written by passionate fanatic.

But when you are on plaintext http browsers reaction is like ¯\_(ツ)_/¯
Even if you have plaintext with password, it will for example in chromium put small little red thingy that almost no one notices.

I believe that broken cert with some error like invalid date is MORE secure than plaintext password, yet still there is this hypocracy with browsers...

I dont say that broken SSL cert is good, or something, Im just pointing out contrast of "broken" https vs plain http.... One looks for casual Joe like end of the world is coming and second is bearly noticable. Da fuck?

I disagree with this approach

Not dev related but still a rant:

My company decided that all the network traffic should go throu a virus scanner. But they don't know what the fuck they are doing, so now EVERY valid SSL cert gets rejected by our browsers because the virus-scanner breaks the SSL encryption.

Anyone open for a pishing attack?

Namecheap have 90% off on SSL certificates from Comodo this Black Friday.

i found this today, during ssl install. it's really funny.

websites without ssl in 2019

I miss old times rants...So i guess, here it goes mine:

Tomorrow is the day of the first demo to our client of a "forward-looking project" which is totally fucked up, because our "Technical Quality Assurance" - basically a developer from the '90-s, who gained the position by "he is a good guy from my last company where we worked together on sum old legacy project...".
He fucked up our marvellous, loose coupling, publish/subscribe microservice architecture, which was meant to replace an old, un-maintainable enormous monolitch app. Basically we have to replace some old-ass db stored functions.
Everyone was on our side, even the sysadmins were on our side, and he just walked in the conversation, and said: No, i don't like it, 'cause it's not clear how it would even work... Make it an RPC without loose coupling with the good-old common lib pattern, which made it now (it's the 4th 2 week/sprint, and it is a dependency hell). I could go on day and night about his "awesome ideas", and all the lovely e-mails and pull request comments... But back to business

So tomorrow is the demo. The client side project manager accidentally invited EVERYONE to this, even fucking CIO, legal department, all the designers... so yeah... pretty nice couple of swallowed company...

Today was a day, when my lead colleague just simply stayed home, to be more productive, our companys project manager had to work on other prjects, and can't help, and all the 3 other prject members were thinking it is important to interrupt me frequently...

I have to install our projects which is not even had a heart beat... not even on developer machines. Ok it is not a reeeeaaally big thing, but it is 6 MS from which 2 not even building because of tight coupling fucktard bitch..., But ok, i mean, i do my best, and make it work for the first time ever... I worked like 10 ours, just on the first fucking app to build, and deploy, run on the server, connect to db and rabbit mq... 10 FUCKING HOURS!!! (sorry, i mean) and it all was about 1, i mean ONE FUCKING LINE!

Let me explain: spring boot amqp with SSL was never tested before this time. I searched everything i could tought about, what could cause "Connection reset"... Yeah... not so helpful error message... I even have to "hack" into the demo server to test the keystore-truststore at localhost... and all the fucking configs, user names, urls, everything was correct... But one fucking line was missing...
EXCEPT ONE FUCKING LINE:
spring.rabbitmq.ssl.enabled=false # Whether to enable SSL support.

This little bitch took me 6 hours to figure out...so please guys, learn from my fault and check the spring boot appendix for default application properties, if everything is correct, but it is not working...

And of course, if you want SSL then ENABLE it...
spring.rabbitmq.ssl.enabled=true

BTW i really miss those old rants from angry devs, and i hope someone will smile on my fucking torture

Fucking shit, this university's website is so damn slow! Basically Every Semester, every student need to enroll to certain classes in University Website.

But the Infrastructure is not enough to handle such a big amount of students, we have approx. 7000 students enrolling at the same fucking time.

And here i am can't enroll to any class at all this semester. Fuck such a waste of time. This always been a thing since they digitalize enrolling system.

I don't want this to happen again. The student always be a victim since they cannot handle the request. Now, as a dev, i want to propose something better to optimize the server, i have some connection to pass some bureaucracy. I am going to do some brainstorming and I will need some solution.

Here some data i gather when i am mad from my univ infrastructure division :
1. The Server is a simple Local Server Forwarded to the Internet.
2. The Server use Windows Server 2007.
4. Web Server Using Microsoft IIS
3. The Website built using ASP.NET
4. The connection is not SSL encrypted (yes its fucking use the http)
5. Hardware Spec (not confirmed officialy, i got this information from my professor) :
- Core i5 4460
- 4 GB Ram
- 1 Gbit NIC

I will summon some expert here and i hope want to help me(us all) out.

Freak yeah!!! Just installed my first SSL Certificate on my Ubuntu Server!!!!! 🤘🏾🤘🏾🤘🏾🤘🏾🤘🏾 First time I had my IT friend do it. I thought about contacting him again, but then thought, what the hell, let's give 'er a shot. 2 days and a whole lot of anger and frustration later https:// is a green light!!! 😝😝😝😝😝😝😝

Yesterday evening I began working on an SSL proxying system for dynamic domain names using Let's Encrypt. I finished just a few hours ago and it's working flawlessly!

A year ago it took me hours to get SSL working on my Digital Ocean droplet I was using to host my website. I had no idea what I was doing and even though I 'knew' how to use the terminal and do most things, I wasn't confident or competent to only rely on the CLI.

About a year later (today) I get an email that my SSL is about to expire and needs renewed. Done and taken care of within 20 minutes, (with a 2 hour gap due to waiting for the cert authority to send me the zip of files)

All that time using i3 and moving to Linux is paying off. Maybe by the time I can afford to build my next desktop I can make my main OS linux

There’s no better feeling then doing a full server rebuild, modifying several projects heavily to be portable and keep working under new infrastructure and loosing access to dependent systems.

Migrating everything across, firing up Apache.... and BAM the fucker just works and ssl labs gives it an A (it was a giant F with multiple vulnerabilities yesterday on the old server)

Okay. So my dumbass boss took this project that had a steep timeline. I told him straight up, it won't work because we won't make the timeline. If we do this, I will be the one bending over backwards to deliver. I don't like to promise and fail. I got the oh don't worry let's just try. If we don't make it that's fine. Unfortunately that's not how I work. I refuse to deliberately fail. So I say okay and we begin. I suggested open source is the fastest way to deliver bit the fucked up part is, I am the only senior dev in the team. I will be expected to reverse engineer the open source app to connect our own deployment parameters. Use tech I have never used before. Connect frontend and backend. Handle dns bullshit. I have literally been working on Vibes and coffee for the past two weeks because ofcourse I ran into so many issues. Now I have an extension for Monday and I hate to fail. So I am not sleeping or resting just working on a fucking java app I didnt build and I am expected to make it work seemlessly on our production environment. I made some progress. Deployed frontend, deployed backend. Forgot to connect production dB so I decided to go with azure database for mysql driver since we have credits on azure. Now my java app is pissing itself over ssl handshake. I generate my keystore and add it and now java socket just times out. I want to pummel somebody or a punching bag that looks like my boss.

This is the last part of the series
(3 of 3) Credentials everywhere; like literally.

I worked for a company that made an authentication system. In a way it was ahead of it's time as it was an attempt at single sign on before we had industry standards but it was not something that had not been done before.

This security system targeted 3rd party websites. Here is where it went wrong. There was a "save" implementation where users where redirected to the authentication system and back.

However for fear of being to hard to implement they made a second method that simply required the third party site to put up a login form on their site and push the input on to the endpoint of the authentication system. This method was provided with sample code and the only solution that was ever pushed.

So users where trained to leave their credentials wherever they saw the products logo; awesome candidates for phishing. Most of the sites didn't have TLS/SSL. And the system stored the password as pain text right next to the email and birth date making the incompetence complete.

The reason for plain text password was so people could recover there password. Like just call the company convincingly frustrated and you can get them to send you the password.

I've got this customer who for some fucking reason won't change their DNS to point to our new servers, but wants to fucking stay on that old piece of crap, where we have to ask our sub-provider to generate a CSR to send to our customer to use to sign a certificate to send to us to send to our sub-provider. Because yeah, that's so much fucking easier than just pointing your domain to our new system, and get SSL set up automatically. For fucks sakes! And also, your certificate expires tomorrow, and since our idiot sub-provider hasn't responded to my email about CSR in a week, you basically have no option. So get that thumb out your butt and just switch the DNS!

OH MY FUCKING GOD!!!

IT FUCKING WORKS!!!

I tried so long on getting my new Netty based webserver up and running, I think I grew my beard twice... But NOW ITS WORKING!

Need to delete a few unnecessary functions that I needed with the old web server, implement SSL. And I can finally release a version of my framework ❤️❤️❤️

And I might put up one standalone version because - it's the same freaking server every time so I am fucking loving to export it ❤️❤️

Oh my gosh I hate SSL so much. A cert expired this morning, and with it, 29 digital signs are now offline. Shoot me now.

Brilliant idea to make sure user doesn't know if your platform is down or not.

HTTPS requests in most languages:

Import a couple of libraries, you may need to install a few as well. It's possible that you will need to initialize and set up the socket. Be sure to specify SSL settings. Create the connection, provide it a URL, and attempt the connection. Read the response, usually in chunks. You may need to manually create a buffer of fixed size, depending on if the language has buffer helper classes or not. You will probably need to convert the input stream response to a string to do anything with it. Close the connection and clean up any buffers used.

HTTPS requests in Python:

import urllib
urllib.YEET()

You can trust me. I know SSL.

half day gone try to find or remember the password of some SSL/key/encrypt/crt/shit/whatever.

Blaming myself for hours, how could I not save the password somewhere?

#Enter Password:
(I pressed enter, no password).
it works.

I love IT security

Dear SSLv3, when I'm around you, I feel so insecure...

"we have add a lot of cost partly due to currency exchange rate, but we also added some services and servers, we'll have a meeting and see what we can cancel or re-arrange."

So now....
- JIRA is gone
- SEO tools are gone
- budget for site security & SSL undecided
- Servers are too expensive.
$800 for twelve 2-24gb ram servers with backup, I call that bargain

Can't wait to see the websites falling apart. Now where are my popcorns?

Yeah!! Waiting!!

A client of ours renewed their SSL certificates without prior notice.
The app we developed for them uses SSL pinning.
The app does not include the new certificates.
The entire userbase is hereby locked out of the app.
Fun times ahead 🙃

me: *hosting docker registry for our team*

me: *sets up ssl and cloudflare dns and shit*

me: *tries to push to registry*

my pc: *413 rEQuEst EnTITy tOo LarGe*

me: *spends 4 hours scrutinizing the shit out of my nginx configs*

me: *finally finds cloudflare sitting there rejecting all of the requests... that cheeky bastard*

Did anyone else notice how setting up a letsencrypt.org certificate for a domain became a lot easier as this year went on? Certbot + automatic renewal was set up in four commands on my RasPi, I remember it being more difficult to set everything up 🤔

I used to do some freelance work for a nonprofit. I’d do some website stuff and gallery sitting.

My friend was the gallery director. When she left, I decided to stop freelancing there and I dropped off the keys with the new director. I told them they could contact me later if they have questions about some things I implemented on the website. The new director thinks I’m a random freelancer and starts to BADMOUTH MY FRIEND, the former director.

Over a year later, the gallery assistant emails me asking about SSL warnings and cc’s the new director. WTF.

1) Those warnings were happening long before I left and long before I even started. 2) I am not your website support. I only invited contact for things I worked on. 3) The assistant already contacted Squarespace and Go Daddy for help and they gave her instructions.

I told her I didn’t set up their website and it sounds like she has the resources to resolve this on her own and she should contact Squarespace and Go Daddy if she needs more help. After all, you pay those companies for their services support and my time isn’t free.

We all have heard about the SSL Handshake...

But what about the SSL Milkshake?

could never figure out how to configure ssl because of google clouds insanely complicated documentation.

today i found a digital ocean guide that explains its a simple installation of certbot, run it once and set it to auto renew....

fuck you google

Being a sysadmin can be the most frustrating thing ever, but it's worth it for those moments when you feel like an absolute ninja.

Switched from single threaded gevent server to an nginx configuration, added ssl, and setup a reverse proxy to flask socketio, all with less than 10 minutes aggregate downtime. On the prod server. \o/

Got my program hooked up to an external sql database that’s ready to be fed into by PHP, hosted on an SSL website, fixed up all the other bugs with TONS of other stuff.

4:23 A.M. and feelin’ good.

When I was a wee little lad of 13, still with that hopeful gleam in my eye, I signed up to work as the webmaster for a local org.

At the time, I had played around with HTML and CSS and a little JavaScript, and I thought all I'd be doing was updating some pages with announcements or whatever

I got paid in SSL, which is a thing kids in Maryland have to do to graduate, and the whole idea is that you need to do 75 hours of volunteer work in your community

The people there promised me 8 hours a month for what I thought would be easy work, and so I eagerly signed up.

What I thought would be updating a few html files and emailing them to the org was actually having to manage a full on server running PHP4 LAMP stack

Needless to say, I was overwhelmed. I tried to make the updates they wanted, but I had no idea how to write PHP, let alone manage a database and server.

I think I got out of it by just never responding to their emails once I realized how fucked I was, but that was definitely the worst learning experience of my dev career

when I hear clients says they spent a fortune on SSL cert. I Wonder for that poor soul, you know what I mean.

Things are fun until you have to implement authing.😔

Diffie–Hellman key exchange is not allowed in this area. For your convenience, an SSL stripper was placed on to every near network.

So my brother went back to school today. Now, during the 5 years I was there they had the most shit security on their IT systems, but aparently now they have fucked up their ssl. If you try to load the https page it comes up with the warning saying its an invalid certificate, but once you click it, it doesn't even load the school website, it loads this random page. Clicking on the buttons then take you to a page under their domain provided by another school. Going to this schools website, the https seems to be broken in the exact same way. It wouldnt be so bad, but it can confuse the hell out of people who type https before a url, and thos who dont realise and end up on the insecure site will need to provide passwords over an insecure connection. I am so glad im out of that place, they had such crap IT and everything was so easy to break.

Did you know, that you can just type 'thisisunsafe'? This will tell Chrome to skip certificate validation 🤯

So I just recently had the pleasure to set up a Rails environment for a friend on Windows. I haven't used Windows in about 5 or 6 years, and the person I had to set it up for doesn't know much about programming at all.

I all went fine at first, install database, devkit thingy and git. Then set up the project itself. And there is where the problems started.

First windows would refuse to use SSL, because of some weird bug in the Windows version of rubygems. The suggested upgrade did not work so I had to switch some gem sources to insecure connections, but at least it did install everything correctly.

Alright, I thought, that's not _that_ bad, everything is running now.

He sent me a screenshot some time later. Something was wrong with the JavaScript runtime, and I could not figure out for the life of me what the issue was.

Later again he sent me another screenshot.
His Antivirus spyware was messing with the asset pipeline. (╯°□°）╯︵ ┻━┻

This was the point where I just said "FUCK IT, i'll just put everything into a fucking VM and let him use that".
I should have done that in the first place.

Long story short:
Setting up a development under Windows is painful.
Do yourself a favor and just use a VM.

FUCK YOU YOU SHITTY COCK SUCKING BITCH MOTHERFUCKER.

GO DIE IN A HOLE THEN GET RAPED IN HELL. I REALLY HATE THIS SHIT.

FUCK OFF GOOGLE.

The whole autistic “no ssl validation” ServerCertificateValidationCallback to true

First off murphy is a bitch. Week started off good, nothing bad happening then friday night came and i get an email about a site being down. Ok check it out real quick, cert is expired. No real big deal just a 20 minute fix, didn't bother me that i didn't get an expiry alert. Now is where murphy decided to be the biggest fucking bucktoothed cocksucker, generate a csr for a wildcard domain using an existing key and sent it off when i get it back the private key doesn't match the cert. Again ok maybe i fucked up, generate a selfsigned cert no fucking problem. Contact support to see if they have an idea. Oh now is when it gets fun, the fucking dumbass preceded to tell me how i didn't know what i was doing and how i just had to generate a csr and private key at the same time after i explained to the bastard that I've already tested it with a selfsigned cert. (How does this fucker have a job) By now apparently i was pissed off enough to scare murphy's pansy ass away cause i told the fucker to refund my money, got a list of 30 subdomains and setup letsencrypt on it. Now the part on this that is fucking hilarious is that it took me damn near 24 hours to be called a fucking idiot from a guy that doesn't know his ass between a hole in the fucking ground and 30 minutes of being pissed off more than i have been since i took anger management classes in the 9th grade to say fuck it and switch.

What's up with almost every other site having invalid ssl certs, even though they are signed with a future date and by LetsEncrypt, did chrome again distrust a batch?

Holy fuckin shit. Fuck java updates.

Today we deployed to production with a java app. For whatever reason it didn't work, just throwing SSL errors left and right.
Same app works on dev and qa

There's only one tiiiiny difference: Java 8 141 on dev/qa, Java 8 171 on prod

Guess what happened in 171 ... they updated the CA

rip 4h debuggin

No, Steam support, I don't wanna see your copy-paste shit, I just want you to fix your broken SSL on one of your server...

I hate writing to support so much (doesn't have to be Steam). I just want to see a human approach for once, but all I get is copypasta bullshit.

Am I bad? I charged a client for an SSL Certificate and installation, but just used LetsEncrypt instead, cost me fuck all.

Hi.
Forgot to renew my expiring ssl cert of my smtp/imaps/pop3s on 12/31. Set that date to self-harm me for bad monitoring.

F**K F**K F**K F**K...

Why do I do that?
F******K!

Meh.

You shall have a happy new year... i will regen certs :D

telco sysadmin: hey maybe we should secure our SMTP server with SSL and password verification so our clients can e-mail safely!
senior exec be like: nah just filter incoming connections for our own IP-range, that'll do.

result: I can impersonate any client of the telco and send e-mail in their name (from any home network connected to that provider), but I can't send e-mail over cellular network.

How the hell are you going to have a WebDev degree and not know what SSL is in 2022.

I also shouldn't be the one to notice your CPanel has a ton of unnecessary extra files and folders, and when you go to a subdomain corresponding to some random folders we find a "hacked by some dude" message. : |

I get your mom paid for the domain and hosting for you but you should really fucking know that information yourself.

And I don't care if your mom says 'everything is fine' on her side. You were hacked you need that information so you can tell when things are added that shouldn't be and in this case notify the host site in case the issue is on them while also knowing how to reset everything properly site specifically

Fuck. I should start charging my friends for being stupid and taking my time with things they should know how to do.

My degree is an associates of 'General Programming'. They have a degree in specifically 'Web Development'

90% of my web development knowledge is self taught. If her program didn't cover fucking ssl she needs her money back

Boss: We need you to configure our Apache Tomcat server for SSL.

Me: Okay, what version of Tomcat is installed?

Boss: 5.5.20

Me:

Decrypt api responses in an iOS app which my “senior” dev thinks it is more secure to encrypt responses in stead of setting up a proper SSL cert (they use plain http to save money 🙄)

They disable the encryption since it does not function as we wanted and set up SSL instead🙄

So a week ago my boss asked me to design + build/write code for our new site from scratch.
Meanwhile the old website they have had for 5 years is still without SSL and looks pre-2000.
It's supposed to be finished and be mobile responsive by tomorrow.
                                                                                                                                                                            
                                                                   
  
       
I'm the digital marketer.

Vodafone India is so shit omfg

Run npm install, ERROR json parse error due to ssl exception

Run pip install, again ssl exception

Run gradle build, again ssl exception!!!

Now everytime i gotta make a new project or install a dependency in anything, i have to pray to the blood god that cache contains a valid/uncorrupted package dependency or else ill have to nuke cache and borrow internet from someone else.
Once i port it to some other operator, i am gonna incinerate this mf sim.

Debugging TLS failures.

In Java.

With the funny certstore cause "we need to do this by ourselves".

Fucking shitty broken pile of cunt code.

At least the debugging output is good.

As much as I love TLS, debugging it is a nightmare and when a programming language like Java decides to wrap it, it becomes Ctulhu.

OS
- TLS Library
-- TLS Certificate Chain
- JDK
-- JDK SSL Handler
--- JDK Certstore
---- Java Library Abstraction, eg. WS SSL

Joyfully fingering of a tentacle arsehole.

Cheapskate's website deployment stack for new projects:

namecheap ($10 domain) + heroku (free hosting) + mailgun (free email) + Cloudflare (free SSL) = $10/year

I don't understand why they're still calling it SSL. It was buried long ago by TLS.

Fuck this marketing bullshit, just fucking call it TLS already.

Today I had sort of a meltdown when I found out that the small, 20-something company where I work and where we should all 'trust each other' is working to stealthily enable SSL Inspection.

I'm done with doing anything other than what is stipulated in my contract such as helping out in other areas out of my own volition.

Management got control hungry and mad once they got their hands on a Deep Inspection Firewall.

Well, I'm not feeling sorry for the uproar they'll have to endure once colleagues find out they are doing this stealthily.

Serves them right and after this and other similar experiences my trust in this company is right through the floor.

Super duper Marketing guy gets hired to boosts Eshop sales. Sends a huge wall of text about moving the site to the X VPS hosting plan, put SSL to the site etc..
Me: We are already on that hosting plan. We have SSL and everything else you mention. Are you sure you checked the right Eshop before you made that Grand Plan of boosting sales? 🤣🤣🤣

Spending hours trying to figure out why the stack just won't work with SSL. Nearly lost my mind as we started feeling dumber than ever. I really started to doubt my skills after it did not even work with the most minimal nginx site config I could imagine.
The next day I discovered that we missed the 443 port mapping in the docker-compose file...it only had port 80 mapped.

Yup, stepping back from a problem and getting some sleep is really worth it sometimes.

i fucking hate trying to debug ssl certs

Anyone else ever had to install Jekyll on Windows?

Man, what a displeasure the last four hours were. SSL errors everywhere because Ruby versions have differing SSL certificates for downloading gems or something, having to install the devkit three times, messing with Linux Subsystem and finding out the Ubuntu repos do not have a new enough Ruby version to support what you're doing.

All this to have some fun with GH pages. It's physically exhausting.

Now hol up, that aint what it means you morons!

SSL should really stand for "Satan's Security Layer", because anytime I have to deal with it, it's always a major pain in the rear. (And an expensive pain at that!) Why in 2016 is the SSL process so bad.

Server migration status:

One of our Windows servers took less than 20 mins. SSL and bla bla everything done.

Linux server was a lil bitch but we got it going for the most part .....sigh...

Still using Linux as my primary desktop at home but geezus man. We really need a dedicated master wizard Linux sys admin for this mofocka

* Developing a new "My pages" NBV offer/order solution for customer
_Thursday
Customer: Are we ready for testing?
Me: Almost, we need to receive the SSL cert and then do a full test run to see if your sales services get the orders correctly. At this point, all orders made via this flow are tagged so they will not be sent to the Sales services. We also still need to implement the tracking to see who has been exposed to what in My Pages.
Customer: Ok, great!

_Friday
Customer: My web team needs these customers to have fake offers on them, to validate the layout and content
Me: Ok, my colleague can fix this by Tuesday - he has all the other things with higher prio from you to complete first
Customer: Ok! Good!

_Sunday
Me: Good news, got the SSL cert installed and have verified the flow from my side. Now you need to verify the full flow from your side.
Customer: Ok! Great! Will do.

_Monday
*quiet*

_Tuesday
Customer: Can you see how things are going? Any good news?
Me: ???
*looks into the system*
WTF!?!
- Have you set this into production on your side? We are not finished with the implementation on our side!
Customer: Oh, sorry - well, it looked fine when we tested with the test links you sent (3 weeks ago)
Me: But did you make a complete test run, and make sure that Sales services got the order?
Customer: Oh, no they didn't receive anything - but we thought that was just because of it being a test link
Me: Seriously - you didn't read what i wrote last Thursday?
Customer: ...
Me: Ok, so what happens if something goes wrong - who get's blamed?
Customer: ...
Me: FML!!!

Your dairy produce is safe with us!

I'm fiddeling around with progressive web apps. I made something and hosted it on a subdomain. Today I made a typo and found my app on an other domain. All my assets and files are copied there. He even uses my SSL certificate.

It's not that spectacular. The app is nothing "revolutionary". It's just the first time it happend to me.

Have you ever found your code on other websites ? How did you react ?

letsencrypt I love you!

spent the entire day trying to get ssl to work 😩
it works now, but honestly, it's draining to spend so much time on config

Since, I am already using Mullvad's vpn service, I also stumbled on https proxies.
Is it still safe to enter my devRant login data, when I would use a https proxy in FF's settings?
The Proxy is a free elite https proxy.
And devRant also uses SSL.
The traceroute would seem like this I guess.:
VPN(*le me sendin my password -> SSL Proxy -> SSL DevRant)
--------------------
Following that path, I would assume that it would be like this in detail:
HTTPS Request
-PW gets encrypted by VPN service
-" " " again " HTTPS Proxy
-" " " again " devRant itself

Set up an Ubuntu AWS ec2 instance running nodejs reverse proxied by nginx, kept running by pm2 and SSL provisioned by certbot.

I know that sounds like nothing but buzzwords but it really felt awesome to get a little node app stack sorted out!

Docker with nginx-proxy and nginx-proxy-le (Lets Encrypt) is fucking awesome!

I only have to specify environment variables with email and host name when starting new containers with web servers, and the proxy containers will automatically make a proxy to the new container, and generate lets encrypt ssl certificates. I don’t have to lift a fucking finger, it is so ducking genius

With a recent HAProxy update on our reverse proxy VM I decided to enable http/2, disable TLS 1.0 and drop support for non forward-secrecy ciphers.

Tested our sites in Chrome and Firefox, all was well, went to bed.

Next morning a medium-critical havock went loose. Our ERP system couldn't create tickets in our ticket system anymore, the ticket systems Outlook AddIn refused to connect, the mobile app we use to access our anti-spam appliance wouldn't connect although our internal blackboard app still connected over the same load balancer without any issues.

So i declared a 10min maintenance window and disabled HTTP/2, thinking that this was the culprit.

Nope. No dice.
Okay, i thought, enable TLS 1.0 again.

Suddenly the ticket system related stuff starts to work again.

So since both the ERP system and the AddIn run on .NET i dug through the .NET documentation and found out that for some fucking reason even in the newest .NET framework version (4.7.2) you have to explicitly enable TLS 1.1 and 1.2 or else you just get a 'socket reset' error. Why the fuck?!

Okay, now that i had the ticket system out of the way i enabled HTTP/2 and verified that everything still works.

It did, nice.

The anti-spam appliance app still did not work however, so i enabled one non-pfs cipher in the OpenSSL config and tested the app.

Behold, it worked.

I'm currently creating a ticket with them asking politely why the fuck their app has pfs-ciphers disabled.

And I thought disabling DEPRECEATED tech wouldn't be an issue... Wrong...

Me and the dba are slowly migrating parts of our JVM stack into .NET AND even tho I love and will always love Java and its ecosystem....I am glad.

IIS as a server is something that I actually look forward to since deploying shit to it is always a breeze

Installing ssl certs is a breeze

Everything is a fucking breeze

Before any of you cocksuckers say anything: this is my opinion only

Someone forgot to renew their certificate

SSL denied to shake his hand

when you cant be arsed to do icons so you just use emojis for button icons.

btn.textContent = "🗑️"

because icon sets now have their own apis (like what ever happened to icon fonts?), and documents explaining what scripts and commands to run to *install fucking plugins* on software written to *supplement* doc servers. plugins and software whos host site returns an SSL error. nice.

to use web icons. downloaded only on request. from other sites.

seems kind of eh, tower-of-baylon to me. like a bird landing on the electrical lines near your house might cause a blip and break one or two icons on your slick 2020 web app.

idk just seems unnecessary, like if you're small, your gonna want to embed your fonts on the webpage instead of overcooking things and hosting *a fucking server* just to serve an api for fucking *icons*. and if you're large you're gonna reduce those requests anyway

Trying to understand SSL/TLS

How would you explain SSL, certificates, and CAs to a layman?

I just spent 30mins trying to explain it to them in a chat (related to Mpngo driver configs and the sslValidatrle flag), they sorta went silent on me so not sure if I explained it or understood the roles/purposes correctly...

One example I used was it prevents a man in the middle attack where your connection gets rerouted to another server. If the CA didn't recognize the cert the new server replies with then it rejects it and prevents the attack.

Anyone else use Let's Encrypt? That is the easiest took for SSL yet.

What disturbs me is when companies uses invalid ssl certs for internal services where you have to login with your company credentials.

I want to cry... Fuck it.. shiit. .. :( :( ;(

Wasted half of the Weekend to Setup MySQL on my vServer which uses ssl encryption, have specific User and so on.
Thought: well, the User mysql is not so good as a Name. Drop it, you don't need it.
What did I? Instead of Drop User mysql , I typed Drop Database mysql.

Fuck that fucking Shit. I'm so sad right now. Broked the complete MySQL Database. Nothing is working anymore. And the server is new, I've Just made One Backup. Deleted this a few hours ago.. also accidently.

Help me :( Shit :( so sad :( Now, I don't have Motivation anymore to work with the vServer :(

Why in fuck's sake would you create a new service and not offer TLS/SSL to your free tier clients ?

On every website I visit, first thing is to snoop who gave the SSL certificate to the domain
Idk why I do this

Fucking docker swarm. Why the hell do they have to change the way it works so damn often. Find a good workthough and its not fucking valid anymore cause swarm doesnt use consul to catalog swarm nodes anymore. Well fuck thanks docker now i have to rethink my architecture cause you fuckers wanted to do something half assed.

Sad fucking thing is the change that made you do that shit in the first place doesn't work right for ssl so your damn mesh network is fucking useless for any real world uses unless people like me rig the fucking hell out off it.

Another fucking thing how the hell haven't these fucktards added a shared storage yet, come the fuck on.

When your Comapny uses way to many certificateS, .p12 and .msc files so Everyone's local breaks after each package release.... It's like building a house of cards on a windy day

me: block all in&put connection
firewall: ok
me: open port 22 for local network
firewall: ok
me: enable firewall
firewall: ok
me: restart pi
firewall: allow me connect
me: open port 80 for local network
firewall: ok
me: open port 443
firewall: Oh! i have to block icoming connections on port 22

Maaaan, we all knew it was coming, we were warned, again and again, yet still, when Lets Encrypt's old root CA expired today, we found out a tool we were using to get new certs (Not cerbot, custom wrapper around acme-tiny) included the old root in the chain.

So... A few hours ago, some of our servers started having connection issues.

Great final 3 hours of today. Better luck next time I guess? Still, despite the little hickup, Lets Encrypt still remains as one of the biggest revolutions in the adoption of SSL, they're the good guys.

School decided to shut down their WiFi for "security" reasons (Everyone used a VPN and they were dumb fucks at networking, blocking sites like Google for having an invalid SSL certificate).

Now I'm forced to use my mobile data to keep using my Arch Linux laptop D:

Omg, freaking web sockets.. But I figured out how to run a socket server in SSL with the certificates in a root folder. Seems like an early night for me!

I made a web project that can generate gifs from webcam. Can't complete it because I don't understand how to use SSL with Azure ☹️

My job in company to developed e-commerce website as a full stack developer.

History of that project.

Company paid 300,000 INR to the local web development firm for developing previous website and they developed website without bootstrap/SSL/Even save information of high profile client in plain text.

I am not angry on that web firm ,I am laughing on my company because such client never trust on independent developers who work hard ,code day and night to complete freelancing projects.

I hope my work will make differnce in their selling.

Debugs SSL setup on server for hours... Realises incoming on 443 was not enabled!! FML

For you freelancers out there, I've been working on trying to make some income with it locally, making single page static sites for some local businesses and restaurants so that I can get a couple hundred for making the site and a little over the cost of hosting each month residually, offering like one free menu change per month, but all redesigns and support being hourly.
I want it to be accessible pricing cause like 5 of my favorite places to eat have defunct sites that I think weren't worth the cost anymore, and I'd love to be able to see up to date menus and hours and I'm certain others would too.
Basically, I'm trying to figure out what hosting would be best for this and if I'm being realistic enough with pricing. I like the idea of surge.sh, but I feel like 12/mo for a custom domain SSL, which is good for SSL, is higher than some of the other alternatives for a lightweight one sing page site.
Any help would be great, Have a great new year guys!

Email from vendor: "Will you require SSL?"

WTF. So many problems with this question. Am I alone in my frustration? What problems do YOU see with that question?

It was the worst local Hackathon. It's not even a Hackathon either, where the whole event spanned over 2 months.

It was a group entry with me and 4 teammates. Each of them did contribute:

Guy A: criticizes what is built and designed
Guy B: offered financial tips on how to make this thing feasible
Guy C: did UI but in graphics. No CSS file, just bits of graphical elements.
Guy D: family commitments

And then there's me, writing documentation, built the entire project, wiki, drove the project, prepared the presentation slides, tests the framework, unit tests, stuck with stupid problems like SSL, localhost, Google Maps Key and the likes.

And we didn't even win, let alone launch this thing, whatever it is, to anywhere. Never doing group projects again.

I'm flying solo for now