192
Sysadmins slam Apple’s SSL/TLS cert lifespan cuts (www.theregister.com)
submitted 2 years ago by to c/technology@lemmy.world
81 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 2 years ago (9 children)

This is the one case where I'd make an exception. I read through the threads, it got particularly heated.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 7 points 2 years ago (8 children)

    As someone who creates custom domain name applications, FUCK THEM WITH A PINEAPPLE SPIKY SIDE FIRST. This problem is on par with timezones for needless complexity and communication disasters. Companys and advertisers are now adding man in the middle certs for additional data collection/visibility. If the ciphers not cracked, changing the certs exposes significantly more failure, than letting one get a little stale.
    Sysadmin used slam! It's super effective!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 3 points 2 years ago (2 children)

    Unrelated to the topic, but I deal with a database storing timestamps.

    In local time.

    For systems all around the world.

    You'll see current entries timestamped 12:28 from eastern Europe followed by ones 6:28 from America and then another 11:28 from central Europe.

    Without offset.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago (1 child)

    Ew. Just store UTC timestamps and do optional translation on the client using whatever the client sets up for their timezone. It's not hard...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 years ago

    Oh believe me, I would change some things about that database if I could. Alas, I'm just the analyst building data models from it.

    (To be fair, it's otherwise easy to work with and for most use-cases, it doesn't matter since they're aggregated per month anyway, so I just load the last month's data on the 2nd of each month. I definitely have worse patients to operate on.)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 2 years ago (4 children)

    Why not just autorenew on a schedule?

    I use Lets Encrypt, and my certs get renewed automatically without me thinking about it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 2 years ago (3 children)

    Mostly customer provided certs, high end clients make all kinds of stupid requests like the aforementioned man-in-the-middle chain sniffers, clients that refuse DNS validation, clients that require alternate domains to be updated regularly. Management is fine for mywebsite.com, but how are you solving an EV on the spoofed root prod domain, with an sso cert chain for lower environments on internal traffic that is originally provided by a client? And do you want the cs reps emailing each other your root cert and (mistakingly) the key? I've been given since SCARY keys by clueless support engineers. I don't want to do this every 3 months.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 years ago (2 children)

    Sounds like a change in company policy, because AFAIK, there's no good reason for pretty much any of that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago (1 child)

    Sounds like you don't do contact negotiations, if someone will pay 2 million to appear on their root domain, you'll sit down and figure it out for a couple hours.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •