unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#47823: Hardenize Guix website TLS/DNS
@ 2021-04-16 11:00 bo0od
  2021-04-16 16:15 ` Leo Famulari
  2023-05-22  2:21 ` bug#47823: Website is fine Felix Lechner via Bug reports for GNU Guix
  0 siblings, 2 replies; 11+ messages in thread
From: bo0od @ 2021-04-16 11:00 UTC (permalink / raw)
  To: 47823

Hi There,

Scanning Guix website gave many missing security features which modern 
security needs them to be available:

* TLS and DNS:

looking at:

https://www.hardenize.com/report/guix.gnu.org/1618568751

https://www.ssllabs.com/ssltest/analyze.html?d=guix.gnu.org

- DNS: DNSSEC support missing (important)
- TLS 1.0 , 1.1 considered deprecated since 2020
- Allow TLS 1.3 as it helps with ESNI whenever its ready by openssl
- Use only secure ciphers, disable old ciphers
- Force redirection of insecure connection with plain text to TLS
- HSTS/HSTS-preload support missing (important)


* Web Application (Headers):

I think its self explanatory:

https://securityheaders.com/?q=https%3A%2F%2Fguix.gnu.org%2F&followRedirects=on

ThX!




^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2023-05-31 16:38 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-16 11:00 bug#47823: Hardenize Guix website TLS/DNS bo0od
2021-04-16 16:15 ` Leo Famulari
2021-04-16 21:36   ` Dr. Arne Babenhauserheide
2021-04-17  0:10   ` Julien Lepiller
2021-05-24 21:36     ` Marius Bakke
2021-05-25 12:51       ` bo0od
2021-05-25 13:45         ` Julien Lepiller
2021-05-25 16:37           ` bo0od
2023-05-22  2:21 ` bug#47823: Website is fine Felix Lechner via Bug reports for GNU Guix
2023-05-22  2:23   ` Felix Lechner via Bug reports for GNU Guix
2023-05-31 16:37     ` bo0od

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).