Timlukas Bloch Timi7007

CAA Adoption Notes

CA/B mandate

The CA/Browser Forum has voted to mandate that CAs must start checking CAA records to control certificate issuance (to verify what CAs are allowed to issue certificates for a domain) by September 8th, 2017.

https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum

Full language of the ballot is here.

How to export and rehost your Tumblr site

(Update: Version 3.2.0 of Jekyll looks like it's breaking a few things, so I've changed the guide to make you specifically install the version I was using, 3.1.3. I believe this is the issue: jekyll/jekyll#5145.)

You will be using jekyll-import to export your Tumblr site, Jekyll to (re)create it, and Surge to rehost it.

Update: You can also use Tumblr's native export feature in your blogs' individual settings. But rehosting that might be tricky. Read my comments below this post for how that works.

Setup and installation

Don't use VPN services.

No, seriously, don't. You're probably reading this because you've asked what VPN service to use, and this is the answer.

Note: The content in this post does not apply to using VPN for their intended purpose; that is, as a virtual private (internal) network. It only applies to using it as a glorified proxy, which is what every third-party "VPN provider" does.

A Russian translation of this article can be found here, contributed by Timur Demin.
A Turkish translation can be found here, contributed by agyild.
There's also this article about VPN services, which is honestly better written (and has more cat pictures!) than my article.

Configuring nginx for SSL SNI vhosts

Gotchas

Note that SHA2 hash algorithm may be not supported on older systems (Windows XP, Windows 2003, among others).
Be aware that mandatory https on SNI vhosts eliminate [Internet Explorer on Windows XP, among others] (http://en.wikipedia.org/wiki/Server_Name_Indication#Web_browsers.5B6.5D).

Remarks

My version of konklones SSL config does not have SPDY support(my nginx+openssl does not support it)
You need a default ssl server (example.org-default.conf).
Some SSL-options have to be unique across your instance, so it's easier to have them in a common file(ssl.conf).

	# HTTP Status Cats
	# Apache (htaccess) config originally created by @dave1010,
	# rebuilt by Sarah Pierce (see modifications section)
	# Licensed CC BY 2.0

	# Images CC BY 2.0, from GirlieMac's photostream:
	# http://www.flickr.com/photos/girliemac/sets/72157628409467125/with/6508023065/

	# Usage: copy save this file as .htaccess or add it to your httpd.conf

	#!/bin/bash

	# Raspberry Pi ZRAM script
	# Tuned for quad core, 1 GB RAM models
	# put me in /etc/init.d/zram.sh and make me executable
	# then run "sudo update-rc.d zram.sh defaults"

	modprobe zram
	echo 3 >/sys/devices/virtual/block/zram0/max_comp_streams
	echo lz4 >/sys/devices/virtual/block/zram0/comp_algorithm

	<!DOCTYPE html>
	<meta charset="utf-8">
	<style>

	.node {
	font: 300 11px "Helvetica Neue", Helvetica, Arial, sans-serif;
	fill: #bbb;
	}

	.node:hover {

	Disable vim automatic visual mode on mouse select

	issue: :set mouse-=a
	add to ~/.vimrc: set mouse-=a

	my ~/.vimrc for preserving global defaults and only changing one option:

	source $VIMRUNTIME/defaults.vim
	set mouse-=a

	#!/bin/sh -e
	hostname=$1
	device=$2
	file=$HOME/.dynv6.addr6
	[ -e $file ] && old=`cat $file`

	if [ -z "$hostname" -o -z "$token" ]; then
	echo "Usage: token=<your-authentication-token> [netmask=64] $0 your-name.dynv6.net [device]"
	exit 1
	fi

	#!/bin/bash

	# This script will stop the sks server, dump it's contents to
	# the $PREDIR, then restart the sks server.
	#
	# Matt Rude <[email protected]> PGP: 0xDD23BF73
	# URL: https://gist.github.com/mattrude/b0ac735d07b0031bb002

	SKSDATE=`date +%Y-%m-%d`
	USER="debian-sks"