CAA in internetstandard checks

The internet standards check at internet.nl has added a CAA check a while ago. Although the data for CAA has been in ShadowTrackr for years, it was still lacking on the internet standards overview and report. That is fixed now.

The current update also introduced the option to make a proper PDF export of the $dns_dependency_report. While this sounds like a small step, it's actually quite a thing. The code behind this opens the door to exporting all sorts of fancy graphs to PDFs.

New detections, and false positive CVE removed

The current update has more and better software detections, focussing mostly on webframeworks and remote login services.

Recently all vulnerabilities detected on certificates where included in the main vulnerability index. Some of you have noticed that CVE-2013-0169 (LUCKY13) appeared on quite a few webserver/certificates. You can prevent this by removing all CBC ciphers, but the truth is that about all webservers have fixed this vulnerability years ago and almost all instances where CVE-2013-0169 is found are false positives.

CVE-2013-0169 is now marked as false positive and does not appear in the vulnerability index anymore. It does still show on the certificate page with the notice that the webserver presenting the certificate is possibly vulnerable.

New group options, DNS dependency preview

For anyone using group accounts, you now have access to suggestions and events on the group level, meaning you can see and edit all of your suborganizations events and suggestions from the grouphome page. The overviews also show the organization names. To better enabled user management, you can now also see the last login time of users. A big thing for the coming year will be better graphs and reports, providing more actionable insights. The first one is in beta now:

$dns_dependency_report

This graph shows all your urls on the left, and your domain name servers on the right. This gives a very nice overview of how your DNS dependencies are. You can instantly spot the outliers, and see which domains depend on just a single provider.