Plus Let's Encrypt's certificate validation mix-up, Intel's questionable new power supply design, and more.

Links:

• Let's Encrypt changes course on certificate revocation
• Revoking certain certificates on March 4
• Let's Encrypt: Incomplete revocation for CAA rechecking bug
• Pass authzModel by value, not reference
• The Complete Guide to CAA Records
• DNS Certification Authority Authorization
• AMD's 7nm Ryzen 4000 laptop processors are finally here
• How Intel is changing the future of power supplies with its ATX12VO spec
• Single Rail Power Supply ATX12VO Design Guide
• FreeNAS and TrueNAS are Unifying
• FreeNAS and TrueNAS are Unifying [Video Announcement]
• Ubuntu 20.04's zsys adds ZFS snapshots to package management
• ubuntu/zsys: zsys daemon and client for zfs systems

The history, the clients, and the from-the-field details you'll want to know.

Links:

• Let’s Encrypt and CertBot – JRS Systems
• Automatic Certificate Management Environment (ACME) — The surprisingly readable IETF draft.
• How It Works - Let's Encrypt
• ACME Client Implementations
• Certbot — Certbot is EFF's tool to obtain certs from Let's Encrypt.
• acme-nginx: python acme client for nginx — A particularly simple client that is useful for understanding the protocol details.
• Caddy - The HTTP/2 Web Server with Automatic HTTPS
• mod_md: Let's Encrypt (ACME) support for Apache httpd
• Traefik - The Cloud Native Edge Router
• Looking Forward to 2019 - Let's Encrypt — We’re now serving more than 150 million websites while maintaining a stellar security and compliance track record. Most importantly though, the Web went from 67% encrypted page loads to 77% in 2018, according to statistics from Mozilla. This is an incredible rate of change!
• Let's Encrypt ACME v2 API Announcements — Now that the draft standard is in last-call and the pace of major changes has slowed, we’re able to release a “v2” API that is much closer to what will become the final ACME RFC.
• Let's Encrypt disables TLS-SNI-01 validation — The researcher noticed that "at least two" large hosting providers host many users on the same IP address and users are able to upload certificates for arbitrary names without proving they have control of a domain.
• A Technical Deep Dive on Using Certbot to Secure your Mailserver from the EFF — With the most recent release of Certbot v0.29.1, we’ve added some features which make it much easier to use with both Sendmail and Exim.

Plus we discuss Let's Encrypt’s Wildcard support and explain what ACME v2 is.

Then we detail the bad position Samba 4 admins are in, and the real cause of these recent 1.7Tbps DDoS attacks.

Sponsored By:

• Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
• Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
• iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!

Links:

• Hardcoded Password Found in Cisco Software — Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password.
• Potent malware that hid for six years spread through routers — "The malware is highly advanced, solving all sorts of problems from a technical perspective and often in a very elegant way, combining older and newer components in a thoroughly thought-through, long-term operation, something to expect from a top-notch well-resourced actor."
• CVE 2018-1057: Authenticated Samba users can change other users' password — On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).
• CVE-2018-1057 - SambaWiki Workarounds — Revoke the change passwords right for 'the world' from all user objects (including computers) in the directory, leaving only the right to change a user's own password.
• ACME v2 and Wildcard Certificate Support is Live — We’re pleased to announce that ACMEv2 and wildcard certificate support is live!
• It just got much easier to wage record-breaking DDoSes — Within days of the new technique going public, security firms reported it being used in a record-setting 1.3 terabit-per-second DDoS against Github and then, two days later, a record-topping 1.7 Tbps attack against an unnamed US-based service provider.
• The real cause of large DDoS — All the gigantic headline-grabbing attacks are what we call "L3" (Layer 3 OSI[1]). This kind of attack has a common trait - the malicious software sends as many packets as possible onto the network.
• Project Nimble – Netflix TechBlog — We set ourselves an aggressive goal of being able to fail over traffic in less than 10 minutes.
• Follow Up: Alex has a tip for Alex
• Question: Oliver asks about a fail2ban replacement
• S3Scanner — Scan for open S3 buckets and dump
• Chromium is also a Snap