Skip to content
This repository was archived by the owner on Nov 6, 2023. It is now read-only.
This repository was archived by the owner on Nov 6, 2023. It is now read-only.

Audit CACert rulesets #9582

Closed
Closed
Audit CACert rulesets#9582
Labels
good volunteer task

Description

@J0WI
J0WI
opened on Apr 18, 2017

Since Let's Encrypt has been launched some platform="cacert" may need an update to be enabled for all users.

Activity

  1. J0WI
    added
    good volunteer task
    on Apr 18, 2017

  2. clairew commented on Apr 18, 2017

    @clairew
    clairew
    on Apr 18, 2017

    Hi @J0WI, this is my first time contributing to open source. Would like some pointers on how to get started with this task! Could you elaborate? Thank you so much, and sorry if I'm asking for a lot of details.

  3. J0WI commented on Apr 18, 2017

    @J0WI
    J0WI
    on Apr 18, 2017
    ContributorAuthor

    Thanks for picking up this task!
    First I recommend to read our CONTRIBUTING.md. We have some quality standards for rulesets.

    Then you can choose any ruleset that contains platform="cacert". If the ruleset already uses our current code style, you can just update it. If not, you need to rewrite those parts to pass our automated tests.
    Toofishes.net.xml seems to be an easy one to start with.

    Please use a separate branch/PR for each ruleset if they are not related.

  4. clairew commented on Apr 18, 2017

    @clairew
    clairew
    on Apr 18, 2017

    Thanks for the pointers!

  5. cschanaj commented on Apr 18, 2017

    @cschanaj
    cschanaj
    on Apr 18, 2017
    Collaborator

    I have made a very simple script on GIST to test the hosts in cacert rulesets. (since the script is so simple, I will assume there are false results). thanks.

    Out of 105 cacert rulesets, I suspect that 69 of them can be enabled (after auditing, of course) for all users.

    List (Audit required)

    Updated: 2017.05.11

    List (HSTS, CANNOT be preloaded)

    Remark: Strict-Transport-Security: max-age >= 10886400; includeSubDomains

    List (HSTS, CANNOT be preloaded)

    Remark: Strict-Transport-Security: max-age < 10886400; includeSubDomains

    List (GONE from DNS)

    Remark: For all subdomains generated by Sublist3r, based on https://dns.google.com

  6. Bisaloo commented on Apr 18, 2017

    @Bisaloo
    Bisaloo
    on Apr 18, 2017
    Collaborator

  7. Bisaloo commented on Apr 18, 2017

    @Bisaloo
    Bisaloo
    on Apr 18, 2017
    Collaborator

    @cschanaj, could you update your comment as a checkbox list to coordinate our efforts, please?

  8. Bisaloo commented on Apr 20, 2017

    @Bisaloo
    Bisaloo
    on Apr 20, 2017
    Collaborator

    chaox.net is weird. I think it's a private server (subdomains have the name of common services : git, mumble, imap, smtp, vpn, wiki, ssh, deluge, etc.) and most subdomains redirect to a bogus page for external IPs.

    What should be done in this case? This ruleset will most likely have zero use.

  9. cschanaj commented on Apr 20, 2017

    @cschanaj
    cschanaj
    on Apr 20, 2017
    Collaborator

    I have a similar question too. Some of the above sites like ip0.eu serves little to no content and most of its sub-domains simply perform redirections. I see little values of it to most of our user since ip0.eu is not even on top-1m list. Personally, I prefer a rm over update the ruleset, is there any instruction on site like this? Maybe this is related to HTTPS Everywhere coverage?

  10. cschanaj commented on May 8, 2017

    @cschanaj
    cschanaj
    on May 8, 2017
    Collaborator

    P.S. I would like to run the newly modified script after the more related PRs are merge, please do not close this immediately. thanks!

  11. cschanaj commented on May 11, 2017

    @cschanaj
    cschanaj
    on May 11, 2017
    Collaborator

    I have updated the audit list against the current master. Only 8 more ruleset require an audit according to the script I use. thanks.

  12. Bisaloo commented on May 12, 2017

    @Bisaloo
    Bisaloo
    on May 12, 2017
    Collaborator

    fr33tux.org is soon to be preloaded.

    https://hstspreload.org/?domain=fr33tux.org

  13. cschanaj commented on May 30, 2017

    @cschanaj
    cschanaj
    on May 30, 2017
    Collaborator

    I would like to note that issue can be closed once the pending PRs #9707, #9767, #7937 and #10069 are merged. Thanks.

  14. Bisaloo commented on Jun 2, 2017

    @Bisaloo
    Bisaloo
    on Jun 2, 2017
    Collaborator

    Found with:

    grep -F 'target host="*.' $(grep -l 'platform="cacert"' *.xml)

  16. J0WI commented on Jun 15, 2018

    @J0WI
    J0WI
    on Jun 15, 2018
    ContributorAuthor

    Looks like this is done 🎉

  17. J0WI
    closed this as completedon Jun 15, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    good volunteer task

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions