Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari will no longer trust certs valid for more than 13 months

theregister.co.uk

Post reply on HN
Print view View original

101–110 of 179 posts

Re: Safari will no longer trust certs valid for more than 13 months

#101

Post by threeseed »

mooibos wrote: post #93

I develop for Apple platforms, and it's absolutely mind-boggling how frequently and regularly they break your code for no tangible benefit. Hopefully their influence doesn't spread to the web too.

There is a tangible benefit. For users.

64-bit only, Project Catalyst, BitCode, HTTPS only connections etc are examples of initiatives which definitely has caused pain to developers but has immensely benefited users as a whole. And if you don't passionately care about users then frankly find another platform to develop on.

Re: Safari will no longer trust certs valid for more than 13 months

#102

Post by jchw »

superkuh wrote: post #39

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders…

> Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.

I mean... How do you expect to have a valid, trusted TLS certificate without a third party? Nobody says it has to be Lets Encrypt or Cloudflare or Amazon load balancers or ... so forth. Some certificate authorities even already have APIs....

Re: Safari will no longer trust certs valid for more than 13 months

#104

Post by threeseed »

superkuh wrote: post #48
derefr wrote: post #42

Earlier quoted context omitted.

CAs have always been third-party services, though. Their APIs just used to involve humans talking to humans, rather than machines talking to machines. But that's no less of an operational dependency. In a systems engineering plan (e.g. a NASA long-term project), both kinds of dependencies are considered liabilities that must be engineered for long-term reliability, fault-tolerance, etc.

In the past browsers did not scaremonger so much about self-signed certs and search engines would index sites that were just http and this didn't effect their ranking.

I can't tell if you are serious here.

You want self signed certs to be trusted and the web to move back to the days of HTTP where anybody could just intercept your traffic ?

Re: Safari will no longer trust certs valid for more than 13 months

#106

Post by greglindahl »

superkuh wrote: post #39

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders…

What about people who want to share information about things they love with privacy and security? This change seems likely to enhance my privacy and security.

Re: Safari will no longer trust certs valid for more than 13 months

#107

Post by threeseed »

superkuh wrote: post #99
bad_user wrote: post #89

Earlier quoted context omitted.

With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting services like Netlify or GitHub Pages are now providing HTTPS certificates and installing it on your own server is pretty painless, if you're into managing your own server. And if your hosting provider doesn't support Let's Encrypt, you can always put Cloudflare in…

>So I don't really understand what you're talking about, That's because you didn't finish reading my post. >Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.

You mean like how it has been for decades ?

You have always needed at minimum hosting, SSL and domain service providers.

Re: Safari will no longer trust certs valid for more than 13 months

#108

Post by gsich »

threeseed wrote: post #104
superkuh wrote: post #48

Earlier quoted context omitted.

In the past browsers did not scaremonger so much about self-signed certs and search engines would index sites that were just http and this didn't effect their ranking.

I can't tell if you are serious here. You want self signed certs to be trusted and the web to move back to the days of HTTP where anybody could just intercept your traffic ?

That's not what he said.

Re: Safari will no longer trust certs valid for more than 13 months

#109

Post by gsich »

threeseed wrote: post #101
mooibos wrote: post #93

I develop for Apple platforms, and it's absolutely mind-boggling how frequently and regularly they break your code for no tangible benefit. Hopefully their influence doesn't spread to the web too.

There is a tangible benefit. For users. 64-bit only, Project Catalyst, BitCode, HTTPS only connections etc are examples of initiatives which definitely has caused pain to developers but has immensely benefited users as a whole. And if you don't passionately care about users then frankly find another platform to develop on.

>64-bit only

how has that benefitted the user? Directly and measureably, no "it's 0.3% faster now" excuses.

Re: Safari will no longer trust certs valid for more than 13 months

#110

Post by kevingadd »

threeseed wrote: post #101
mooibos wrote: post #93

I develop for Apple platforms, and it's absolutely mind-boggling how frequently and regularly they break your code for no tangible benefit. Hopefully their influence doesn't spread to the web too.

There is a tangible benefit. For users. 64-bit only, Project Catalyst, BitCode, HTTPS only connections etc are examples of initiatives which definitely has caused pain to developers but has immensely benefited users as a whole. And if you don't passionately care about users then frankly find another platform to develop on.

How does it benefit the user for half their software to break, or for them to have to pay a vendor (rightfully) for a massive update/overhaul just so the software keeps working?

64-bit Only benefits Apple because they don't have to maintain the 32-bit stack anymore. Any perf-sensitive software that needed to be 64-bit transitioned a long time ago.

Post reply on HN