Tag Archives: security

In Welly for Kiwicon

I’ll be in Wellington for Kiwicon from Fri 8th to Tue 12th. If you’re coming to the conference, track me down and we’ll catch up there. If you’re not at the conference, I’ll be around town, so just drop me … Continue reading

Tagged , , , , , , | 6 Comments

Varnish DoS vulnerability

The Varnish developers have recently announced a DoS vulnerability in Varnish (CVE-2013-4484) , if you’re using Varnish in your environment make sure you adjust your configurations to fix the vulnerability if you haven’t already. In a test of our environment, … Continue reading

Tagged , , , , , , | Leave a comment

Virgin Travel Bank Woes

A few months back, a flight I was on from Melbourne to Sydney got cancelled and I ended up having to chase Virgin through numerous phone calls to get a refund processed. Being the large annoying company that they are, … Continue reading

Tagged , , , , , | 2 Comments

Delicious Entropy

I run a large GNU/Linux server with KVM for running numerous virtual machine guests, including build hosts used to package and compile software for different GNU/Linux distributions and other operating systems. I recently ran into an issue during a kernel … Continue reading

Tagged , , , , , , , , | Leave a comment

WordPress & SSL Fixes

I’ve been using WordPress for this blog for a number of years now – at some point I realised that whilst writing my own code is fun, there’s no need to reinvent yet-another-fucking-blog-platform and ended up selecting WordPress to use … Continue reading

Tagged , , , , , , , , | 2 Comments

SSL Intermediate CA Bundles with Amazon

When configuring SSL services, generally you need to set a certificate, a private key and the CA bundle containing the intermediate certificate(s), which is often a bundle of several different certificates. For example, https://www.jethrocarr.com‘s configuration looks like: SSLEngine on SSLCertificateFile … Continue reading

Tagged , , , , , | Leave a comment

Attack vectors for personal computers

I’ve put together a (very) simplified overview of various attack vectors for an end user’s personal computer. For a determined attacker with the right resources, all of the above is potentially possible, although whether an attacker would go to this … Continue reading

Tagged , , , , , | Leave a comment

Why SSL is really ISL

Secure transmission of data online is extremely important to avoid attackers intercepting data or claiming to be a site that they are not. To provide this, a technology called SSL/TLS (and commonly seen in the form of https://) was developed … Continue reading

Tagged , , , , , , , , , | Leave a comment


The EFF has put together a handy website for anyone looking to replace some of their current proprietary/cloud controlled systems with their own components. You can check our their guide at: http://prism-break.org/ Generally it’s pretty good, although I have concerns … Continue reading

Tagged , , , , , , | 2 Comments

IRD online services registration

I recently signed up with IRD’s (New Zealand’s Tax Department) online Kiwisaver service, so I could view the status of my payments and balance of New Zealand’s voluntary superannuation scheme. The user sign up form is pretty depressing (and no, … Continue reading

Tagged , , , , , | 3 Comments