Firefox 的 Headless 模式

Google Chrome 推出 Headless 模式後,Firefox 也推出了:「Headless mode」。

目前正式版是 55 版,只有 Linux 版本有支援,下一個版本 56 版就會包括 Windows 與 Mac 了:

Headless Firefox works on Fx55+ on Linux, and 56+ on Windows/Mac.

然後大家也都是以 Selenium 為重心,所以使用上應該不會是大問題...

Vim 的 Easy Mode

Twitter 上看到 Vim 的 Easy Mode 是無法直接用 :q! 直接離開的,對於用 Vim 用很久的人反而不知道怎麼辦 XDDD:

因為知道是 -y,所以查了 manual 後發現是 easy mode。有了關鍵字後解法就很好找了,是「How to quit vim's easy mode (vim -y)」這篇,先用 Ctrl-L 回到 Normal Mode 再用 :q! 離開...

Firefox 在 56 也要支援 Headless 模式

Google Chrome 出了以後 Firefox 決定要跟著出的感覺?慢了好幾拍...:「Support headless mode on Windows」。

目前 stable 版是 54.0,所以再兩個 release cycle 就會看到了... 這樣就有兩個有支援 headless 模式的瀏覽器 (而且底層 engine 不一樣) 可以測試了。現在要測的人可以在 nightly 裡看到了。

OpenSSL 1.1.1 將支援 TLS 1.3

OpenSSL 的文章「Using TLS1.3 With OpenSSL」提到了:

The forthcoming OpenSSL 1.1.1 release will include support for TLSv1.3.

另外也提到了 TLS 1.3 的標準是 blocker,在 TLS 1.3 沒出來前不會出 OpenSSL 1.1.1:

OpenSSL 1.1.1 will not be released until (at least) TLSv1.3 is finalised.

OpenSSL 實做的 TLS 1.3 支援了這些 cipher:

  • TLS13-AES-256-GCM-SHA384
  • TLS13-CHACHA20-POLY1305-SHA256
  • TLS13-AES-128-GCM-SHA256
  • TLS13-AES-128-CCM-8-SHA256
  • TLS13-AES-128-CCM-SHA256

GCM 的部份不算意外,比較特別的是包括了 ChaCha20Poly1305 (喊很久了),另外包括了 CCM mode 的實做...

Google Chrome 的 Headless 模式與 PhantomJS 的歷史

瀏覽器的 headless 模式讓開發者可以透過 command line 或是 API 界面操作,對於自動化開發測試很有用。而 Google Chrome 將在 59 版 (目前 57 版) 引入 headless 模式:「Headless mode」。

Headless mode allows running Chromium in a headless/server environment. Expected use cases include loading web pages, extracting metadata (e.g., the DOM) and generating bitmaps from page contents -- using all the modern web platform features provided by Chromium and Blink.

To use headless, start Chrome with a command line flag:

$ chrome --headless --remote-debugging-port=9222 https://chromium.org

PhantomJS 則是因為 Google Chrome 決定要支援 headless 模式,主要的貢獻者 Vitaly Slobodin (參考 Contributors to ariya/phantomjs 這邊) 決定退出維護:「[Announcement] Stepping down as maintainer」。

是個功成身退的感覺...

Mac 上的 Cleartext

看到 Mac 上的「Cleartext」這個軟體:

A text editor that only allows the 1,000 most common words in English

限制你使用比較簡單的英文,這樣可以讓讀的人比較容易了解 (尤其是非母語的人)。

有種跟 Simple English Wikipedia 的想法很像的感覺:

The project uses around 2,000 common English words, and is based on Basic English, an 850-word auxiliary international language created by Charles Kay Ogden in the 1920s.

另外還有提供 Trump mode XDDD:

Trained with a few of Trump's best known speeches, the app is now ready to help you write like a billionaire.

這好壞 XDDD

Google 加倍對 Chromebook 訪客模式的攻擊獎金

Google 決定加倍對 Chromebook 訪客模式下攻陷系統的獎金:「After 0 successful submissions, Google doubles top reward for hacking a Chromebook to $100,000」。

原先是五萬美金:

Last year, Google introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. The company’s security team says it hasn’t received a single successful submission.

提升到十萬美金:

As such, Google has doubled the bounty, which was already the top Chrome reward, to $100,000. The company really wants someone to hack Chrome OS to pieces. “That said, great research deserves great awards, so we’re putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool,” Google declared.

讓 nginx 看到 5xx 回應時,去另外一台有開 debug-mode 的 server 上再跑一次

Debug 模式會比一般的模式來的慢,但可以看到更多資訊。以往的問題是 5xx 難以重製,而 NGINX 的「Capturing 5xx Errors with a Debug Server」這篇文章介紹了如何用 nginx 實作標題的功能。

如果是隨機造成的問題就沒辦法重製,但如果是 client 的狀態造成的問題,就很有可能可以抓出來... 不是解決所有問題,但可以幫助解掉以前不太好解的狀況。

Amazon 之前放出的 s2n 的安全性問題

Amazon 之前放 s2n 出來當作 TLS protocol 的方案,於是就有人摸出東西來:「Lucky Microseconds: A Timing Attack on Amazon's s2n Implementation of TLS」。

即使是經過外部資安檢證,仍然還是有找到問題。這次找到的問題是 timing attack 類在 CBC-mode 下的 plaintext recovery:

At the time of its release, Amazon announced that s2n had undergone three external security evaluations and penetration tests. We show that, despite this, s2n - as initially released - was vulnerable to a timing attack in the case of CBC-mode ciphersuites, which could be extended to complete plaintext recovery in some settings.

攻擊分成兩個階段:

Our attack has two components. The first part is a novel variant of the Lucky 13 attack that works even though protections against Lucky 13 were implemented in s2n. The second part deals with the randomised delays that were put in place in s2n as an additional countermeasure to Lucky 13. Our work highlights the challenges of protecting implementations against sophisticated timing attacks.

最後還是酸了一下 Amazon:

It also illustrates that standard code audits are insufficient to uncover all cryptographic attack vectors.

Amazon 的官方說明則在「s2n and Lucky 13」這邊可以看到。