TLS (Transport Layer Security) on Rietta Cybersecurity

Is Ruby on Rails Secure?

Mon, 01 Jan 0001 00:00:00 +0000

Question: Is Ruby on Rails secure? What if I add SSL? Answer: Security is not an on/off switch. You need to ask three questions whenever you’re trying to determine the appropriate security level for anything: Secure against what? What is the worst thing that can happen? Compared to what alternative? There is no secure switch to make all the risks go away. Security is a process that includes every aspect of the business model, application development, and deployment management practices, not a single magic setting.

Generate OpenSSL Elliptic Curve Key Pair from the Command Line

Tue, 18 Aug 2026 00:00:00 +0000

Back in 2012, I wrote Generate OpenSSL RSA Key Pair from the Command Line, which has gone on to become the single most-visited post on this entire blog. Fourteen years is a long run for a command-line tutorial, and RSA hasn’t gone anywhere. But if you’re generating a new key pair in 2026, I’d point you toward elliptic curve cryptography (ECC) instead of a bigger RSA key.

Shorter SSL/TLS Lifetimes: Business Impact of Monthly Certificate Renewals

Tue, 22 Apr 2025 08:00:00 +0000

The CA/Browser forum has reportedly approved a measure to reduce the allowed time for certificate validity from 398 to 47 days by March 15, 2029. This change will require users to renew certificates on a nearly monthly basis. This is a manual process that will now have to be done up to 10 times per year, instead of just once. This change will not be evident to most Internet users and businesses.

Xfinity is Man-in-the-Middle (MITM) Attacking my Internet

Tue, 29 Oct 2019 00:00:00 +0000

I recently moved to Fort Collins, CO. With this move also meant new internet… Unfortunately, Xfinity (Comcast) is the only ISP available in the area until early next year, so I purchased service through Xfinity. I had heard horror stories from co-workers about Comcast, but after working at a company that makes billing and networking software and hardware for Wireless Internet Service Providers, I was skeptical; everyone seems to hate their ISP.

Security Quick-Wins: Use DNS CAA records to avoid fraudulent certificates

Tue, 24 Jul 2018 11:30:00 -0500

It’s ordinarily possible for a CA to sign a certificate for your domain without properly validating it. We essentially have to trust them to take security seriously and to not make mistakes in their process.

Migrate Away from SSL/Early TLS for PCI Compliance

Sat, 30 Jun 2018 19:00:00 -0500

Systems that handle payment information, particularly e-commerce systems, are regulated by PCI DSS. Changes to the PCI compliance requirements have reclassified the use of outdated and insecure versions of TLS (and its predecessor, SSL) as non-compliant. This has some significant impact across the software industry as the changes went into enforcement today, June 30, 2018. The key takeaways for us as web application developers are that we must ensure that our deployed systems are using modern and secure TLS configurations, and that we should now do so at the expense of supporting legacy web browsers that are non-compliant, namely old versions of Internet Explorer and Windows.

Equifax Missed Defense in Depth, Allowing a Massive Data Breach

Mon, 18 Sep 2017 00:00:00 -0400

Equifax has confirmed that the main vector that lead to the data breach was a remote code execution vulnerability in Apache Struts that had been known for months [1]. Equifax had not yet patched it within the production environment. This is not just a lesson in the importance of patch management but one of defense in depth. The weakness in Equifax’s design was set in motion years before when they failed to design with the assumption that the front-end web server would be compromised.

The attacker was able to obtain the massive trove of private data because the web application was the only gatekeeper. Once the remote code execution vulnerability was exploited, the attacker was able to access data unfettered by additional access controls. Equifax chose to use a typical web application architecture without defense in depth.

Defense in depth has to start as part of the development process. All developers should be aware of the OWASP Top 10 (#3) and their work should be audited against the OWASP Advanced Security Verification Standard (ASVS) [#3] for the level appropriate for the risk faced by an organization in the event of a security breach.

How To Protect Against the POODLE SSLv3 Vulnerability

Thu, 16 Oct 2014 09:21:22 -0400

The POODLE SSL vulnerability marks the third major security flaw discovered this year that impacts the security of millions of websites.

The attack works by forcing the connection to downgrade from the newer TLS protocol to the 18 year old SSL 3 protocol, which is obsolete and insecure, and then utilizing a weakness to calculate small strings of data from the encrypted communication, such as session cookies.

Raspberry Pi crypto key management project!

Thu, 02 Oct 2014 21:20:16 -0400

A few months ago I bought a Raspberry Pi B to experiment with, but sadly my day job as a Ruby developer keep me busy enough that it just sat on the shelf unused until this last weekend. For those not yet in the know, the Raspberry Pi is an excellent little complete computer system on a small circuit board that uses very low power and looks like this:

Free, Universal SSL with Cloudflare

Mon, 29 Sep 2014 09:11:52 -0400

Cloudflare, the web application security forward proxy and transparent CDN service, has announced on their blog universal SSL even on their free accounts.

This is a very welcome development for the public interest on the internet.

Retake the Net for Privacy!

Thu, 05 Jun 2014 15:18:56 -0400

Rietta (@riettainc on Twitter) will educate customers on the use of strong headers, TLS w/ PFS, and other countermeasures as part of our continuing security initiatives program. Will you also help join us in the world-wide cause to retake the net? Check out the petition yourself at Reset the Net and choose for yourself today what you can personally do to make the web secure from illegitimate prying eyes.

OpenSSL Vulnerability, Patch 1.0.1 Immediately

Mon, 07 Apr 2014 23:50:50 -0400

Major Vulnerability, Action Required. A major vulnerability for OpenSSL 1.0.1 was announced today, April 7, 2014. The Heartbleed Bug, CVE-2014-0160, is a major vulnerability that may lead to secret key disclosure. A discussion of this vulnerability can be found on the Hacker News thread on the Heartbleed vulnerability.

Conditionally Including Resources on SSL or non-SSL to Avoid Mixed Content Security Warnings in Ruby on Rails

Wed, 21 Dec 2011 00:00:00 +0000

When building content that can be delivered on an encrypted HTTPS connection it is necessary to reference all of the embedded resources, 3rd party badge images, embedded YouTube videos, etc, from an HTTPS url. Otherwise a mixed content error will imply to your users that the website is not safe, ouch!

Authentication Without Encryption for Ham Radio

Mon, 17 Aug 2009 00:00:00 +0000

In April 2004, I gave a talk for the Atlanta Radio Club about the possibilities for authenticated digital communication for amateur radio applications. I published the document on my Georgia Tech website at that time. Since I no longer have an account at Georgia Tech, I am re-posting the document here. Authenticating on a Ham Internet The FCC regulations for amateur radio, part 97, rule that encryption cannot be used to obscure the meaning of communications.