杨澜访谈录

How Quran burnings in Sweden have increased threats from Islamic militants_我的网站

一 |     

　    一键部署OpenClaw        

证书装了不等于站点安全。TLS版本太低、密码套件太弱，照样会被中间人攻击和协议降级攻击盯上。尤其是站长手里的小站，很多用的还是默认配置，老旧的TLS 1.0/1.1根本没关。    STOCKHOLM -- The killing of two Swedish citizens in an attack ahead of a soccer match in Brussels has shocked the Scandinavian country, although the government has been warning for months that Swedes were at greater risk since a recent string of public desecrations of the Quran holy book by a handful of anti-Islam activists. Swedish Prime Minister Ulf Kristersson on Tuesday noted that the government and the security service in August had raised the terror alert to the second-highest level following threats against Sweden by Islamic extremists. “Now we know with chilling clarity that there were grounds for those concerns,” he said. The desecrations, primarily by an Iraqi refugee living in Sweden, have sparked angry reactions in Muslim countries. In June, demonstrators in Iraq stormed the Swedish Embassy and the Iraqi government cut off diplomatic relations with Sweden. The desecrations have raised questions -– including in Sweden -– about why such acts are allowed.Swedish officials have repeatedly condemned the desecrations while saying they are allowed under freedom of speech. The government is investigating whether to give police greater authority to stop such acts on security grounds.“Not everything that is legal is appropriate," Kristersson said Tuesday. “What you do in Sweden can have consequences elsewhere.”In August, Sweden raised its terror alert to the second-highest level for the first time since 2016 following the Quran burnings and threats from militant groups.In a statement Tuesday, the Swedish Security Service, known as SÄPO, said the situation was ”serious” and that it was “working closely with the Belgian authorities.”Kristersson said he had been told by Belgium that the perpetrator "had stayed in Sweden but was not known to the Swedish police.”The European Union's passport-free zone allowed him to travel to Sweden. “We have an openness in Europe, which is one of the important reasons why we need to keep an eye on the EU’s external border, because otherwise people can easily move between European countries,” Kristersson said.In Sweden, there is no law specifically prohibiting the desecration of the Quran or other religious texts. The right to hold public demonstrations is protected by the Swedish Constitution. Police generally give permission based on whether they believe a public gathering can be held without major disruptions or risks to public safety.Many in Sweden say criticizing religion, even in a manner that is considered offensive by believers, must be allowed and that Sweden should resist pressure to re-introduce blasphemy laws which were abandoned decades ago in the predominantly Lutheran but highly secularized nation.Sweden, once largely insulated from militant violence, has experienced attacks in recent years.On April 7, 2017, Rakmat Akilov, an Uzbek man who said he wanted to punish Sweden for joining a coalition against the Islamic State group, drove a stolen truck into a crowd in Stockholm, killing five people and wounding 14 others. He was convicted of terror-related murder and given a life sentence.Another man, Taimour Abdulwahab, blew himself up in the same area in December 2010 when it was packed with Christmas shoppers, killing himself and injuring two people.A 2007 drawing of the Prophet Muhammad by a Swedish cartoonist, Lars Vilks, raised tensions. In May 2011, Vilks was assaulted while giving a speech in Uppsala, and vandals unsuccessfully tried to burn down his home in southern Sweden.。    

下面的配置直接屏蔽TLS 1.0/1.1，只保留TLS 1.2和1.3，同时启用HSTS和OCSP Stapling，让浏览器只走安全通道。

二 |     server {        listen 443 ssl http2;        ssl_certificate     /etc/nginx/ssl/site.crt;        ssl_certificate_key /etc/nginx/ssl/site.key;             ssl_protocols       TLSv1.2 TLSv1.3;        ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;        ssl_prefer_server_ciphers on;             ssl_session_cache   shared:SSL:10m;        ssl_session_timeout 1h;        ssl_session_tickets off;             add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;        ssl_stapling on;        ssl_stapling_verify on;        ssl_trusted_certificate /etc/nginx/ssl/chain.crt;    }    

配置完用openssl s_client -connect yourdomain.com:443 -tls1_1测试，正确结果是握手失败。再用SSL Labs跑一下，A+就稳了。    

Windows的IIS用户也能照这个思路：在注册表里关闭TLS 1.0/1.1的服务器端，并启用HSTS响应头。

三 | 原理一样，只是换了个配置入口。

申请创业报道，分享创业好点子。

四 | 点击此处，共同探讨创业新机遇！。

Current article:http://rz1d.qixicuorenchouzuan.buzz/news/20260826_1813.html

Published on:08:02:46