I wish you a merry christmas and a happy new year.

This week I received an email from my bank company. They advertised that they are cooperating with the “Post”(Austrian mailprovider) and recommended to use “E-Brief” for notifications from them. My first thought was: “it’s E-Mail”. Because E-Brief translated from german means: “E-Mail”. So I took a look in the FAQ’s from the Post and they wrote things like(translated from German):

Your E-“Letter Box” from everywhere

High security

This blog really became 4 years old. When I started to write it was mostly for practicing written english. But my intention was always to give something back to the open-source community. I failed terribly with the first point. My english is as bad as it was before, but I have readers and get responses to some articles. It seems that I didn’t failed with “giving something back to the open-source community”.

Thank you to all my readers.

Overview

• System affected: PHKP
• Software-Version: including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b
• User-Interaction: Not required
• Impact: Remote-Code-Execution
• CVE: CVE-2018-1000885

The legendary portscanner nmap was released 20 years ago in Phrack #51. Happy Birthday nmap.

Sysadmins are the heros who bring back our cat-pictures from the heights of the filesystem-tree. So let’s honour our firefighters of the internet.

Many people are scared because Microsoft bought GitHub. I wonder why people are so shocked now. Github is just another cloud-thingy and cloud means: “it’s just the computer of someone else”. If “someone else” will shutdown or wipe his computer, then we better have backups. Having this in our minds I would say that it’s time to make (auto)backups. I wrote this little ruby-script that clones all public repositories of a user into a directory. If the repositories already exist locally, then this script will just make a “git-pull”.

I proudly pronounce the first (pre-)release of cryptorecord. Cryptorecords is a ruby gem that provides an API and scripts for creating crypto-related dns-records(e.g. DANE). Currently it supports TLSA, OPENPGPKEYS and SSHFP but I plan to support other records in future. The API doesn’t create any keys or certificates. It just takes existing keyfiles to create the DNS-records.

TLS via SMTP is opportunistic which makes connections vulnerable to man-in-the-middle-attacks. In order to prevent mitm-attacks, DANE could be used. The sender-server will first check the domain-records if dnssec is in use(and valid) and if a TLSA-record is published(and valid). If a TLSA-record is valid and matches with the certificate of the recipient-server the connection could be encrypted and the encryption is verified. Postfix was one of the first smtp-servers that implemented DANE since the author of the DANE protocol is a postfix-developer. This article describes how to enable DANE in postfix.