Unable to load image

Mozzarella wants CAs to revoke 30 random certificates per year

https://news.ycombinator.com/item?id=42656079

!codecels lol

lmao even

65
Jump in the discussion.

No email address required.

I have a client that does this with firewall exceptions. They just randomly kill a bunch of them every so often, then I get people calling me freaking out because some interface we haven't changed in 2 years suddenly quits working and now they can't do something important like change a vendor's bank account or process journal entries or whatever other important task they've moved to some r-slurred SaaS product lately. The whole company freaks out about it for half a day with dozens of people involved, then some butthole in networking is like "oh that got browned out sorry lol"

Jump in the discussion.

No email address required.

fricking why? there is no advantage in having an action plan for your port getting blocked, the only fix and only course of action is to unfrick the port.

the whole point of this random 30 thing is to ensure customers and intermediaries make adequate plans to respond to an unexpected cert revocation

a better system IMO would be to guarantee that every cert gets randomly revoked and reissued once during it's valid period this will actually force people to use suitable automation unless they are so small-time they can handle randomly going offline every 6 weeks or so.

Jump in the discussion.

No email address required.

Its to try to identify exceptions they don't need anymore and it is exactly as dumb of an idea as it sounds.

Jump in the discussion.

No email address required.

No one's binding to this port so you need to close it for security compliance

:marseyaaatremble#: :marseyaaatremble#: :marseyaaatremble#:

Jump in the discussion.

No email address required.

>Server has a thing running on it that expects incoming traffic from the Internet.

>Thing is replaced with the New Hotness; server is deleted.

>!!Firewall rule for internet traffic never goes away!!

>New server reuses that IP address, for something meant to be internal-only

>Some hackster from the Democratic People's Republic of Korea finds it and steals your payroll data

Jump in the discussion.

No email address required.

There should be an address you can bind to for internal only services.

:marseyclueless:

Jump in the discussion.

No email address required.

Why are you assuming that someone running a vendor install script is competent to set all the security options correctly?

Jump in the discussion.

No email address required.

:notmyproblem#:

Jump in the discussion.

No email address required.

Not surprised that you're incredibly stupid as well as annoying

Jump in the discussion.

No email address required.

:marseycry#:

Jump in the discussion.

No email address required.

Like, I'd think they could just put a packet counter on the rule for a year or so (definitely at least a month, but there could also be some things used once annually) and see if it counts any traffic.

Jump in the discussion.

No email address required.

um Here they want the longest certs they can because they think automation is too difficult and takes away their easy Jira points, and :marseyraging:

Jump in the discussion.

No email address required.



Now playing: Funky the Main Monkey (DKC2).mp3

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.