Geoff Huston from APNIC talked at the RIPE 84 about certificate revocation as a “sanction”. He concludes that the certificate infrastructure is not working, and instead suggests DNS is the answer. You can put keys in the DNS and use TTL to control the caching lag of the information.
There will be the 6th OpenPGP Email Summit on Friday, May 27 & Saturday, May 28, 2022 in Geneva (Switzerland) at the offoffices of Proton AG (the company behind ProtonMail and OpenPGP.js) (those interested, please ask the secretary to forward you the invitation) https://wiki.gnupg.org/OpenPGPEmailSummit202205
This is an event open for anybody involved in the development of email clients using OpenPGP for encryption, and related software. The agenda will be driven by the attendees. Anyone may propose any topic for discussion, as long as he is ready to lead the discussion.
As you know, you can having a CAcert signature on your PGP keyring. Having a CAcert signature on your PGP keyring signifies that your identity has been verified (assured) by at least two other people (that’s the only way to get more than 50 Assurance Points). So it gives credibility to your PGP keys’ authenticity.
If you want to strengthen the relationship between CAcert and OpenPGP, please feel free to representet CAcert at the 6th OpenPGP Email Summit.
Sie wurden bekannt, indem sie sorglosen Umgang mit Sicherheit ausnutzten: Mit geleakten E-Mails und gehackten russischen Servern sorgte die Internetaktivisten-Gruppe Anonymous auch jüngst wieder für Schlagzeilen. Doch wer steckt hinter dem Kollektiv? Hier teilen die Investigativ-Journalisten der NZZ ihre Erkenntnisse über Ursprünge, Funktionsweisen und Tätigkeiten von Anonymous mit uns.
Update #1:
Moving www.cacert.org to new hardware was not successful due to some firewall settings, so we decided to keep the old server active.
During the next days/weeks we’ll change some firewall settings remotely so short downtimes may apply before we try to activate the new server during the next visit in some weeks.
Original note:
During the next visit at the datacenter on Friday we’re doing some hardware-changes within our rack, especially for our main website www.cacert.org.
As a preparation we will disable most of the services on www.cacert.org on Tuesday evening. The site will be fully operational again after the new server is up and running (most likely during Friday morning).
All other subdomains like blog/wiki/… will only have a short outage while we install a new firewall.
— this post will be updated after returning back from the datacenter —
DEUTSCH Jetzt den Wiederaufbau der Ukraine vorbereiten! In der Ukraine hatte CAcert vor Kriegsausbruch Assurer in Lemberg und Kiew. Befinnden sich zur Zeit in Ihrer Umgebung ukrainische Flüchtlinge? Dann helfen Sie diesen, Assurer zu werden.
Zum Beispiel indem Sie beim CATS übersetzen. Indem Sie ihnen bei den Assurance beistehen und andere Assurer beiziehen, sich selber assuren lassen.
ENGLISCH Prepare the reconstruction of Ukraine now! In Ukraine, CAcert had assurers in Lviv and Kiev before the outbreak of war. Are there Ukrainian refugees in your area at the moment? Then help them to become assurers. For example, by translating at CATS. By assisting them with the assurances and involving other assurers, or by becoming an assurer yourself.
POLSKI Przygotuj si? do odbudowy Ukrainy ju? teraz! Na Ukrainie CAcert mia? przed wybuchem wojny asesorów we Lwowie i Kijowie. Czy w Twojej okolicy mieszkaj? obecnie uchod?cy z Ukrainy? Nast?pnie pomó? im sta? si? asesorami. Na przyk?ad t?umacz?c w CATS. Pomagaj?c im w uzyskaniu zapewnienia i anga?uj?c innych asekuruj?cych lub samemu staj?c si? asekuratorem.
A Swiss security engineer develops high-security systems for free after work. A handful of people run a free certificate authority. How can that be?
For the fact that Gary Gregory has had to work through the past few days, even though he is actually on holiday, he is in a surprisingly good mood. The developer is one of the main people responsible for Log4j, the software component in which a serious security vulnerability was recently found. When the warning message reached him, it was immediately clear to him that he and his handful of colleagues were in for some sleepless nights.
Meanwhile, an older vignette has been revived on the internet: it shows an adventurous construction of blocks resting at the base on a fragile pillar. The construction represents “the whole modern digital infrastructure”, the narrow column “a project that someone in Nebraska has been maintaining since 2003 without thanks”.
(source: XKCD Comic / CC 2.5)
True, Gary Gregory lives in Florida and has maintained the Log4j component for “only” nine years. Apart from these details, the picture fits the current situation perfectly. Because the free piece of software, developed and maintained by volunteers, is in applications from the iCloud to the Tesla.
In a survey conducted by the CH-Open association among companies and public authorities with at least one IT manager in Switzerland, 97 per cent said they use open source software (OSS); about half even in more than 15 application areas. The picture shows how this number growed between 2015 and 2021.
Open Source is used in all kinds of areas: Programming languages such as Java and Python, web server and database programmes, desktop applications such as Firefox and Libre Office are just a few examples. So, such software is in computer systems at all levels.
Open source is software whose source code is publicly accessible. With a licence, the authors grant users the right to use the software and the source code for any purpose; they may also distribute it or adapt it for their own use. Because the entire code is transparent, users can find and solve problems themselves. Ideally, there is an exchange that makes the software as a whole better and better, similar to how it works with the online encyclopaedia Wikipedia.
Often, the code is not simply published on random websites, but under the umbrella of foundations that have rules and processes that are supposed to guarantee the quality of the software. Enough money to pay for all the volunteer work the foundations don’t have – as CAcert.
Gary Gregory works an average of about ten hours a week on open source projects. He says, “With a full-time job and three kids, it’s not easy.” He is passionate about it and enjoys it. Compared to his job, he can be more creative. Instead of the ideas of business clients, his own ideas take centre stage, which he likes.
Gregory is lucky. Because his employer supports his commitment and allows him to occasionally work on his open source project during working hours. “My company realises that it benefits from open source and it’s only fair to give something back once in a while.”
This is rather the exception. In the survey of Swiss users cited earlier, less than a quarter of organisations say that employees are allowed to contribute to open source developments during working hours. Donations to volunteers or to organisations behind the code are also quite rare.
Some user companies contribute to open source software (OSS), the picture above shows the different modes of support.
Security engineer Christian Folini knows the situation first-hand. He is one of two leaders of the “Modsecurity Core Rule Set” of the open source foundation Owasp, which specialises in security. The “Modsecurity Core Rule Set” is a set of hard-to-read rules designed to detect and defend against malicious attacks. Such a rule set is part of the infrastructure of security-sensitive applications, such as online banking or the cloud.
Microsoft, Google, AWS, Yahoo, Cloudfare: all integrate and distribute Folini’s rule set. Of those mentioned, only Google supports the project with donations. Folini has been able to recruit smaller companies as sponsors. With the money, the group finances, for example, that a person is available around the clock to answer questions. If there were more money, the quality of the software, i.e. the safety of the users, could be further increased. But this awareness is usually lacking.
If you can help with CAcert as a volunteer or supporter, please contact the secretary at secretary (at no spam) cacert (dot) org
Und es kamen #Assurer aus dem #Osten und brachten dem Kind #Geschenke mit: einen #Fingerprint, ein freies #Zertifikat und einen digitalen #Identitästausweis. Sei auch du ein #König und verbreite #CAcert in der ganzen #Welt #Gib_Dich_als_Assurer_zu_erkennenhttps://bit.ly/2Rcy1Rj
And #Assurer came from the #east and brought #gifts to the #child: a #Fingerprint, a #free #Certificate and a #digital #identity card. Be a #King and spread #CAcert all over the #world! http://f.eg. on a #holiday or a #business #trip https://wiki.cacert.org/AssuranceHandbook2#Make_yourself_known_as_a_CAcert_assurer
Roberto Cirillo has been CEO of Swiss Post for just under two years. Before that, he was a McKinsey consultant, CEO of the British hospital group Optegra and head of the activities of the service company Sodexo in France. Cirillo took up his post with the aim of stopping the downward trend. In the past five years, the Post’s turnover has fallen by around CHF 1 milliard. The volume of letters is decreasing rapidly, the post offices are less and less frequented.
In an interview with the NZZ, he said: “Today, we make more than 90% of our turnover in the logistics sector with business customers. Especially in e-commerce and goods logistics. Of the CHF 3 milliard we plan to invest in the next four years, the majority will go into logistics and communication services. The reason why the Post was created over 170 years ago was not to transport letters. It was the secrecy of letters. It was about transmitting information securely, reliably and trustworthily. That’s what we want to do more of in the digital world as well.” (22.02.2021)
Dear friends and members of the CAcert community. Are you curious and want to know what is wrapped in the package under the tree? This year, Father Christmas has packed something really nice.
As always with CAcert, you can unwrap it faster and enjoy it more quickly if you help out a little. Translate a little. Or do a little programming. Or test a few new functions. Or like this. To do so, you find further information on the web or write to our secretary.