[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150501213405.2b2aca2a@pc1>
Date: Fri, 1 May 2015 21:34:05 +0200
From: Hanno Böck <hanno@...eck.de>
To: mancha <mancha1@...o.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: On sanctioned MITMs
My quick take on this:
It is very common that when you run any kind of IT infrastructure that
you outsource some technical parts to third parties. Your security
relies on the question how trustworthy these third parties are.
I don't see anything special here with outsourcing your server's TLS
handling. Or anything special about cloudflare. When you outsource IT
infrastructure you trust someone.
Just a thought experiment that has nothing to do with CDNs or TLS: Most
medium or small Web services don't have their own datacenters. They have
servers - either rented or their own - in a datacenter run by someone
else. With physical access to the machine basically you can own them
completely. There's almost nothing you can do to secure a machine where
non-trustworthy people have physical access.
So I don't deny there are potential problems. But I don't see them as
new or special.
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
