[B! security] limitususã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

limitusus id:limitusus

securityã«é–¢ã™ã‚‹limitususã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (75)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

å½“ç¤¾åˆã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆç™ºç”Ÿ | ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚¹ã™ã ã¡ãã‚“
ã‚·ãƒ³ã‚¸ã§ã™ã€‚ã‚‚ã£ã¨ãã‚Œã£ã½ã„å ±å‘Šæ›¸ã¿ãŸã„ãªæ„Ÿã˜ã«ã—ã¦ã‚‚ã‚ˆã‹ã£ãŸã‚“ã§ã™ã€‚äº‹æ•…å ±å‘Šæ›¸ã£ã¦PDFã«ã—ã¦ãã‚Œã£ã½ãã™ã‚‹ã¨ã€èªã‚€æ°—ãŒæ¹§ãä¸ŠãŒã‚‹ç¨®æ—ã£ã¦ã„ã‚‹ã˜ã‚ƒãªã„ã§ã™ã‹ã€‚ä¿ºãªã‚“ã§ã™ã‘ã©ã€‚æ›¸ãã®é¢å€’ã ã£ãŸã®ã§ãƒ–ãƒã‚°ã§å‹˜å¼ã€‚ ä½•ãŒèµ·ããŸã‹ å¾“æ¥å“¡ãŒã€ãŠå®¢ã•ã‚“ã«é€ã‚‹ãƒ¡ãƒ¼ãƒ«ã§ã€æ·»ä»˜ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–“é•ãˆã¦é€ã‚Šã¾ã—ãŸã€‚ç«¯çš„ã«æ›¸ã‘ã°ãã‚Œã ã‘ã§ã™ã€‚ ã©ã†ã„ã†ã“ã¨ã™ã‹ Aç¤¾ã•ã‚“ã«é€ä»˜ã—ãŸã‹ã£ãŸè¦‹ç©æ›¸ã®PDFãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚ã‚Šã¾ã—ãŸ Aç¤¾ã•ã‚“ã«ãƒ¡ãƒ¼ãƒ«ã‚’æ›¸ã„ã¦ãƒ•ã‚¡ã‚¤ãƒ«ã‚’æ·»ä»˜ã—ã¦é€ä¿¡ã—ã¾ã—ãŸ Aç¤¾ã•ã‚“ã‹ã‚‰ã€Œã“ã‚Œã¡ãŒããï¼Ÿã€ã£ã¦è¿”äº‹ãŒæ¥ã¾ã—ãŸ æ‹…å½“è€…ã¯è¬ç½ªã—ã¦ãƒ¡ãƒ¼ãƒ«ã‚’æ¶ˆã™ã‚ˆã†ã«é€£çµ¡ã‚’å…¥ã‚Œã¾ã—ãŸ æ‹…å½“è€…ã¯ã‚·ãƒ³ã‚¸ã«ã€Œé–“é•ãˆãŸãƒ•ã‚¡ã‚¤ãƒ«é€ã£ã¡ã‚ƒã„ã¾ã—ãŸï¼ã€ã£ã¦Slackã§ãƒ¡ãƒ³ã‚·ãƒ§ãƒ³ã—ã¦é€£çµ¡ã—ã¾ã—ãŸ ã¾ãã“ã‚“ãªå…·åˆã§ã™ã€‚ å•é¡Œç‚¹ ã²ã¨ã¤ã‚ ã‚¦ãƒã®ä¼šç¤¾ã®Webã‚µã‚¤ãƒˆã‚’è¦‹ã¦ã‚‚ã‚‰ã†ã¨ã‚¤ãƒ³ãƒ•ãƒ©æ§‹æˆãŒæ›¸ã„ã¦ã‚ã‚‹ã®ã§ãã‚Œã§ã–ã£ãã‚Šåˆ†ã‹ã‚‹ã®ã§ã™ãŒã€ãã‚‚ãã‚‚
limitusus 2018/07/26
security

ãƒ¡ãƒ¼ãƒ«

æƒ…ã‚·ã‚¹
ãƒªãƒ³ã‚¯
TLS ã® SNI æš—å·åŒ–ã«é–¢ã™ã‚‹ Internet Draft ã‚’å…±åŒæå‡ºã—ã¾ã—ãŸ
Eric Rescorla (RTFM), Nick Sullivan (Cloudflare), Christopher Wood (Apple) ã®å„æ°ã¨ã¨ã‚‚ã«ã€SNI ã‚’æš—å·åŒ–ã™ã‚‹ TLS æ‹¡å¼µã‚’ææ¡ˆã™ã‚‹ Internet Draft ã‚’æå‡ºã—ã¾ã—ãŸã€‚ Encrypted Server Name Indication for TLS 1.3 ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã®ãƒ¡ãƒ¼ãƒ«ã«ã‚ã‚‹ã¨ãŠã‚Šã€ã™ã§ã« NSS / Firefox ã¨ picotls / H2O ã§å®Ÿè£…ä½œæ¥ãŒé–‹å§‹ã•ã‚Œã¦ãŠã‚Šã€ä»Šæœˆé–‹å‚¬ã•ã‚Œã‚‹ IETF 102 ã§ç›¸äº’é‹ç”¨è©¦é¨“ã‚’è¡Œã†ã¨ã¨ã‚‚ã«ã€æ¨™æº–åŒ–ã«ã‚€ã‘ãŸè°è«–ã‚’æ·±ã‚ã‚‹äºˆå®šã§ã™ã€‚ ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ä»¥é™ã€åºƒç¯„å›²ã«ãŠã‚ˆã¶ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ãƒ¢ãƒ‹ã‚¿ãƒªãƒ³ã‚°ã«ã‚ˆã‚‹ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ä¾µå®³ã®æ‡¸å¿µãŒæ˜Žã‚‰ã‹ã«ãªã‚‹ã¨ã¨ã‚‚ã«ã€ã§ãã‚‹ã ã‘å¤šãã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã®é€šä¿¡ãƒ—ãƒãƒˆã‚³ãƒ«ã‚’æš—å·åŒ–ã™ã‚‹ã“ã¨ãŒæ±‚ã‚ã‚‰ã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ãã¾ã—ãŸ (å‚è€ƒ: R
limitusus 2018/07/03
kazuho

TLS

security
ãƒªãƒ³ã‚¯
Let's encryptã¨SSL/TLSã«é–¢ã™ã‚‹èª¤è¬¬ - Chienomi
å…¨ãä»¥ã¦æ„å‘³ä¸æ˜Žãªèª¤è¬¬ãŒã¯ã³ã“ã£ã¦ã„ãŸä¸Šã«ã€ã‚„ãŸã‚‰ä¸Šã‹ã‚‰ç›®ç·šã ã£ãŸã®ã§ã€æ¶ˆç«ã—ã¦ãŠã“ã†ã¨æ€ã†ã€‚ ãã‚‚ãã‚‚SSL, TLSã¨ã¯ä½•ã‹ SSL/TLSã¯æš—å·åŒ–æŠ€è¡“ã§ã‚ã‚‹ã€‚ SSL/TLSã®ãƒ‡ãƒ¼ã‚¿é€šä¿¡è‡ªä½“ã¯å¯¾ç§°æš—å·ã§ã‚ã‚‹ã€‚ãŸã ã—ã€æš—å·åŒ–ã«åˆ©ç”¨ã™ã‚‹æš—å·éµã¯ä½¿ã„æ¨ã¦ã‚‹ã€‚ Cipherã¯ã‹ãªã‚Šè‰²ã€…ä½¿ãˆã‚‹ã®ã ã‘ã©ã€ã ã„ãŸã„ã¯Triple DES (3DES)ã‹AESãŒä½¿ã‚ã‚Œã‚‹ã€‚ ãã®æ‰‹é †ã¯ <- HelloRequest -> ClientHello <- ServerHello <- ServerCertificate <- ServerKeyExchange <- ServerHelloDone -> ClientKeyExchange -> Finished -> ChangeCipherSpec <- Finished <- ChangeChiperSpec <-> Application Dat
limitusus 2018/06/09
ssl

TLS

Let'sEncrypt

security
ãƒªãƒ³ã‚¯
Weak cryptographic standards removed | The GitHub Blog
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
limitusus 2018/02/28
github

https

security
ãƒªãƒ³ã‚¯
HashDoSè„†å¼±æ€§ã¨ã®æˆ¦ã„ï¼ Rubyã‚³ãƒŸãƒƒã‚¿ãƒ¼ãƒ»åœéƒ¨æ˜Œå¹³ãŒæ˜Žã‹ã™ãƒ—ãƒã‚°ãƒ©ãƒ å …ç‰¢åŒ–ã®ãƒŽã‚¦ãƒã‚¦ - ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢Hubï½œè‹¥æ‰‹Webã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ã‚ãƒ£ãƒªã‚¢ã‚’è€ƒãˆã‚‹ï¼
HashDoSè„†å¼±æ€§ã¨ã®æˆ¦ã„ï¼Â Rubyã‚³ãƒŸãƒƒã‚¿ãƒ¼ãƒ»åœéƒ¨æ˜Œå¹³ãŒæ˜Žã‹ã™ãƒ—ãƒã‚°ãƒ©ãƒ å …ç‰¢åŒ–ã®ãƒŽã‚¦ãƒã‚¦ éŽåŽ»ã€HashDosã®å½±éŸ¿ã‚’å—ã‘ãŸRubyã€‚è¨€èªžé–‹ç™ºè€…ã¯ã„ã‹ã«ã—ã¦ã“ã†ã—ãŸå•é¡Œã«å¯¾å¿œã—ã¦ããŸã®ã§ã—ã‚‡ã†ã‹ã€‚ã‚³ãƒŸãƒƒã‚¿ãƒ¼ã§ã‚ã‚‹åœéƒ¨æ°ã®è²´é‡ãªè¨˜éŒ²ã‚’å…¬é–‹ã—ã¾ã™ã€‚ 2011å¹´ã®æœ«é ƒã€HashDoSã¨ã„ã†è„†å¼±æ€§ãŒå…¬è¡¨ã•ã‚Œã€Rubyã‚‚ã“ã®å½±éŸ¿ã‚’å—ã‘ãŸã€‚æœ¬ç¨¿ã®ç†è€…ã§ã‚ã‚‹åœéƒ¨æ˜Œå¹³ï¼ˆã†ã‚‰ã¹ãƒ»ã—ã‚‡ã†ã¸ã„ï¼@shyouheiï¼ä»¥ä¸‹ã€åœéƒ¨ï¼‰ã¯ã€å ±å‘Šå½“åˆã‹ã‚‰Rubyå´ã®ãƒãƒ¼ãƒ ãƒ¡ãƒ³ãƒãƒ¼ã¨ã—ã¦ãƒ—ãƒã‚°ãƒ©ãƒ æœ¬ä½“ã®ä¿®æ£ã‚’æ‹…å½“ã—ãŸã€‚ä»¥ä¸‹ã¯ãã®è¨˜éŒ²ã§ã‚ã‚‹ã€‚è¨€èªžé–‹ç™ºè€…ãŸã¡ãŒæ™®æ®µã©ã®ã‚ˆã†ãªã“ã¨ã‚’è€ƒãˆã€ã©ã†ã„ã£ãŸæŠ€è¡“ã‚’ç”¨ã„ã¦é–‹ç™ºã‚„ãƒã‚°ãƒ•ã‚£ãƒƒã‚¯ã‚¹ã‚’è¡Œã£ã¦ã„ã‚‹ã®ã‹ã€‚ãã®æ¦‚è¦ã‚’çŸ¥ã£ã¦ã‚‚ã‚‰ãˆã‚Œã°å¹¸ã„ã ã€‚ ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆæŒ‡å‘ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªž Ruby HashDoSã®æ¦‚è¦ ãªãœç´„6å¹´å¾Œã®ä»Šã€ä¿®æ£å†…å®¹ã‚’å…¬é–‹ã™ã‚‹ã«è‡³ã£ãŸã‹ï¼Ÿ å‰å²ï¼šã™ã§ã«å†…åŒ…ã•ã‚Œã¦ã„ãŸãƒªã‚¹ã‚¯
limitusus 2018/01/10
ã»ã‚“ã¨ãã®é€šã‚Š > å•é¡Œã‚’æ£ã—ãç†è§£ã™ã‚‹ã“ã¨ã®æ–¹ãŒã€å•é¡Œã‚’æ£ã—ãä¿®æ£ã™ã‚‹ã‚ˆã‚Šä½•å€ã‚‚é›£ã—ã„ã‹ã‚‰ã ã€‚

ruby

security
ãƒªãƒ³ã‚¯
/bin/bash based SSL/TLS tester: testssl.sh
Key features Clear output: you can tell easily whether anything is good or bad Ease of installation: Works for Linux, Mac OSX, FreeBSD, NetBSD and WSL/MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like. OpenBSD only needs bash to be postinstalled. Alternatively a Dockerfile is provided or you can just use docker run --rm -ti drwetter/testssl.sh F
limitusus 2017/12/18
openssl

security

utility
ãƒªãƒ³ã‚¯
OSSã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æŠ€è¡“ã®ä¼š
NEWS ã€2022/10/12ã€‘CSS 2022ã®ãŠçŸ¥ã‚‰ã›ï¼†OWS 2022ã‚’é–‹å‚¬è‡´ã—ã¾ã™ ä»Šå¹´ã‚‚æƒ…å ±å‡¦ç†å¦ä¼šã®CSS 2022(æœ‰å„Ÿ)ä¸ã§OWS2022ã‚’é–‹å‚¬è‡´ã—ã¾ã™ã€‚ é–‹å‚¬æœŸé–“ 2022å¹´10æœˆ24æ—¥(æœˆ) ï½ž 2022å¹´10æœˆ27æ—¥(æœ¨) ä¼šå ´ ç†Šæœ¬åŸŽãƒ›ãƒ¼ãƒ«ã¨ã‚ªãƒ³ãƒ©ã‚¤ãƒ³(ZOOM)ã®ãƒã‚¤ãƒ–ãƒªãƒƒãƒ‰é–‹å‚¬ ä¸»å‚¬ ä¸€èˆ¬ç¤¾å›£æ³•äºº æƒ…å ±å‡¦ç†å¦ä¼š ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶ä¼šï¼ˆCSECï¼‰ å…±å‚¬ ä¸€èˆ¬ç¤¾å›£æ³•äºº æƒ…å ±å‡¦ç†å¦ä¼š ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¿ƒç†å¦ã¨ãƒˆãƒ©ã‚¹ãƒˆç ”ç©¶ä¼šï¼ˆSPTï¼‰ åˆåŒé–‹å‚¬ ãƒžãƒ«ã‚¦ã‚§ã‚¢å¯¾ç–ç ”ç©¶äººæè‚²æˆãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—2022ï¼ˆMWS2022ï¼‰ ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—2022ï¼ˆPWS2022ï¼‰ ãƒ¦ãƒ¼ã‚¶ãƒ–ãƒ«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—2022ï¼ˆUWS2022ï¼‰ OSSã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æŠ€è¡“ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—2022ï¼ˆOWS2022ï¼‰ ãƒ–ãƒãƒƒã‚¯ãƒã‚§ãƒ¼ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—2022ï¼ˆBWS2022ï¼‰ OW
limitusus 2017/03/16
security

OSS

CVE
ãƒªãƒ³ã‚¯
è„†å¼±æ€§æƒ…å ± (CVE) ã®å¯¾å¿œçŠ¶æ³ã‚’ç¢ºèªã™ã‚‹ - kakakakakku blog
è„†å¼±æ€§æƒ…å ± (CVE : Common Vulnerabilities and Exposures) ã®å¯¾å¿œçŠ¶æ³ã‚’ç¢ºèªã™ã‚‹æ‰‹é †ã‚’ã¾ã¨ã‚ã¦ãŠã“ã†ã¨æ€ã†ï¼Ž CVE ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ CVE æƒ…å ±ã¯å…¨ã¦ä»¥ä¸‹ã«ã¾ã¨ã¾ã£ã¦ã„ã‚‹ï¼Ž cve.mitre.org å…¨ã¦ã® CVE ã«ã¯ãƒ¦ãƒ‹ãƒ¼ã‚¯ãª ID ãŒæŒ¯ã‚‰ã‚Œã¦ã„ã¦ï¼Œä¾‹ãˆã°ï¼Œç’°å¢ƒå¤‰æ•° HTTP_PROXY ã‚’æ‚ªç”¨ã—ã¦å¤–éƒ¨ã‚µã‚¤ãƒˆã¨é€šä¿¡ã§ãã¦ã—ã¾ã†å¯èƒ½æ€§ãŒã‚ã‚‹ "httpoxy" ãªã‚‰ CVE-2016-5385 ã ã—ï¼ŒImageMagick ã§ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã†å¯èƒ½æ€§ãŒã‚ã‚‹ "ImageTragick" ãªã‚‰ CVE-2016-3714 ã¨ãªã‚‹ï¼Ž"Shellshock" ã‚‚ãã†ã ã‘ã©ï¼Œã©ã®è„†å¼±æ€§ã‚‚ã‚«ãƒƒã‚³ã‚¤ã‚¤åˆ¥åï¼ˆåŽ¨ãƒ‹ï¼‰ãŒä»˜ã„ã¦ã¦ï¼Œã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢åŒå£«ã®ä¼šè©±ã ã¨ãƒã‚ºãƒ¯ãƒ¼ãƒ‰çš„ã«èªè˜ã§ãã¦è‰¯ã„ã¨æ€ã†ï¼Ž CVE - CVE-2016-5385 CVE - CV
limitusus 2016/08/04
security
ãƒªãƒ³ã‚¯
ç·å‹™çœï½œéžå¸¸å‹¤è·å“¡æŽ¡ç”¨æƒ…å ± æƒ…å ±æµé€šè¡Œæ”¿å±€ï¼ˆæƒ…å ±æµé€šæŒ¯èˆˆèª²æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å®¤ï¼‰
ä»¥ä¸‹ã«æŽ²ã’ã‚‹äº‹é …ã«ã¤ã„ã¦é«˜ã„å°‚é–€æ€§ã‚„ååˆ†ãªçŸ¥è¦‹ã‚’æœ‰ã—ã¦ã„ã‚‹è€… æƒ…å ±é€šä¿¡ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã®æ§‹ç¯‰ãƒ»é‹ç”¨ã«é–¢ã™ã‚‹å°‚é–€çš„çŸ¥è˜ã€å®Ÿå‹™çµŒé¨“ã‚’æœ‰ã™ã‚‹ã“ã¨ã€‚ æƒ…å ±é€šä¿¡æŠ€è¡“ã®å‹•å‘ã«é–¢ã™ã‚‹æƒ…å ±åŽé›†ãƒ»åˆ†æžã«å¿…è¦ãªçŸ¥è˜ã€çµŒé¨“ã‚’æœ‰ã™ã‚‹ã“ã¨ã€‚ æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹æƒ…å ±åŽé›†ãƒ»åˆ†æžã«å¿…è¦ãªçŸ¥è˜ã€çµŒé¨“ã‚’æœ‰ã™ã‚‹ã“ã¨ã€‚ ãƒ‘ã‚½ã‚³ãƒ³æ“ä½œï¼ˆEXCELã€WORDç‰ã«ã‚ˆã‚‹è³‡æ–™ä½œæˆï¼‰ãŒã§ãã‚‹ã“ã¨ã€‚ ãªãŠã€ä»¥ä¸‹ã«è©²å½“ã™ã‚‹æ–¹ã¯ã€å¿œå‹Ÿã§ãã¾ã›ã‚“ã®ã§å¾¡äº†æ‰¿ãã ã•ã„ã€‚ æ—¥æœ¬å›½ç±ã‚’æœ‰ã—ãªã„è€… å›½å®¶å…¬å‹™å“¡æ³•ç¬¬38æ¡ã®è¦å®šã«ã‚ˆã‚Šå›½å®¶å…¬å‹™å“¡ã«ãªã‚‹ã“ã¨ãŒã§ããªã„è€… æˆå¹´è¢«å¾Œè¦‹äººã€è¢«ä¿ä½äºº ç¦éŒ®ä»¥ä¸Šã®åˆ‘ã«å‡¦ã›ã‚‰ã‚Œã€ãã®åŸ·è¡Œã‚’çµ‚ã‚ã‚‹ã¾ã§åˆã¯åŸ·è¡Œã‚’å—ã‘ã‚‹ã“ã¨ãŒãªããªã‚‹ã¾ã§ã®è€… ä¸€èˆ¬è·ã®å›½å®¶å…¬å‹™å“¡ã¨ã—ã¦æ‡²æˆ’å…è·ã®å‡¦åˆ†ã‚’å—ã‘ã€å½“è©²å‡¦åˆ†ã®æ—¥ã‹ã‚‰2å¹´ã‚’çµŒéŽã—ãªã„è€… æ—¥æœ¬å›½æ†²æ³•åˆã¯ãã®ä¸‹ã«æˆç«‹ã—ãŸæ”¿åºœã‚’æš´åŠ›ã§ç ´å£Šã™ã‚‹ã“ã¨ã‚’ä¸»å¼µã™ã‚‹æ”¿å…šãã®ä»–ã®å›£ä½“ã‚’çµæˆã—ã€åˆã¯ã“ã‚Œã«åŠ å…¥ã—ãŸ
limitusus 2016/07/20
ã“ã®çµ¦ä¸Žã§äº¤é€šè²»ã‚‚ä½å®…æ‰‹å½“ã‚‚ãªãè¦æ±‚ãƒ¬ãƒ™ãƒ«ã ã‘é«˜ã„ã®ï¼Ÿãƒžãƒˆãƒ¢ãªäººã¯ã“ãªã„ã§ã—ã‚‡ã€‚ç·å‹™çœã®äººãã‚Œãã‚‰ã„ã‚ã‹ã‚‹ã§ã—ã‚‡â€¦

ã“ã‚Œã¯ã²ã©ã„

ç·å‹™çœ

å›½å®¶å…¬å‹™å“¡

security
ãƒªãƒ³ã‚¯
httpoxy
Recommended reading Summary What Is Affected Immediate Mitigation Prevention Interesting, but once youâ€™ve mitigated How It Works Why It Happened History of httpoxy CVEs A CGI application vulnerability (in 2016) for PHP, Go, Python andÂ others httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict: RFC 3
limitusus 2016/07/19
security

http

php

python

CGI

httpoxy

vulnerability
ãƒªãƒ³ã‚¯
ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼ã‚«ãƒ¼ãƒ‰ã§SSHã™ã‚‹ - AAA Blog
ã¿ãªã•ã‚“ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼ã‚«ãƒ¼ãƒ‰ã¯ã‚‚ã†æ‰‹å…ƒã«å±Šãã¾ã—ãŸã‹? ç§ã®ä½ã‚€å¤§ç”°åŒºã¯ã¨ã¦ã‚‚æ··é›‘ã—ã¦ã„ã¦ç”³è«‹ã‹ã‚‰5ãƒ¶æœˆã‹ã‹ã£ã¦ä»Šæœˆã‚„ã£ã¨äº¤ä»˜ã—ã¦ã‚‚ã‚‰ã†ã“ã¨ãŒã§ãã¾ã—ãŸã€‚ ã“ã®ã‚«ãƒ¼ãƒ‰ã«å«ã¾ã‚Œã‚‹å…¬çš„å€‹äººèªè¨¼æ©Ÿèƒ½ã¯ä»¥å‰ã‹ã‚‰ä½åŸºã‚«ãƒ¼ãƒ‰ã«å…¥ã£ã¦ã„ãŸã‚‚ã®ã§ã™ãŒã€ä»Šå¹´ã‹ã‚‰æ°‘é–“åˆ©ç”¨ã‚‚ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ã—ã‹ã—ã€ã“ã®å…¬çš„å€‹äººèªè¨¼ã§ã™ãŒè©³ç´°ãªä»•æ§˜ãŒå…¬é–‹ã•ã‚Œã¦ã„ãªã„ãŸã‚ã€å•†ç”¨åˆ©ç”¨ã—ã‚ˆã†ã¨ã„ã†å‹•ãã¯ã¾ã èžãã¾ã›ã‚“ã—ã€æ—¢ã«å‹•ã„ã¦ã„ã‚‹è¡Œæ”¿ã‚µãƒ¼ãƒ“ã‚¹ã®e-govã‚„e-taxã¯IEé™å®šã§ã€ã„ã¾ã ã«Java AppletãŒä½¿ã‚ã‚Œã¦ã„ã‚‹ãªã©å¤§å¤‰æ®‹å¿µãªçŠ¶æ³ã§ã™ã€‚ ã‚«ãƒ¼ãƒ‰ã«å…¥ã£ã¦ã„ã‚‹é›»åè¨¼æ˜Žæ›¸ã¨2048bitã®RSAç§˜å¯†éµã¯æ§˜ã€…ãªç”¨é€”ã«æ´»ç”¨ã§ãã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã®ã«ã€ã›ã£ã‹ãç¨Žé‡‘ã‚’è²»ã‚„ã—ã¦ä½œã£ãŸã‚·ã‚¹ãƒ†ãƒ ãŒä½¿ã‚ã‚Œãªã„ã®ã¯ã‚‚ã£ãŸã„ãªã„ã§ã™ãã€‚ æ°‘é–“åˆ©ç”¨ã®ç¬¬ä¸€æ©ã¨ã—ã¦ã€ã‚«ãƒ¼ãƒ‰ã«å…¥ã£ã¦ã„ã‚‹RSAéµã‚’åˆ©ç”¨ã—ã¦è‡ªå®…ã‚µãƒ¼ãƒãƒ¼ã«SSHãƒã‚°ã‚¤ãƒ³ã—ã¦ã¿ã¾ã—ã‚‡ã†!
limitusus 2016/06/24
ã€Œè¨¼æ˜Žæ›¸ã®å¤±åŠ¹æƒ…å ±ã‚’å¾—ã‚‹ã«ã¯ãªãœã‹ç·å‹™å¤§è‡£ã®èªå¯ãŒå¿…è¦ã€ãªã‚“ã¨â€¦

ssh

security
ãƒªãƒ³ã‚¯
How to Record SSH Sessions Established Through a Bastion Host | Amazon Web Services
AWS Security Blog How to Record SSH Sessions Established Through a Bastion Host A bastion host is a server whose purpose is to provide access to a private network from an external network, such as the Internet. Because of its exposure to potential attack, a bastion host must minimize the chances of penetration. For example, you can use a bastion host to mitigate the risk of allowing SSH connection
limitusus 2016/06/15
ssh

AWS

security
ãƒªãƒ³ã‚¯
Symantecã®è¨¼æ˜Žæ›¸ç™ºè¡Œã«ä¸æ‰‹éš›ã€GoogleãŒå¯¾å¿œã‚’è¦æ±‚
ç±³Symantecã®èªè¨¼å±€ãŒæ‰‹é•ã„ã«ã‚ˆã‚Šã€ã€Œgoogle.comã€ãªã©ã®ãƒ‰ãƒ¡ã‚¤ãƒ³å‘ã‘ã®ãƒ†ã‚¹ãƒˆè¨¼æ˜Žæ›¸ã‚’ãƒ‰ãƒ¡ã‚¤ãƒ³æ‰€æœ‰è€…ãŒçŸ¥ã‚‰ãªã„ã†ã¡ã«ç™ºè¡Œã—ã¦ã„ãŸã“ã¨ãŒåˆ†ã‹ã‚Šã€ç±³Googleã¯10æœˆ28æ—¥ã€åŒç¤¾ã«å¯¾ã—ã¦å¯¾å¿œã‚’è¦æ±‚ã—ãŸã€‚Symantecã®å¯¾å¿œæ¬¡ç¬¬ã§ã¯ã€Googleè£½å“ã§Symantecã®è¨¼æ˜Žæ›¸ãŒå®‰å…¨ã¨ã¿ãªã•ã‚Œãªããªã‚‹å¯èƒ½æ€§ã‚‚ã‚ã‚‹ã¨è¦å‘Šã—ã¦ã„ã‚‹ã€‚ SymantecãŒ10æœˆ2æ—¥ã«ç™ºè¡¨ã—ãŸã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆå ±å‘Šæ›¸ã§ã€Googleã‚„Operaãªã©5çµ„ç¹”å‘ã‘ã®ãƒ†ã‚¹ãƒˆè¨¼æ˜Žæ›¸23ä»¶ãŒãƒ‰ãƒ¡ã‚¤ãƒ³æ‰€æœ‰è€…ã®çŸ¥ã‚‰ãªã„ã†ã¡ã«ç™ºè¡Œã•ã‚Œã¦ã„ãŸã¨å ±å‘Šã—ãŸã€‚ã“ã‚Œã«å¯¾ã—ã¦Googleã¯ã€ä¸å¯©ãªè¨¼æ˜Žæ›¸ã¯ãã‚Œä»¥å¤–ã«ã‚‚å˜åœ¨ã™ã‚‹ã¨æŒ‡æ‘˜ã€‚ãã®å¾Œã€Symantecã¯10æœˆ12æ—¥ã«å‡ºã—ãŸæ›´æ–°ç‰ˆã®å ±å‘Šæ›¸ã§ã€ã•ã‚‰ã«76ãƒ‰ãƒ¡ã‚¤ãƒ³å‘ã‘ã®è¨¼æ˜Žæ›¸164ä»¶ã¨ã€æœªç™»éŒ²ãƒ‰ãƒ¡ã‚¤ãƒ³å‘ã‘ã®è¨¼æ˜Žæ›¸2458ä»¶ãŒè¦‹ã¤ã‹ã£ãŸã¨ç™ºè¡¨ã—ãŸã€‚ Googleã¯ã“ã†ã—ãŸSymantecã®å¯¾å¿œ
limitusus 2015/11/03
Certificate Transparencyã®ç¾©å‹™ä»˜ã‘ã‹

Google

security

Symantec

TLS
ãƒªãƒ³ã‚¯
SSL Labs - Projects / Public SSL Server Database - SSL Server Test
This free online service performs a deep analysis of the configuration of any SSL web server on the public Internet. Please note that the information you submit here is used only to provide you the service. We don't use the domain names or the test results, and we never will.
limitusus 2015/09/08
ssl

security

web

service
ãƒªãƒ³ã‚¯
Security/Server Side TLS - MozillaWiki
The ordering of cipher suites in the Old configuration is very important, as it determines the priority with which algorithms are selected. OpenSSL will ignore cipher suites it doesn't understand, so always use the full set of cipher suites below, in their recommended order. The use of the Old configuration with modern versions of OpenSSL may require custom builds with support for deprecated ciphe
limitusus 2015/09/07
server

security

apache

tls
ãƒªãƒ³ã‚¯
https://jp.techcrunch.com/2015/02/11/20150210take-googles-security-checkup-get-2gb-of-free-google-drive-space/
limitusus 2015/02/12
Google

security
ãƒªãƒ³ã‚¯
conma.me
This domain may be for sale!
limitusus 2015/01/23
AWS

security
ãƒªãƒ³ã‚¯
å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸æ”¹ã–ã‚“ã«é–¢ã™ã‚‹ãŠè©«ã³ã¨ã”å ±å‘Š | gihyo.jp
å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«ãŠã„ã¦ã€2014å¹´12æœˆ6æ—¥11æ™‚ï½ž14æ™‚ã®ã‚ã„ã ã€ç¬¬ä¸‰è€…ã‹ã‚‰ã®ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã‚ˆã‚Šã‚µã‚¤ãƒˆãŒæ”¹ã–ã‚“ã•ã‚Œã¦ã„ãŸäº‹ãŒåˆ¤æ˜Žã„ãŸã—ã¾ã—ãŸã€‚ã”åˆ©ç”¨é ‚ã„ã¦ãŠã‚Šã¾ã™ãƒ¦ãƒ¼ã‚¶ã®çš†ã•ã¾ã«ãŠã‹ã‚Œã¾ã—ã¦ã¯ã”è¿·æƒ‘ã‚’ãŠæŽ›ã‘ã„ãŸã—ã¾ã—ã¦ã€æ·±ããŠè©«ã³ç”³ã—ä¸Šã’ã¾ã™ã€‚ ãªãŠã€ç¾åœ¨ã¯è¢«å®³ã‚’å—ã‘ãŸã‚µãƒ¼ãƒã¯å¾©æ—§ä½œæ¥ã‚’å®Ÿæ–½æ¸ˆã¿ã§ã™ã€‚ã”åˆ©ç”¨ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®çš†ã•ã¾ã®å€‹äººæƒ…å ±æµå‡ºç‰ã¯ã€ç¾åœ¨ã®ã¨ã“ã‚ç¢ºèªã•ã‚Œã¦ãŠã‚Šã¾ã›ã‚“ã€‚ è¢«å®³å¯¾è±¡ã‚µã‚¤ãƒˆï¼ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ URLï¼šhttp://gihyo.jp æ”¹ã–ã‚“å†…å®¹ã¨ãã®å½±éŸ¿ ã‚µãƒ¼ãƒã®ä¸èº«ã‚’å…¥ã‚Œæ›¿ãˆã‚‰ã‚Œã€å¤–éƒ¨ã®ã‚µã‚¤ãƒˆã«ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã•ã‚Œã‚‹ã‚ˆã†ã«è¨å®šã•ã‚Œã¦ã„ãŸã€‚ ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã•ã‚Œã¦ã„ãŸã‚µã‚¤ãƒˆï¼ˆã‚¢ã‚¯ã‚»ã‚¹ã—ãªã„ã‚ˆã†ã”æ³¨æ„ãã ã•ã„â ï¼‰â www.koushin-lawfirm.net live.livelistingreport.com ç¾åœ¨æŠŠæ¡ã—ã¦ã„ã‚‹æ”¹ã–ã‚“ã•ã‚Œã¦ã„ãŸå¯èƒ½æ€§ãŒã‚ã‚‹æœŸé–“ 2014å¹´12æœˆ6æ—¥
limitusus 2014/12/08
security

gihyo
ãƒªãƒ³ã‚¯
Linux ã‚µãƒ¼ãƒã® SSH èªè¨¼ã‚’ Google Authenticator å¯¾å¿œã«ã—ã‚ˆã† (CentOS 5.6) - Kenichi Maehashi's Blog
Google Apps ã§åˆ©ç”¨å¯èƒ½ã«ãªã£ã¦ã„ã‚‹ Google Authenticator ã«ã‚ˆã‚‹ 2 è¦ç´ èªè¨¼ã§ã™ãŒã€å®Ÿã¯ PAM ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãŒã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã§å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’åˆ©ç”¨ã—ã¦ã€SSH ã‚µãƒ¼ãƒã‚’ Google Authenticator ã«ã‚ˆã‚‹ 2 è¦ç´ èªè¨¼ã«ã—ã¦ã¿ã¾ã—ã‚‡ã†ã€‚ ãƒ¡ãƒªãƒƒãƒˆå˜ä¸€ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã§ã¯ãªããƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ + ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰(ç¢ºèªã‚³ãƒ¼ãƒ‰) ã® 2 è¦ç´ ã§èªè¨¼ã™ã‚‹ãŸã‚ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰æ¼æ´©æ™‚ã‚„ãƒ–ãƒ«ãƒ¼ãƒˆãƒ•ã‚©ãƒ¼ã‚¹æ”»æ’ƒã«å¯¾ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¾µå®³ãƒªã‚¹ã‚¯ãŒä½Žããªã‚Šã¾ã™ã€‚iPhone ã‚„ Android ãªã©ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã§ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ç”Ÿæˆã§ãã‚‹ãŸã‚ãŠæ‰‹è»½ã§ã™ã€‚ æ³¨æ„ç‚¹PAM ã‚’ä½¿ç”¨ã—ã¦èªè¨¼ã™ã‚‹ãŸã‚ã€å…¬é–‹éµ + ç¢ºèªã‚³ãƒ¼ãƒ‰ã® 2 è¦ç´ èªè¨¼ã«ã¯ã§ãã¾ã›ã‚“ (å…¬é–‹éµã®ã¿ã®èªè¨¼ã¯å¼•ãç¶šãå¯èƒ½ã§ã™)ã€‚ å°Žå…¥æ‰‹é †ä»¥ä¸‹ã¯ã™ã¹ã¦ root ã‚’æƒ³å®šã—ãŸä½œæ¥ã§ã™ã€‚ç’°å¢ƒã«
limitusus 2014/10/10
Google

Security

authentication
ãƒªãƒ³ã‚¯
ãƒ¤ãƒ•ãƒ¼ã‚¸ãƒ£ãƒ‘ãƒ³ã€ç·å‹™çœã«ãƒ‘ãƒ–ã‚³ãƒ¡ã‚’å‡ºã™ã‚‚æ¿€ã—ãå…¨å¦å®šã•ã‚Œãƒãƒƒãƒˆã§ã‚‚åå—ç ²ç«ã‚’æµ´ã³ç‚Žä¸Š(å±±æœ¬ä¸€éƒŽ) - å€‹äºº - Yahoo!ãƒ‹ãƒ¥ãƒ¼ã‚¹
limitusus 2014/07/21
ã‚µãƒ¼ãƒ“ã‚¹

security

privacy
ãƒªãƒ³ã‚¯
1 2 3 4 æ¬¡ã®ãƒšãƒ¼ã‚¸