How we brought HTTPS Everywhere to the cloud (part 1)

CloudFlare's mission is to make HTTPS accessible for all our customers. It provides security for their websites, improved ranking on search engines, better performance with HTTP/2, and access to browser features such as geolocation that are being deprecated for plaintext HTTP. With Universal SSL or similar features, a simple button click can now enable encryption for a website.

Unfortunately, as described in a previous blog post, this is only half of the problem. To make sure that a page is secure and can't be controlled or eavesdropped by third-parties, browsers must ensure that not only the page itself but also all its dependencies are loaded via secure channels. Page elements that don't fulfill this requirement are called mixed content and can either result in the entire page being reported as insecure or even completely blocked, thus breaking the page for the end user.

What can we do about it?

When we conceived the Automatic HTTPS Rewrites project, we aimed to automatically reduce the amount of mixed content on customers' web pages without breaking their websites and without any delay noticeable by end users while receiving a page that is being rewritten on the fly.

A naive way Continue reading

Walk, Jog, Run: Getting Smarter About Docker

 

illustration-com-container-party.png

I’ve spent most of the summer traveling to and speaking at a lot of different trade shows: EMC World, Cisco Live!, VMworld, HP Discover, Dockercon, and LinuxCon (as well as some meetups and smaller gatherings). A lot of the time, I’m speaking to people who are just getting familiar with Docker. They may have read an article or have had someone walk into their office and say “This Docker thing, so hot right now. Go figure it out”.

Certainly there are a number of companies running Docker in production, but there are still many who are asking fundamental questions about what Docker is, and how it can benefit their organization. To help folks out in that regard, I wrote an eBook.

After someone gets a grasp on what Docker is, they tend to want to dive in and start exploring, but often times they aren’t sure how to get started.

My advice (based on the approach I took when I joined Docker last year) is to walk, jog, and then run:

Walk: Decide where you want to run Docker, and install it. This could be Docker for Mac, Docker for Windows, or just installing Docker on Linux. Continue reading

Docker Weekly Roundup | September 18, 2016

 

weekly-roundup.png

It’s time for your weekly roundup! Get caught up on the top Docker news including; how to maintain dev environments for Java web apps, scale with Swarm, and make your CI/CD pipeline work for you. As we begin a new week, let’s recap our top five most-read stories of the week of September 18, 2016:


Weekly #Roundup: Top 5 #Docker stories for the week 09/18/16
Click To Tweet

The post Docker Weekly Roundup | September 18, 2016 appeared first Continue reading

Companies say IoT matters but don’t agree how to secure it

A majority of enterprises say the internet of things is strategic to their business, but most still take a piecemeal approach to IoT security.Those results from a global IDC survey conducted in July and August reveal both the promise and the growing pains of IoT, a set of technologies that may help many industries but can’t simply be plugged in. The 27-country survey had more than 4,500 respondents, all from organizations with 100 or more employees.For 56 percent of enterprises, IoT is part of their strategic plans for the next two or three years, IDC analyst Carrie MacGillivray said on a webcast about the results. But the state of adoption varies widely among industries. Manufacturing companies are investing the most in the technology, with retail and financial services – especially insurance – also on the cutting edge.To read this article in full or to leave a comment, please click here

A robot fish is helping the Navy improve underwater movement

Oscar Curet is an assistant professor at Florida Atlantic University. For the past couple of years, he's studied the movement of the Knifefish, an animal native to the Amazon River, that uses a long ribbon fin to propel itself through the water and navigate its complex environment.  "As a engineer, we try to solve problems, and nature has solved some of the problems that we are facing, and one of them is mobility," Curet said. Curet, along with other researchers from Florida Atlantic University (FAU), has created a robot fish to identify the differences between engineering systems and what occurs in nature. The prototype is composed of 3D-printed materials, 16 motors, and a number of sensors. The team also recently received a grant from the U.S. Navy to equip their prototype with a Volumetric Particle Image Velocity System, or PIV. The system, which uses four cameras synchronized with a laser light to capture currents in three dimensions, will help researchers measure how fluid dynamics interact with the flexible propulsors the team has developed to make underwater vehicles more maneuverable. To read this article in full or to leave a comment, please click here

Cisco, IBM may be interested in buying Imperva

Security vendor Imperva is shopping itself around and may be attractive to the likes of Cisco and IBM, according to Bloomberg.The Motley Fool reports that Imperva’s stock rose 20% today after Bloomberg’s report, which the Fool notes could actually drive buyers away because it would mean a more costly deal.Bloomberg named a number of other possible buyers including Forecpoint (owned by Raytheon and Vista Equity Partners), Akamai and Fortinet.To read this article in full or to leave a comment, please click here

Cisco, IBM may be interested in buying Imperva

Security vendor Imperva is shopping itself around and may be attractive to the likes of Cisco and IBM, according to Bloomberg.The Motley Fool reports that Imperva’s stock rose 20% today after Bloomberg’s report, which the Fool notes could actually drive buyers away because it would mean a more costly deal.Bloomberg named a number of other possible buyers including Forecpoint (owned by Raytheon and Vista Equity Partners), Akamai and Fortinet.To read this article in full or to leave a comment, please click here

Best Deals of the Week, September 19th – September 23rd – Deal Alert

Best Deals of the Week, September 19th - September 23rd - Deal AlertCheck out this roundup of the best deals on gadgets, gear and other cool stuff we have found this week, the week of September 19th. All items are highly rated, and dramatically discounted!1 Free Amazon Echo Dot When You Buy 5Echo Dot is a hands-free, voice-controlled device that uses Alexa to play & control music (either on its own, or through a connected speaker/receiver), control smart home devices, provide information, read the news, set alarms, and more. If you’re looking to buy them as gifts, or for different homes or rooms, Amazon will throw in a free one ($50 value) when you buy 5, or two free ones when you buy 10 (a $100 value). To take advantage of this limited time offer, select 6 or 12 in the quantity dropdown and add to your Shopping Cart. Enter promo code DOT6PACK or DOT12PACK at checkout where you will see the discount applied. The new Amazon Echo Dot comes in black, and now also white.  See the new Amazon Echo Dot now on Amazon.To read this article in full or to leave a comment, please click here

Announcing the new Docs Repo on GitHub!

By John Mulhausen

The documentation team at Docker is excited to announce that we are consolidating all of our documentation into a single GitHub Pages-based repository on GitHub.

When is this happening?

  • The new repo is public now at https://github.com/docker/docker.github.io.
  • During the week of Monday, September 26th, any existing docs PRs need to be migrated over or merged.
  • We’ll do one last “pull” from the various docs repos on Wednesday, September 28th, at which time the docs/ folders in the various repos will be emptied.
  • Between the 28th and full cutover, the docs team will be testing the new repo and making sure all is well across every page.
  • Full cutover (production is drawing from the new repo, new docs work is pointed at the new repo, dissolution of old docs/ folders) is complete on Monday, October 3rd.

The problem with the status quo

  • Up to now, the docs have been all inside the various project repos, inside folders named “docs/” — and to see the docs running on your local machine was a pain.
  • The docs were built around Hugo, which is not natively supported by GitHub, and took minutes to build, and even longer for us Continue reading

Worth Reading: Organizational Doxing and Disinformation

In the past few years, the devastating effects of hackers breaking into an organization’s network, stealing confidential data, and publishing everything have been made clear. It happened to the Democratic National Committee, to Sony, to the National Security Agency, to the cyber-arms weapons manufacturer Hacking Team, to the online adultery site Ashley Madison, and to the Panamanian tax-evasion law firm Mossack Fonseca. —Schneier on Security

LinkedInTwitterGoogle+Facebook

The post Worth Reading: Organizational Doxing and Disinformation appeared first on 'net work.

Global Forum sharpens focus on smart cities

Eindhoven, Netherlands -- The 25th Global Forum, an annual policy and strategy conference sometimes called “the Davos of ICT,” was held this week in Eindhoven, a smart city and technology hub with a rich industrial past.Eindhoven was the original home and de facto company town of Philips Electronics, one of the world’s leading technology giants. Then, under pressure from Asian and global competitors, Philips began a long process of exiting its historic lines of business.Eindhoven suffered an economic and psychological blow when in 1997 the company moved its headquarters to Amsterdam.The resulting economic and social disruption challenged Eindhoven to reinvent itself. The community focused on research and innovation (R&I), and built upon its Philips legacy to become the industrial design center of its country and the European region.To read this article in full or to leave a comment, please click here

The next target for phishing and fraud: ChatOps

This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.Enterprise chat applications have surged in popularity, driven in large part by Slack, which now claims to serve more than three million users daily.  What’s more, the popularity of these apps has given rise to a new phenomenon known as ChatOps, which is what happens when these new messaging systems are used to automate operational tasks. The ChatOps term was coined by GitHub to describe a collaboration model that connects people, tools, processes and automation into a transparent workflow.  According to Sean Regan, Atlassian’s Head of Product Marketing for HipChat, this flow connects the work needed, the work happening and the work done in a consistent location staffed by people, bots and related tools.  Its transparent nature hastens the feedback loop, facilitates information sharing, and enhances team collaboration, but also ushers in a new set of challenges for securityand risk professionals.To read this article in full or to leave a comment, please click here

The next target for phishing and fraud: ChatOps

This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.Enterprise chat applications have surged in popularity, driven in large part by Slack, which now claims to serve more than three million users daily.  What’s more, the popularity of these apps has given rise to a new phenomenon known as ChatOps, which is what happens when these new messaging systems are used to automate operational tasks. The ChatOps term was coined by GitHub to describe a collaboration model that connects people, tools, processes and automation into a transparent workflow.  According to Sean Regan, Atlassian’s Head of Product Marketing for HipChat, this flow connects the work needed, the work happening and the work done in a consistent location staffed by people, bots and related tools.  Its transparent nature hastens the feedback loop, facilitates information sharing, and enhances team collaboration, but also ushers in a new set of challenges for securityand risk professionals.To read this article in full or to leave a comment, please click here

The next target for phishing and fraud: ChatOps

This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

Enterprise chat applications have surged in popularity, driven in large part by Slack, which now claims to serve more than three million users daily.  What’s more, the popularity of these apps has given rise to a new phenomenon known as ChatOps, which is what happens when these new messaging systems are used to automate operational tasks. 

The ChatOps term was coined by GitHub to describe a collaboration model that connects people, tools, processes and automation into a transparent workflow.  According to Sean Regan, Atlassian’s Head of Product Marketing for HipChat, this flow connects the work needed, the work happening and the work done in a consistent location staffed by people, bots and related tools.  Its transparent nature hastens the feedback loop, facilitates information sharing, and enhances team collaboration, but also ushers in a new set of challenges for securityand risk professionals.

To read this article in full or to leave a comment, please click here

If you’re not planning for IoT, you’re already behind

Roughly half of the audience informally polled at last month’s CIO 100 event said they had attended an IoT event in the last 12 months. "So what were the other half [of you] doing on the most hyped word on the internet today?" asked Vernon Turner, senior vice president of enterprise systems & fellow for the internet of things at IDC.To read this article in full or to leave a comment, please click here(Insider Story)

Dollar Shave Club grooming AWS cloud services for smoother growth

If you asked a CIO to sketch the ideal modern IT architecture on a few cocktail napkins, it might resemble the system fashioned by of the Dollar Shave Club (DSC), the men's grooming ecommerce company that ascended from relative obscurity to prominence thanks to sound branding and this memorable YouTube clip.Running in a public cloud, the startup uses 22 custom applications to run sales and marketing campaigns and customer service, as well as a recommendation engine. The custom-cloud combination embodies the type of IT environment CIOs say they would build if they had a green field devoid of legacy architecture and technical debt.To read this article in full or to leave a comment, please click here

Court ruling puts future of H-1B lottery in doubt

The U.S. government's attempt to stop a lawsuit challenging the legality of the H-1B lottery was rejected Thursday by a federal court judge.The government tried to get this case dismissed on legal technicalities but failed. U.S. District Court Judge Michael Simon, in Oregon, denied the government's dismissal motion in a 24-page ruling.This case may now be decided quickly. The plaintiffs are seeking a summary judgment with oral arguments schedule in December. If the summary judgment is granted, the lottery could end -- the plaintiffs hope -- as early as next year.The case was brought by Tenrec Inc., a web development firm, and Walker Macy LLC, a landscape architecture, urban design and planning firm. Both firms filed petitions to hire a person who needed an H-1B visa, but lost the lottery.To read this article in full or to leave a comment, please click here

NY regulation aims to raise bank security standards

Next week, New York State will begin a 45-day public comment period on its new financial industry cybersecurity regulation -- and, so far, security experts have a favorable view of the proposal.Under the new regulations, banks and insurance companies doing business in New York State will need to establish a cybersecurity program, appoint a Chief Information Security Officer and monitor the cybersecurity policies of their business partners.According to New York Gov. Andrew Cuomo, this is the first such regulation in the country. "This regulation helps guarantee the financial services industry upholds its obligation to protect consumers and ensure that its systems are sufficiently constructed to prevent cyber-attacks to the fullest extent possible," he said in a statement.To read this article in full or to leave a comment, please click here

NY regulation aims to raise bank security standards

Next week, New York State will begin a 45-day public comment period on its new financial industry cybersecurity regulation -- and, so far, security experts have a favorable view of the proposal.Under the new regulations, banks and insurance companies doing business in New York State will need to establish a cybersecurity program, appoint a Chief Information Security Officer and monitor the cybersecurity policies of their business partners.According to New York Gov. Andrew Cuomo, this is the first such regulation in the country. "This regulation helps guarantee the financial services industry upholds its obligation to protect consumers and ensure that its systems are sufficiently constructed to prevent cyber-attacks to the fullest extent possible," he said in a statement.To read this article in full or to leave a comment, please click here

1 … 2,595 2,596 2,597 2,598 2,599 … 3,788