Home » 2015 » February (Page 4)

記錄 Firefox/Chrome 在 TLS 的 Session Key 供 Wireshark 使用

以往要看 TLS traffic,需要用 mitmproxy 之類的軟體擋在中間,這需要在 client 端安裝對應的 CA root certificate。

而剛剛在「Decrypting TLS Browser Traffic With Wireshark – The Easy Way!」這篇文章裡面提到了如何讓 FirefoxChrome 記錄下 TLS 的 Session Key,然後倒給 Wireshark 使用。(文章裡有提到需要 dev 版本,不確定是因為新版支援的關係,還是這個功能限制在 dev 版才能用)

方法是在執行時設定 SSLKEYLOGFILE 這個環境變數,指定寫到某個檔案裡。不論是在 Windows & MacOSX & Linux 都一樣。

之後就可以把 Session Key 丟給 Wireshark 處理了,就像是這樣:(原文的範例)

ELB 預設關閉 RC4 Cipher

Twitter 上看到 Jeff Barr 轉貼自論壇的公告:「Announcement: Elastic Load Balancing releases security update to disable RC4」。

既有的 ELB 不受影響,不過官方還是建議把現有的 RC4 關閉。新開的 ELB 如果需要 RC4 也還是可以手洞開回來:

If you require RC4 ciphers you can re-enable them by selecting the 2014-10 SSL Security Policy or by manually configuring the SSL ciphers used by the load balancer.

關於 .onion SSL Certificate 的表決 (Tor Network)

關於 .onion 的 SSL Certificate,在 CAB Forum 這邊提出來表決了:「Ballot 144 – Validation rules for .onion names」。

有些時間限制與一般的 SSL Certificate 不太一樣:

CAs MUST NOT issue a Certificate that includes a Domain Name where .onion is in the right-most label of the Domain Name with a validity period longer than 15 months. Despite Section 9.2.1 of the Baseline Requirements deprecating the use of Internal Names, a CA MAY issue a Certificate containing an .onion name with an expiration date later than 1 November 2015 after (and only if) .onion is officially recognized by the IESG as a reserved TLD.


On or before May 1, 2015, each CA MUST revoke all Certificates issued with the Subject Alternative Name extension or Common Name field that includes a Domain Name where .onion is in the right-most label of the Domain Name unless the Certificate was issued in compliance with this Appendix F.


jQuery 官方在 2014 年的概況

在「jQuery Foundation 2014 Annual Report」這篇裡面有提到了 jQuery 在 2014 年的情況,其中 code.jquery.com 使用的頻寬這段還蠻有趣的:

If you need evidence that jQuery Foundation projects are used everywhere, look no further than our Content Delivery Network (CDN) powered by MaxCDN. The 290 billion requests in 2014 transferred nearly 11 petabytes of data. That, of course, does not include the requests for locally hosted copies of jQuery and to other CDNs such as Google, Microsoft, or CDNJS. No doubt the overall number of requests is in the trillions.

光是 code.jquery.com 每天的量平均就是 30TB,也就是平均流量 3Gbps?如果考慮到 Google 提供的平台更普及...

Google Chrome 將會用 HTTP/2 取代 SPDY

Google Chrome 將會在接下來幾個星期的 40 版支援 HTTP/2 (現在已經是 40 版了,所以照這個說法應該是 41 一定會有?),並且在 2016 年拿掉對 SPDY 的支援:「Hello HTTP/2, Goodbye SPDY」。

接下來又是大量的 migrate 了:

We plan to remove support for SPDY in early 2016, and to also remove support for the TLS extension named NPN in favor of ALPN in Chrome at the same time. Server developers are strongly encouraged to move to HTTP/2 and ALPN.

在「Implementations」這邊可以看到 HTTP/2 支援的程度,包括了 client 與 server 的部份。