Unable to load image

Mozilla wants CAs to revoke 30 random certificates per year

https://news.ycombinator.com/item?id=42656079

!codecels lol

lmao even

65
Jump in the discussion.

No email address required.

This is actually closely related to my side project of flooding random roads to make people with insufficient tyre tread aquaplane and crash. I'm glad Mozilla have been learning from my experiments.

:marseyschi#zonotes:

Jump in the discussion.

No email address required.

Aren't Irish roads already made of mud? How can you make them crash when the primary mode of transportation is people sliding around on their bellies?

Jump in the discussion.

No email address required.

:marseynerd3: The technical term is a boreen.

Jump in the discussion.

No email address required.

:#marseysalutearmy: :#marseydemonicgrin:

Jump in the discussion.

No email address required.

where's my cert

:#marseynerd2:

What cert

:g#igachad2:


:#marseyviewerstaretalking:

Jump in the discussion.

No email address required.

Google Chrome also takes a hard line when it comes to revocation requirements, and Apple wants to limit certificate lifetimes to 45 days. Although neither have stated a position on random revocations, they are directionally aligned with Mozilla and you will be disappointed if you expect either of them to prioritize server operator convenience over the security of their users.

As for Microsoft, they are simply asleep at the wheel, trusting terrible CAs that do things like misissue a google.com certificate https://bugzilla.mozilla.org/show_bug.cgi?id=1934361.

Microchode continues to be the :marseyretardchad: of the tech world

Jump in the discussion.

No email address required.

Sorry, too busy printing money

:gigachad2talking#:


:marseybooba:

Jump in the discussion.

No email address required.

:marseyjewofthesubcontinent: we are business saar we are not having time for the jerking in a circle about leet code


https://i.rdrama.net/images/1735868008VuwOx0je-jZWTQ.webp

Jump in the discussion.

No email address required.

>all of internet security boils down to files on some guy's hard drive

>some guy suggests maybe we actually commit to rotating these files

>world is engulfed in sneed

Jump in the discussion.

No email address required.

The eternal struggle. :marseydepressed:

Jump in the discussion.

No email address required.

ycombinator link

Which links a groups dot google link

:marseyeyeroll: Just give me the summary :marseyraging:

Jump in the discussion.

No email address required.

Mozilla wants CAs to randomly revoke 30 certificates every year to both force server admins to automate replacements and to force CAs to promptly comply with revoked certs

Jump in the discussion.

No email address required.

sounds obnoxious

Jump in the discussion.

No email address required.

Sounds good for Drama.

Jump in the discussion.

No email address required.

what does any of this mean why are you all such nerds

Jump in the discussion.

No email address required.

Mozilla is run by dramatards

Jump in the discussion.

No email address required.

Groomercord:!marseytrain:s*

Jump in the discussion.

No email address required.

I'm jealous of you, seeing :!marseytrain:s everywhere :marseywink:

Jump in the discussion.

No email address required.

He's an r-slur, but he's correct here today

Jump in the discussion.

No email address required.

Good, frick them nikkas *sips tea*

Jump in the discussion.

No email address required.

I have a client that does this with firewall exceptions. They just randomly kill a bunch of them every so often, then I get people calling me freaking out because some interface we haven't changed in 2 years suddenly quits working and now they can't do something important like change a vendor's bank account or process journal entries or whatever other important task they've moved to some r-slurred SaaS product lately. The whole company freaks out about it for half a day with dozens of people involved, then some butthole in networking is like "oh that got browned out sorry lol"

Jump in the discussion.

No email address required.

fricking why? there is no advantage in having an action plan for your port getting blocked, the only fix and only course of action is to unfrick the port.

the whole point of this random 30 thing is to ensure customers and intermediaries make adequate plans to respond to an unexpected cert revocation

a better system IMO would be to guarantee that every cert gets randomly revoked and reissued once during it's valid period this will actually force people to use suitable automation unless they are so small-time they can handle randomly going offline every 6 weeks or so.

Jump in the discussion.

No email address required.

Its to try to identify exceptions they don't need anymore and it is exactly as dumb of an idea as it sounds.

Jump in the discussion.

No email address required.

No one's binding to this port so you need to close it for security compliance

:marseyaaatremble#: :marseyaaatremble#: :marseyaaatremble#:

Jump in the discussion.

No email address required.

>Server has a thing running on it that expects incoming traffic from the Internet.

>Thing is replaced with the New Hotness; server is deleted.

>!!Firewall rule for internet traffic never goes away!!

>New server reuses that IP address, for something meant to be internal-only

>Some hackster from the Democratic People's Republic of Korea finds it and steals your payroll data

Jump in the discussion.

No email address required.

There should be an address you can bind to for internal only services.

:marseyclueless:

Jump in the discussion.

No email address required.

Why are you assuming that someone running a vendor install script is competent to set all the security options correctly?

Jump in the discussion.

No email address required.

:notmyproblem#:

Jump in the discussion.

No email address required.

Not surprised that you're incredibly stupid as well as annoying

Jump in the discussion.

No email address required.

:marseycry#:

Jump in the discussion.

No email address required.

Like, I'd think they could just put a packet counter on the rule for a year or so (definitely at least a month, but there could also be some things used once annually) and see if it counts any traffic.

Jump in the discussion.

No email address required.

um Here they want the longest certs they can because they think automation is too difficult and takes away their easy Jira points, and :marseyraging:

Jump in the discussion.

No email address required.

what mean :marseydunce:

Jump in the discussion.

No email address required.

Reported by:

tldr kill every webdev and return to communicating solely through irc and shitty web1.0 pages


dude bussy lmao

Jump in the discussion.

No email address required.

I am interested

Jump in the discussion.

No email address required.

Well how else are people gonna get groomed by libertarian Swedish women online?

Jump in the discussion.

No email address required.

ssl

Jump in the discussion.

No email address required.

So they cannot redeem?

Jump in the discussion.

No email address required.

All my shit is automated, they could revoke my cert daily i dont give a shit.

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.