undefined | Better HN

0 pointsLinuxBender4y ago0 comments

They have a good cert rating but ipv6 is not responding [1] and some clients will be denied based on cipher policy. I would be surprised if that applied to Chrome but one can always check. The DNS entry for ipv6 should be removed if not used.

[1] - https://www.ssllabs.com/ssltest/analyze.html?d=egbert.net&hi...

0 comments

10 comments · 2 top-level

egberts14y ago· 8 in thread

Thank you for the input. I really don’t care for Chrome users and their inability to do pure TLSv1.3. Also, my server decides the selection of algorithms in TLSv1.3, not the web browsers: and that’s ChaCha/Poly.

Yeah, it’s also a JS-free website.

Migration to IPv6 is a work-in-progress.

Hurricane Electric ISP also has a weird login condition; they want you to create a second account so you can pass your IPv6 certification (first was for DNS/IPv4). So I am looking for a secondary DNS provider for IPv6.

NavinF4y ago

Dude your config is FUBAR. Why enforce TLS1.3 when you don’t understand that the way cipher suites are negotiated changed in TLS 1.3?

> Also, my server decides the selection of algorithms in TLSv1.3, not the web browsers

SMH. Either use Caddy with an empty config file or follow Mozilla’s recommendation: https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&...

    # modern configuration
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

Also lol are you trying to host your site via HE’s free tunnel?

deburo4y ago

Would the cypher negotiation be the problem? I checked that Chrome supports Chacha/Poly, and it seems it does.

- https://chromestatus.com/feature/5355238106071040

Chrome seems to support TLS 1.3 since v70, and I'm on 99.

There's only the 0-RTT/EarlyData as far as I can tell that may be messing things up, is it required for TLS 1.3? It's not enabled by default yet (still in dev?).

- https://chromestatus.com/feature/5447945241493504

- https://developers.cloudflare.com/ssl/edge-certificates/addi...

1 more reply

egberts14y ago

FUBAR, in terms of speed, but of course.

because, TLSv1.3 negotiation capability is there.

My server dictates the selection, lest the client gets the sideway algo slip.

try it through your enterprise TLS transparent proxy.

also, no HE IPv6 tunnel.

lazyweb4y ago

> I really don’t care for Chrome users and their inability to do pure TLSv1.3.

You "don't really care" for a majority of users, based on what? TLS 1.2 is perfectly fine to use with strong ciphers. I salute your static website which is free of JS/cookies/bloat/external stuff (similar to my own blog), but at the same time you're actively sabotaging accessibility.

egberts14y ago

Not concerned with accessibility as opppsed to security.

If they are astute in cybersecurity, they will be using other (and secured) browsers.

1 more reply

LinuxBenderOP4y ago

also a JS-free website

That's great. I would love to see more JS-free sites and more lightweight sites.

tetromino_4y ago

> I really don’t care for Chrome users and their inability to do pure TLSv1.3.

I am confused why even provide a link to a website which is configured to be inaccessible to most readers. May as well say "My work: an unpublished manuscript; message me for a copy".

egberts14y ago

Because a real cybersecurity aficionado would use the right tools.

And my website is for those who do do use the right tools.

egberts14y ago

Knocked the IPv6 from its DNS records … for now.

j / k navigate · click thread line to collapse

0 comments

10 comments · 2 top-level

egberts14y ago· 8 in thread

Yeah, it’s also a JS-free website.

Migration to IPv6 is a work-in-progress.

NavinF4y ago

Dude your config is FUBAR. Why enforce TLS1.3 when you don’t understand that the way cipher suites are negotiated changed in TLS 1.3?

> Also, my server decides the selection of algorithms in TLSv1.3, not the web browsers

SMH. Either use Caddy with an empty config file or follow Mozilla’s recommendation: https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&...

    # modern configuration
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

Also lol are you trying to host your site via HE’s free tunnel?

deburo4y ago

Would the cypher negotiation be the problem? I checked that Chrome supports Chacha/Poly, and it seems it does.

- https://chromestatus.com/feature/5355238106071040

Chrome seems to support TLS 1.3 since v70, and I'm on 99.

There's only the 0-RTT/EarlyData as far as I can tell that may be messing things up, is it required for TLS 1.3? It's not enabled by default yet (still in dev?).

- https://chromestatus.com/feature/5447945241493504

- https://developers.cloudflare.com/ssl/edge-certificates/addi...

1 more reply

egberts14y ago

FUBAR, in terms of speed, but of course.

because, TLSv1.3 negotiation capability is there.

My server dictates the selection, lest the client gets the sideway algo slip.

try it through your enterprise TLS transparent proxy.

also, no HE IPv6 tunnel.

lazyweb4y ago

> I really don’t care for Chrome users and their inability to do pure TLSv1.3.

egberts14y ago

Not concerned with accessibility as opppsed to security.

If they are astute in cybersecurity, they will be using other (and secured) browsers.

1 more reply

LinuxBenderOP4y ago

also a JS-free website

That's great. I would love to see more JS-free sites and more lightweight sites.

tetromino_4y ago

> I really don’t care for Chrome users and their inability to do pure TLSv1.3.

I am confused why even provide a link to a website which is configured to be inaccessible to most readers. May as well say "My work: an unpublished manuscript; message me for a copy".

egberts14y ago

Because a real cybersecurity aficionado would use the right tools.

And my website is for those who do do use the right tools.

egberts14y ago

Knocked the IPv6 from its DNS records … for now.

j / k navigate · click thread line to collapse