Internes

I have been fed up with my old Wordpress-based blog for quite some time now. One factor might be the missing updates, but another issue was Wordpress (WP) itself. Sure, WP looks like a simple solution, if all you want is have a blog with some usable tools around it.

Just as a quick note here:

I originally planned to do my third part on DNSSEC with configuration hints using the popular DNS server BIND. At the moment I also use BIND for my setup.

Now I discovered the “Advanced Secuity Notifications” at ISC, which sells prior warnings about security issues in BIND. Personally, I don’t want to support this model.

Instead I am currently migrating to another DNS server implemenation, YADIFA, which I will then write about. But first I need to check my setup using this server.

As I already explained in Part 1, the current state of DNS is pretty insecure. The goal of DNSSEC is to improve this situation. Here is how that (should) work. I won’t go into cryptographic details here, but just show the general behaviour.

DNS is probably one of the most important protocols on the internet. Everybody uses it countless times each day, usually without even noticing it. Every time somebody visits any website, every time somebody sends a mail, every time somebody wants to do literallly ANYTHING on the internet, a DNS server is involved.

For some time now, I haven’t been writing here. But since I was asked how the story about my notebook ended, I thought I should post an update here. Yes, I got my notebook back. It’s been three month now, that I have been using it, and everything seems to be fine. I wasn’t sure about that, when I received the package, so I documented every step of unboxing. 😉

It looks like the DHL managed to pull my notebook back out of the lava pit it fell into. I received a mail from Lenovo that my notebook was returned to them, due to a wrong address. I phoned them and they sent it again.

Last year, around the end of March, I bought my new Laptop. I wanted a small device with a 11inch screen but with still a bit of punch so I was looking for a 4th generation i5 or i7 and 8GB of ram at least. I was searching for some time and all I came up with was the Apple MacBook Air 11. Ethically I can’t support buying Apple devices, so this was no real option, though I was damn near buying one nonthetless.

Nachdem ich im Dezember schonmal von meinem kaputten Mainboard geschrieben habe, hier mal das Update wie es um den Service steht: Ich bin mir sicher, dass der Servicepartner vor Angst schlottert. Schon die zweite automatische Mahnung. Das einzige was ich auch diesem System erfahre ist, dass wohl um 4:30 der Cron-Job die automatischen Mahnungen erzeugt. Sicherlich gibt es einen Grund warum ein Mainboard nach über einem Monat noch nicht repariert ist, aber dann wäre es auch schön, den zu erfahren.

Zum Thema SSL-Zertifikate heute nur mal ein kleiner Link zu Fefe: https://blog.fefe.de/?ts=b25933c5 Ist zwar vier Jahre alt, gilt aber immernoch uneingeschränkt, wenn nicht gar noch mehr.

Statt nur das Serverzertifikat zu wechseln habe ich gleich auch den Webserver von Apache auf Nginx umgestellt. Dabei interessiert mich die angebliche bessere Performance nur nebenbei, mir ging es um die bessere Unterstützung von TLS Ciphers.