https cert is only good for github urls about nodeschool.github.io HOT 33 CLOSED

I agree with @SomeoneWeird that we should have something in place asap. I'm applying the CloudFlare setup to one of my domains to see how easy it is to implement. If it doesn't give me trouble we can implement it for nodeschool.io as well.

from nodeschool.github.io.

Well done everyone!

from nodeschool.github.io.

Yeah, would be great if we could get Zeit to sponsor our hosting. Would solve all our problems 👼

from nodeschool.github.io.

Protecting 2/3 steps of the connection is the same as not having the protection at all.

So you're suggesting we have 0 protection rather than some ?

from nodeschool.github.io.

Anyway, enabling SSL (even if it's just for the 75%!) should be the first thing we do ASAP. We can reevaluate and keep arguing about it, but as long as we have something soon, we have time to evaluate the best way to proceed from here.

from nodeschool.github.io.

Thanks @brianloveswords. It seems that the changes have propagated properly and we have a valid certificate 🎉

from nodeschool.github.io.

It is possible put a https proxy in front of github webhosting. or use a different webhost to host http://nodeschool.io. In any case: Infra support welcome.

from nodeschool.github.io.

A decent solution could be using CloudFlare, as decribed here. We probably need a different tier than their free one though because their free tier does not support sha1 for older browsers.

I'd like to match the Google Analytics data from nodeschool.io against the statistics provided by CloudFlare to see how many of our visitors we would exclude if we would use CloudFlare's free tier.

@martinheidegger Do you know who has access to this Google Analytics data?

Below CloudFlare stats.

Edit: s/Cloudflare/CloudFlare/

from nodeschool.github.io.

My concern with using CloudFlare is that the connection between CloudFlare and GitHub will not be over SSL. Protecting 2/3 steps of the connection is the same as not having the protection at all.

from nodeschool.github.io.

Doesn't it work like this?

https://nodeschool.io (at CloudFlare) < - > https://nodeschool.github.io (at GitHub)

from nodeschool.github.io.

More like this :
User <-- SSL --> CloudFlare <-- HTTP --> GitHub

I don't think we can opt for Full SSL (Strict). Assuming we opt for Full SSL (2nd option), since CloudFlare doesn't validate the certificate, we would be risking a MITM attack.

from nodeschool.github.io.

Aha. So Full SSL (Strict) would only suffice. What do we need for that?

from nodeschool.github.io.

From what I understand after reading this thread, I don't think Full SSL (Strict) is going to work. Seems like for now, people are opting for Flexible SSL because Full SSL by itself doesn't really make much difference.

from nodeschool.github.io.

A different thought: now costs 14.90/month for a custom_domain. And it would allow us to do some other, server-side processing as well. I wonder if we could get open-source sponsoring?

from nodeschool.github.io.

@riyadhalnur I see, interesting thread. Ok, then CloudFlare is not going to work.

from nodeschool.github.io.

(with now it is possible to serve ssl content)

from nodeschool.github.io.

@rauchg, would it be possible for Zeit to sponsor us with hosting?

from nodeschool.github.io.

If the origin server has SSL, cloudflare will 100% use that if you enable "Full SSL" (but not strict mode) when connecting back to origin. Just because something is not 100% perfect does not mean we can't use it.

from nodeschool.github.io.

@SomeoneWeird If there's a possibility of MITM attacks, yes I don't think it's worth protecting two-thirds of the path. The whole point of SSL is to mitigate MITM attacks among others.

from nodeschool.github.io.

@riyadhalnur So you would rather leave everyone open to 100% possibility of MITM, rather than protecting against the 75% - albeit leaving the hardest 25% vulnerable? That seems very backwards.

from nodeschool.github.io.

If there was to be a MITM attack when you have 75% of it protected, then the loss of trust that will arise is more damaging. We'll essentially be giving people a false sense of security.

Another example would be this scenario - serving an app over HTTPS but storing user passwords in plain text in the database.

from nodeschool.github.io.

So you would rather leave everything open to MITM to really basic adversaries (like somebody sitting on the same WiFi router as them) than protecting against the easiest 75% and now having to fend off nation-state level attackers that have to be able to MITM the infrastructure between Cloudflare and Github?

"Don't do nothing just because you can't do everything"

from nodeschool.github.io.

I get your point but you're assuming that only state level actors can inflict damage on the unprotected 25%. This incident doesn't give me confidence.

from nodeschool.github.io.

Even if we have 100% SSL across everything, it would still be a problem if a rogue CA handed out malicious certs. What we're talking about here doesn't (and can't!) protect against that. I'm assuming that anybody that can get access to a link between CF & GH can MITM that connection, and with DCs crazy security nowadays, I am presume only a nation-state-level actor would be able to do it.

from nodeschool.github.io.

Enabling stuff like HPKP can be done on top of us enabling SSL on the website, which would mitigate some of the attack avenues of rogue-certificates. But we still need SSL.

from nodeschool.github.io.

That's a level of trust you walk in with when deploying SSL anywhere be it from Let's Encrypt, DigiCert, Comodo and so on. That like everything else goes to show nothing's 100% perfect but would you want to push that trust beyond that, as a real user?

from nodeschool.github.io.

I know, that's what i'm arguing for. You're saying that just because we can't 100% trust everybody then we shouldn't use SSL?

from nodeschool.github.io.

I'm not saying we should never use SSL but personally, I would not want to push my trust beyond a certain point which is the case here - accepting at all that benefit of last-mile security outweighs harm from illusion of security.

We could definitely use CloudFlare for the time being and since we don't have any sensitive information passing through the servers (none comes to mind), it would theoretically be ok. I personally would still like an option like now.

from nodeschool.github.io.

@SomeoneWeird If there's a possibility of MITM attacks, yes I don't think it's worth protecting two-thirds of the path. The whole point of SSL is to mitigate MITM attacks among others.

@riyadhalnur I agree completely. Even with a secure connection, you're still only protecting part of the path, the hosting company can still access data. A browser/OS vendor could still supply fake root certificates and hijack all traffic. If we can't prevent against these things then we are just engaging in security theatre. The only reasonable step is to remove the hard drive from the server, store it in a vault and weld it shut.

Although, I have to admit the unlikely possibility that I might be wrong and that just maybe security isn't boolean and instead a balance between risk and convenience.

from nodeschool.github.io.

@gerrywastaken thank you for making my day a bit brighter 😄

from nodeschool.github.io.

Current DNS records are like so:

~ ➜ host -a nodeschool.io
Trying "nodeschool.io"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3241
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 0, ADDITIONAL: 10

;; QUESTION SECTION:
;nodeschool.io.                 IN      ANY

;; ANSWER SECTION:
nodeschool.io.          3334    IN      TXT     "v=spf1 include:mailgun.org ~all"
nodeschool.io.          3334    IN      NS      ns2.dnsimple.com.
nodeschool.io.          3334    IN      NS      ns3.dnsimple.com.
nodeschool.io.          3334    IN      NS      ns4.dnsimple.com.
nodeschool.io.          3334    IN      NS      ns1.dnsimple.com.
nodeschool.io.          3334    IN      SOA     ns1.dnsimple.com. admin.dnsimple.com. 1435660680 86400 7200 604800 300
nodeschool.io.          86400   IN      A       192.30.252.153
nodeschool.io.          3334    IN      MX      10 mxa.mailgun.org.
nodeschool.io.          3334    IN      MX      10 mxb.mailgun.org.

CloudFlare will copy 'em like this:

@brianloveswords if this looks sane to you, can change the nameservers like so?

from nodeschool.github.io.

@jpwesselink we good on this issue, think we can close it?

EDIT: nevermind I commented before refreshing! Thanks for driving this.

from nodeschool.github.io.

With pleasure :)

from nodeschool.github.io.