I’ve tried the new short-lived (~6 days) Let’s Encrypt certificate with Caddy: https://cj.rs/blog/6days/, here are my first impressions.

💬 Feel free to comment here!

#blog #blogging #tls #security #LetsEncrypt #Caddy

I finally jotted down a table of in how far the big three browsers currently support RFC9460 HTTPS records.

In summary:
- All browsers support ALPN
- Safari has the best support; it's the only browser that supports AliasMode, but Safari doesn't support ECH
- Firefox requires DoH, but then supports several parameters
- Chrome only support ALPN and ECH

See this page for details, I may update it in the future:
https://www.netmeister.org/blog/https-caniuse.html

#dns

Reinventing PowerShell in C/C++: Bypassing Security Features

The article demonstrates creating a full PowerShell console using native C/C++ code, bypassing security features like AMSI and Constrained Language Mode.

https://blog.scrt.ch/2025/02/18/reinventing-powershell-in-c-c/

#PowerShell

@BjornW @letsencrypt They're a certificate authority. They don't actually get your private keys, there's no unique new risk to them.
One of the issues with the CA system is that you trust all of the CAs in your trust store for everything. So we already trust Apple, Amazon, .... (and that's a long list. 153 certs on my system).

Each CA in your trust store could create a certificate for any @letsencrypt protected website and have your browser accept it.

It doesn't actually matter (much) which CA you use, you're vulnerable to subversion of any CA in your trust store.

There's no additional risk here, realistically. We already only get the lowest common denominator security.