Some Notes on the Machines

From the remarkable Tharin Brown:

https://transparencyreport.google.com/safe-browsing/search

Something new:

https://reep.io/

Possibly the best:

http://www.mediaelementjs.com/

Wonderful tool, cross-platform:

http://www.httrack.com

From the excellent Matt Quick:

http://www.netscantools.com/ssl-certificate-scanner-standalone.html

Favicons now come in many flavors. Here’s one web tool which handles it all.

https://realfavicongenerator.net/

This one courtesy of the amazing Mike Hunsinger.

1. Run the web site SSL test here, specifying the URL to study:

https://www.ssllabs.com/ssltest/

2. A rating of A through F, or T, will be reported. T means a fundamental problem with the certificate install itself.

An A rating means the server is set to only accept protocols such as TLS1.2, that are currently recognized as secure. Anything below an A rating means the server responded on SSL or other protocols considered insecure.

Scroll down on the SSL Labs rating page to see the technical details on what protocols were detected and which are failing security checks.

If this is a Windows web server, remote in and:

3. Download the portable app, IISCrypto from here:

https://www.nartac.com/Products/IISCrypto/Download

Run this program on the server which hosts the website.

You’ll get a window showing all protocols that are on this server and whether they’re enabled or not. To achieve an A rating, use the details view from SSL Labs as a guide. Disable any protocols in IIS Crypto that SSL Labs flags as a security risk. Only do these after verifying that the web site / web application will certainly work with the newest protocols and does not depend on the older ones.

The protocols that a Windows webserver will accept are specified via Regedit entries. IIS Crypto reads and modifies these Regedit entries automatically.

4. Reboot the webserver. Then retest with SSL Labs. Make further changes as dictated by the scoring detail.

5. If you have control over workstations, use Group Policy to deploy the certificate to all of them, and to disable insecure protocols, and to enable the secured protocols.

As of this writing (2017-05-16), the situation is in flux. Items:

• The historical closed-source uberstandard for both Java virtual machine and plugin, this being Oracle (originally Sun), is supporting plugins for its current version, 8, but has announced a ceasing of plugin support for 9.
• The open-source plugin standard, IcedTea, shows no signs of weakening, and works very well indeed with both Oracle’s Java and the open-source OpenJVM and others as well. However, no Windows porting is known to this author.
• Firefox and Chrome do not support Java in their current versions. There is an Extended Support Release version of Firefox which does, for a little while longer.
• Pale Moon, a very distinctive Mozilla/Firefox variant, is reported to support Java.
• Opera is reported to support the Oracle/Sun JVM only.
• Midori is reported to support both Oracle’s and IcedTea.

The author is working on practical tests of the last three.

The original “IE Tab” appears to work well with Windows 10. It has seen quite a lot of development over the years, and now includes a binary helper MSI:

https://chrome.google.com/webstore/detail/ie-tab/hehijbfgiekmjfkfjpbkbammjbdenadd

“IE Tab Multi” was recommendable for several years, but does not appear to work on 10:

https://chrome.google.com/webstore/detail/ie-tab-multi-enhance/fnfnbeppfinmnjnjhedifcfllpcfgeea

Vivaldi is looking very good so far, Windows Mac and Linux:

http://vivaldi.com

It is possibly the only browser for 32-bit Linux which will do Netflix and other DRM’d video. To do this, you need the ffmpeg codecs package and also widevine. For Netflix, you also need to start it like this (use vivaldi-snapshot if that’s what you have):

vivaldi-stable --user-agent='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36'

Vivaldi does not yet have built-in synchronization of bookmarks et cetera, but one can use the excellent EverSync to take good care of this, it also works amongst Firefox, Chrome, IE, Android, iOS, and even Windows phones.