The Curious Engineer

All blogs / Security

Andrew Ayer

agwa.name/blog

SecurityNetworkingGo

’15’20’25
Posts
86 from 8 Nov 2012 to 6 Oct 2026
Posting
monthly (7 in the last year)
Kind
personal blog
Feed
https://www.agwa.name/blog/feed

2026 4

  1. sourcespotter-authorize: Monitor Your Go Modules for Malicious Versions, Without the Noise
  2. macOS Can't Clone "Dumb" Git Repositories Over HTTP/2
  3. FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies
  4. Why IP Address Certificates Are Dangerous and Usually Unnecessary

2025 5

  1. Certificate Authorities Are Once Again Issuing Certificates That Don't Work
  2. Google Just Suspended My Company's Google Cloud Account for the Third Time
  3. Older Posts
  4. I'm Independently Verifying Go's Reproducible Builds
  5. SQLite's Durability Settings are a Mess

2023 6

  1. The Story Behind Last Week's Let's Encrypt Downtime
  2. The Difference Between Root Certificate Authorities, Intermediates, and Resellers
  3. The SSL Certificate Issuer Field is a Lie
  4. Popular
  5. Older Posts
  6. whoarethey: Determine Who Can Log In to an SSH Server

2022 6

  1. No, Google Did Not Hike the Price of a .dev Domain from $12 to $850
  2. Checking if a Certificate is Revoked: How Hard Can It Be?
  3. Parsing a TLS Client Hello with Go's cryptobyte Package
  4. How I'm Using SNI Proxying and IPv6 to Share Port 443 Between Webapps
  5. Older Posts
  6. Comcast Shot Themselves in the Foot with MTA-STS

2021 2

  1. It's Now Possible To Sign Arbitrary Data With Your SSH Keys
  2. How Certificate Transparency Logs Fail and Why It's OK

2020 10

  1. Security Vulnerabilities in Smallstep PKI Software
  2. The Lengths People Go To Just To Avoid DNSSEC
  3. Older Posts
  4. Writing an SNI Proxy in 115 Lines of Go
  5. Security Review of CFSSL Signer Code
  6. Fixing the Breakage from the AddTrust External CA Root Expiration
  7. Short Take: Why Trust-On-First-Use Doesn't Work (Even for SSH)
  8. When Will Your DNS Record Be Published?
  9. Older Posts
  10. This Is Why You Always Review Your Dependencies, AGPL Edition

2019 3

  1. Preventing Server Side Request Forgery in Golang
  2. Programmatically Accessing Your Customers' Google Cloud Accounts (While Avoiding the Confused Deputy Problem)
  3. MTA-STS is Hard. Here's how DNS Providers Can Make it Awesome With Automation...

2018 5

  1. Older Posts
  2. Comments
  3. Comments
  4. Google's Certificate Revocation Server Is Down - What Does It Mean?
  5. audit transparency logs

2017 3

  1. Why Man-in-the-Middle Detection is Overrated
  2. Older Posts
  3. I called out last September as evidence of systemd's poor security hygiene

2016 3

  1. Systemd is not Magic Security Dust
  2. WTF moment with revocation
  3. Comments

2015 6

  1. Thoughts on the Systemd Root Exploit
  2. Older Posts
  3. Comments
  4. Comments
  5. Hardening OpenVPN for DEF CON
  6. How to Responsibly Publish a Misissued SSL Certificate

2014 11

  1. Renewing an SSL Certificate Without Even Logging in to My Server
  2. CloudFlare: SSL Added and Removed Here :-)
  3. Older Posts
  4. Comments
  5. STARTTLS Considered Harmful
  6. Comments
  7. Titus isolation techniques continued
  8. xbox.com IPv6 Broken, Buggy DNS to Blame
  9. previous blog post
  10. Older Posts
  11. Responding to Heartbleed: A script to rekey SSL certs en masse

2013 7

  1. Comments
  2. ICMP Redirect Attacks in the Wild
  3. Older Posts
  4. Running a Robust NTP Daemon
  5. GCC's Implementation of basic_istream::ignore() is Broken
  6. Comments
  7. Easily Running FUSE in an Isolated Mount Namespace

2012 7

  1. Insecure and Inconvenient: Gmail's Broken Certificate Validation
  2. Older Posts
  3. Comments
  4. Working Around the HE/Cogent IPv6 Peering Dispute
  5. Security Pitfalls of setgid Programs
  6. FUSE's nonstandard semantics can cause problems with rsync-based backups
  7. Remote SSH Commands and Broken Connections

Undated 8

  1. Here's the complete Go source code
  2. see here for the implementation of isPublicIPAddress
  3. drop-in token source type
  4. adaptable example of how to use it
  5. Route
  6. here's the resulting CSR
  7. here's the corresponding certificate
  8. non-member function implementation