Modwest Blog

First Fruits of the Modwest Community

A couple weeks ago we launched the Modwest Feedback Community.  Already, we have heard important ideas form customers and implemented changes in response!

Here's a few examples:

• radiohead correctly pointed out that while Subversion (svn) is available in all Modwest shared hosting accounts, we hadn't done a very good job of letting people know. We quickly made a few changes so that it shows up on the big features page as well as the main webhosting page under Site Management. Thanks radiohead!
• In a comment thread, squiggle advised that our System Status page should continue displaying maintenance and issue alerts for more than just a few days, to aid our clients in debugging any issues they may be tackling. We took care of that a few days later, and now the last 30 days of notices display. 
• In an OnSite feature request topic, bryanb suggested we provide a more direct way for site owners to get into webmail. Turns out that already existed but we never told anyone! There are two options:

http://webmail.modwest.com
https://beta-webmail.modwest.com

As an example of what's being discussed right now, here's a recently popular topic (click it for details!):

So, we'd say our "kick off" was a great success. If you haven't visited recently, check it out, and participate for a chance to win real prizes like this one:

-JM

Clearing Up the MD5-Signed Certificate Issue

We have had some questions recently about the news that Berlin researchers had "broken SSL" by exploiting weaknesses in the "MD5" algorithm. Some of the news reports were alarming, and seemed to imply that worldwide electronic commerce was in grave danger as a result of their discovery.

While the weakness of MD5 has been known for a long time, the big news from Berlin was about how the team of security researchers and a room full of 200 Playstation 3 units managed to use those weaknesses to generate a counterfeit SSL certificate.

In theory, the researchers could have set up a fake https://www.paypal.com, and if they subsequently directed visitors to it (via DNS Poisoning or some other redirection exploit), their fake site would be indistiguishable from the real thing.

But here's what the news doesn't mean.

• It doesn't mean that MD5-signed certificates already in use are "vulnerable" to something.   There is no new exploit expressly designed to hack into sites utilizing MD5-signed certificates, for example.
• It also doesn't mean that the encrypted communication between site visitors and web servers with MD5-signed certificates is any less secure.

If your Modwest purchased-and-hosted certificate is MD5-signed, we will be happy to reissue and reinstall it upon request. Although your certificate is still secure, if you'd prefer a re-issued (non-MD5) certificate, just contact support and we'll take care of it.

To identify whether your SSL certificate is MD5-signed, you could use the SSL Blacklist Firefox plugin (despite its alarming warnings). Or visit your site securely (HTTPS-mode), double-click the SSL padlock, and look in the Details section for the 'Certificate Signature Algorithm'.

For more information, see this FAQ from RapidSSL or Verisign's Blog for even more details and debate.

-JM

Feedback Community Launched!

Since our open beta announced in October, we've had some really helpful input by a handful of Feedback Community members, fixed a few things, and improved a few things. So it's time to draw back the curtain and invite all Modwest customers to participate.

Marianne is our Community Manager and as she said in an email invitation this morning:

It's not a survey. It's not really a forum, either. It's probably like nothing you've seen before, and if you visit the site you'll see what I mean.

• Share your ideas and feedback
• Discuss web hosting (and other web topics) with us and other customers
• Win prizes for participating in contests
• Let's get to know each other and hear what everyone has to say!

We also have some contests with real prizes planned, so we hope you'll check it out.

You can log in to the Feedback Community with any valid OnSite username, so feel free to forward your invitation to all your mailbox owners too!

See you in the "MFC"!

-JM