Re: HSTS and expired cert: our site is down for now

Florent Daigniere <[email protected]> Thu, 06 Apr 2017 18:19:47 +0200
Newsgroups	gmane.network.freenet.devel
Message-ID	<[email protected]>
On Thu, 2017-04-06 at 15:08 +0000, Ian wrote:
>  Well, it's an improvement over what we have now even if it is
> incomplete :)
> Just for clarity, what is the procedure for deploying improvements?

Pushing them to the existing repository on a different branch. Travis
will auto-build/deploy from there if the build succeeds.

The list of authorized people/process hasn't changed; anyone not on the
list has to send a pull request.

> Now that it's live hopefully multiple people can fork it and start
> pushing improvements which we can review and merge.  
> We should have an approval process for it - it would be ideal if we
> had staging where changes could be reviewed live before being pushed
> to production.

That's the plan. When I get some time I will set it up (two branches,
deploying to two different buckets/FQDNs, like we used to have).

> Florent, if you won't have time to do anything for the foreseeable
> future, is there someone else familiar enough with how things are set
> up that they can work on it?

Right now there is still massive amounts of work to be done on the
content; IMHO a two step review process would be overkill for now...

> It would be well worth spending some of our funding to hire an AWS
> expert to ensure everything is set up nicely and minimize the risk of
> something like this happening in future.  I have a good guy in mind
> (used to work for Amazon so very familiar with AWS).
> Thoughts?

I don't think it would be. This happened because we weren't using AWS
yet. Our new setup is rock-solid and fairly standard: it's an S3 bucket
where the content is served by cloudfront.

Florent

> Ian.
> 
> 
> On Thu, Apr 6, 2017 2:49 AM, Florent Daigniere nextgens@freenetproject
> .org wrote:
> > I have made the DNS changes; these aren't the problem...
> > 
> > The problem is that the content we serve from the new infrastructure
> > isn't ready... almost a year in the making... so we have never
> > finished
> > the infrastructure switch.
> > 
> > Whatever is pushed to
> > https://github.com/freenet/website/tree/2016-redesign
> > will go live; both of you have access; if you care, fix it :)
> > 
> > I won't have time to do anything more for the foreseeable future.
> > 
> > Florent
> > 
> > On Thu, 2017-04-06 at 00:10 +0000, Ian wrote:
> > >  Crap, what are we waiting on to get it back up?
> > >
> > >
> > > On Wed, Apr 5, 2017 6:35 PM, Arne Babenhauserheide arne_bab-S0/[email protected]
> > > wrote:
> > > > Hi,
> > > >
> > > > The certificate expired and we use HTTP Strict Transport
> > Security
> > > > (HSTS). That means: Our old site is down until the DNS can be
> > > > switched
> > > > over to the AWS site.
> > > >
> > > > Let’s treat this as a test of what would happen if an attacker
> > were
> > > > to
> > > > take down our clearnet infrastructure.
> > > >
> > > > Best wishes,
> > > > Arne
> > > > --
> > > > Unpolitisch sein
> > > > heißt politisch sein
> > > > ohne es zu merken
> > > >
> > > >
> >
signature.asc (application/pgp-signature, 488 B)