Nginx reverse proxy SSL security issue

Until today the example Nginx reverse proxy config for Etherpad allowed for weaker SSL encryption than is acceptable.

You can see if your instance is vulnerable by checking your instances SSL cert

Check your Nginx config to see if this line exists:

ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

If so replace with:

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 ECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

Restart Nginx then check your instances SSL cert

We updated the wiki to reflect this change.

Skype and Hangouts alternative

We’re tired of being spied upon and we’re tied of tech companies colluding.

With no sign of an end we think it’s time to take control.

So.. We’re Introducing an Etherpad instance to serve as an alternative to Microsoft Skype and Google Hangouts, we’re using it internally but we’re inviting you to try it out too for your own chats and let us know what you think..

Try out Vetherpad at https://v.etherpad.org/

Naturally no plugins or extensions are required, just a gool ‘ol modern browser..

Wanna host your own? Just install Etherpad and the webrtc plugin, it takes minutes then you will have your own secure, private video chat and document editing facilities.

Found a bug and wanna fix it? Awesome! We gots the bug trackers.

Looking to see what else Etherpad can do? Check out our beta instance..

Try out Vetherpad at https://v.etherpad.org/

Etherpad for the masses

Over time Etherpad has grown, it’s become more than we aimed for it to ever be with many large tech and activist organizations deploying their own instances. However, one problem we have is the ability for smaller organizations to easily roll their own Etherpad instance on the web.

Don’t get us wrong, there are some great services such as PrimaryPad that exist and cater for individual markets but we feel we feel that as a community we can provide a richer, more configurable service that contributes more back to our core open source project.

So we’re considering building an easy way to deploy a private Etherpad instance for your organization on Etherpad.com

We don’t know exactly how this Etherpad as a Service will look like, but we will probably take inspiration from WordPress.com

We want everything to be kept open source, not just what we choose to push back to the core project.

We want to provide confidence that activists groups anonymity and data will be kept safe.

We want to create an ecosystem that has some finance involved but we want to keep the uptake for small organizations costs at a minimum. We have a small pool of start-up funds available. We’re not sure yet how we will go about assigning stakeholders for this new venture.

Services we have been offered help with so far..

  • Hosting: Rackspace
  • SSL Certificates: GlobalSign
  • Automated Testing: SauceLabs
  • Etherpad Development: Etherpad Foundation (naturally)
  • Ticketing and Support: Primary Technology
  • Security Auditing: Mozilla
  • Translations: Wiki Media Foundation
  • Etherpad.com: Google

Services we’re looking for help with, maybe your organization can help?

  • Pen testing (Security penetration testing, ensuring our overall service is as safe as possible from attackers)
  • Marketing (Press release drafting, branding etc.)
  • Management and business strategy (Deciding the best approach for us to ensure we’re providing the best service)
  • Billing and Invoice handling (Allowing for simple online payments(including crypto-currencies), creating invoices and chasing them when they are unpaid)
  • Sales consultancy (Discussing payment options with potential and existing Etherpad.com users)
  • Data analysis(Looking at our collected stats/data and provide Management with decisions to help them improve their overall strategy)

Our big problem is going to be monetization. We have a few options we want to get your feedback on…

Charge per changeset: 1M or so changesets free then 0.001p per changeset after. We think this will confuse too many people and potentially scare people off using the service.
Flat fee per month: 1 month free then pay per month. We feel we can do better than this.
Free to use with micropayments for plugins: Something along the lines of $0.50 for each plugin you enable. We’re keen on this model as it funds new plugin development.
Ad supported: We’re not overly keen on spamming your page with ads, we think it devalues the service.
Pay per user: Monthly Micro payment for each user account you add / uses Etherpad.
A choice of any of the above: This may be the most complex model for us to achieve technically but it might be the best for large and small organizations as they will be able to switch between payment options to secure the best deal for them.

So that’s our general goal, to create an ecosystem around Etherpad development to encourage more developers to take up Etherpad as their full time development job and to empower smaller organizations will the ability to quickly throw their own Etherpad instance up on the Web so they are in control.

Please do let us know your thoughts, we appreciate this isn’t ground breaking stuff but if we can build a stronger ecosystem it should lead to a more rapid release cycle and more innovation around Etherpad.