<div dir="ltr"><br><div class="gmail_extra"><div class="gmail_quote">On Sat, Sep 7, 2013 at 12:01 AM, Noah Kantrowitz <span dir="ltr"><<a href="mailto:noah@coderanger.net" target="_blank">noah@coderanger.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I would sooner burn the entire PSF infra than compromise our key integrity (if you are worried about government intrusions). Every person that has ever had access to our key material I trust personally (the list is quite small). Given that, PFS doesn't buy us a whole lot unless someone was able to steal the private key(s) without our knowledge and while every step I can think has been taken to prevent this, I can never fully rule it out. That said, now that Fastly handles the vast bulk of SSL terminations, we can probably look at this without risk of overloading the servers :-) (corollary, Fastly doesn't offer ECC for exactly the same reasons we aren't, nor would I expect this to change in the near future)<br>
</blockquote><div><br></div><div>I'm not worried about anything. I was just wondering if we could follow the best practices on the web to set a good example. But since I'm not doing the work I'll just shutup. :)</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
--Noah<br>
<div><div class="h5"><br>
On Sep 6, 2013, at 11:39 PM, Gregory P. Smith wrote:<br>
<br>
> Any chance we could change the default preferred ciphers?<br>
><br>
> currently sslscan shows (complete with a misspelling):<br>
><br>
> Prefered Server Cipher(s):<br>
> SSLv3 128 bits RC4-SHA<br>
> TLSv1 128 bits RC4-SHA<br>
><br>
> for <a href="http://wiki.python.org" target="_blank">wiki.python.org</a> et al?<br>
><br>
> Defaulting to ECDHE (for perfect forward secrecy) seem the right thing to do for the web.<br>
><br>
> ie it'd be great to see:<br>
><br>
> Prefered Server Cipher(s):<br>
> SSLv3 128 bits ECDHE-RSA-RC4-SHA<br>
> TLSv1 128 bits ECDHE-RSA-RC4-SHA<br>
><br>
> <a href="http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html" target="_blank">http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html</a><br>
><br>
> -gps<br>
><br>
><br>
><br>
> On Thu, Sep 5, 2013 at 9:06 AM, M.-A. Lemburg <<a href="mailto:mal@egenix.com">mal@egenix.com</a>> wrote:<br>
> On 04.09.2013 22:26, M.-A. Lemburg wrote:<br>
> > On 04.09.2013 22:16, M.-A. Lemburg wrote:<br>
> >> On 03.09.2013 16:49, M.-A. Lemburg wrote:<br>
> >>> Since the HTTPS redirect are now mostly working (there are still some<br>
> >>> details to be worked out), I've removed the wiki banners about the<br>
> >>> attack and instead added a section to the front pages of the Python<br>
> >>> and Jython wikis.<br>
> >>><br>
> >>> It's a good idea to change the passwords on the wikis now, since<br>
> >>> clear text passwords are just too easy to sniff at conferences.<br>
> >><br>
> >> Update: The HTTPS config changes have now been put in place and<br>
> >><br>
> >> HSTS is now also enabled for the wikis:<br>
> >><br>
> >> <a href="http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank">http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security</a><br>
> >><br>
> >> (allowing redirects to happen on the client side, if the browser<br>
> >> supports HSTS)<br>
> ><br>
> > I've submitted an HSTS preload list entry request to Google for<br>
> > inclusion in their list:<br>
> ><br>
> > <a href="https://sites.google.com/a/chromium.org/dev/sts" target="_blank">https://sites.google.com/a/chromium.org/dev/sts</a><br>
> > <a href="https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json" target="_blank">https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json</a><br>
> ><br>
> > Firefox bases its list on Google's, so hopefully <a href="http://wiki.python.org" target="_blank">wiki.python.org</a><br>
> > will end up there as well in a few weeks:<br>
> ><br>
> > <a href="http://blog.mozilla.org/security/2012/11/01/preloading-hsts/" target="_blank">http://blog.mozilla.org/security/2012/11/01/preloading-hsts/</a><br>
> > <a href="https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List" target="_blank">https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List</a><br>
><br>
> This is added now:<br>
><br>
> <a href="http://src.chromium.org/viewvc/chrome?revision=221431&view=revision" target="_blank">http://src.chromium.org/viewvc/chrome?revision=221431&view=revision</a><br>
><br>
> It'll appear in Chrome after the usual product development<br>
> cycles. Not sure how often Mozilla updates their list.<br>
><br>
> Donald: You might want to add <a href="http://pypi.python.org" target="_blank">pypi.python.org</a> to the HSTS<br>
> list as well.<br>
><br>
> --<br>
> Marc-Andre Lemburg<br>
> eGenix.com<br>
><br>
> Professional Python Services directly from the Source (#1, Sep 05 2013)<br>
> >>> Python Projects, Consulting and Support ... <a href="http://www.egenix.com/" target="_blank">http://www.egenix.com/</a><br>
> >>> mxODBC.Zope/Plone.Database.Adapter ... <a href="http://zope.egenix.com/" target="_blank">http://zope.egenix.com/</a><br>
> >>> mxODBC, mxDateTime, mxTextTools ... <a href="http://python.egenix.com/" target="_blank">http://python.egenix.com/</a><br>
> ________________________________________________________________________<br>
> 2013-09-04: Released eGenix pyOpenSSL 0.13.2 ... <a href="http://egenix.com/go48" target="_blank">http://egenix.com/go48</a><br>
> 2013-09-20: PyCon UK 2013, Coventry, UK ... 15 days to go<br>
> 2013-09-28: PyDDF Sprint ... 23 days to go<br>
><br>
> eGenix.com Software, Skills and Services GmbH Pastor-Loeh-Str.48<br>
> D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg<br>
> Registered at Amtsgericht Duesseldorf: HRB 46611<br>
> <a href="http://www.egenix.com/company/contact/" target="_blank">http://www.egenix.com/company/contact/</a><br>
> ________________________________________________<br>
> Infrastructure mailing list<br>
> <a href="mailto:Infrastructure@python.org">Infrastructure@python.org</a><br>
> <a href="https://mail.python.org/mailman/listinfo/infrastructure" target="_blank">https://mail.python.org/mailman/listinfo/infrastructure</a><br>
> Unsubscribe: <a href="https://mail.python.org/mailman/options/infrastructure/greg%40krypto.org" target="_blank">https://mail.python.org/mailman/options/infrastructure/greg%40krypto.org</a><br>
><br>
> ________________________________________________<br>
> Infrastructure mailing list<br>
> <a href="mailto:Infrastructure@python.org">Infrastructure@python.org</a><br>
> <a href="https://mail.python.org/mailman/listinfo/infrastructure" target="_blank">https://mail.python.org/mailman/listinfo/infrastructure</a><br>
</div></div>> Unsubscribe: <a href="https://mail.python.org/mailman/options/infrastructure/noah%40coderanger.net" target="_blank">https://mail.python.org/mailman/options/infrastructure/noah%40coderanger.net</a><br>
<br>
</blockquote></div><br></div></div>