Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

Post reply on HN
Print view View original

11–20 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#11

Post by hanklazard »

jjoonathan wrote: post #6
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

That last part is my nightmare ... which company is it?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#12

Post by tialaramex »

> If we take a look at similar data for iOS, it's a very different story.

This fits the prevailing narrative, and for all I know it's true, but Scott does not in fact illustrate it.

The "similar data" to a table of all Android API versions versus popularity turns out to be a chart of recent iOS versions in which everything that isn't current is just grouped as "Other" at 16.28%

Maybe if we ungrouped "Other" it would prove Scott's point, maybe not, we shan't find out answers in his article. If those "Other" iOS users are all running 10.3 it's a very different story than if they're on iOS 6...

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#13

Post by derekp7 »

jjoonathan wrote: post #6
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

If you open up a smart TV, isn't the "smart" part of it basically an embedded ARM cpu SBC, with a somewhat standard connection to the LCD cable? If so, how hard would it be to rip out the smarts and put in a passive HDMI to LCD converter board?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#15

Post by katbyte »

dathinab wrote: post #10
briffle wrote: post #8

Earlier quoted context omitted.

I never hooked up the smart tv to my wireless network. I have heard too many stories about data getting sent back to the manufacturers to sell your watching habits, etc. Instead, I use a Roku, that I know gets updates (and yes, they also sell your watching habits, but so far, nextdns.io's lists block the DNS that roku uses to do this.)

Problem some do connect to any non secured WiFi they can find.

I purposely bought and expensive one that’s pure android tv where you can disable all the tracking bits

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#16

Post by briffle »

dathinab wrote: post #10
briffle wrote: post #8

Earlier quoted context omitted.

I never hooked up the smart tv to my wireless network. I have heard too many stories about data getting sent back to the manufacturers to sell your watching habits, etc. Instead, I use a Roku, that I know gets updates (and yes, they also sell your watching habits, but so far, nextdns.io's lists block the DNS that roku uses to do this.)

Problem some do connect to any non secured WiFi they can find.

That is terrifying.. good to know!

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#17

Post by gregmac »

devit wrote: post #7

Having expiring certificates/key rotation might be a net negative: if you keep the private key secure, there is no need to rotate it, and it avoids a lot of hassle. Also, if you have a revocation mechanism, then rotation doesn't add that much for keys that are only used for signing and not for encryption (like the CA keys). Of course in some cases like domains it's necessary since the domain can be transferred, but t…

It's a good point. At any given time, the key is either compromised or it's not. And you may or may not know either way.

If it's compromised, and you know, then it should be revoked -- if your only mechanism to revoke it is waiting some amount of time (several days, months, or even a decade) you have a pretty big problem.

If you don't have a way to detect if it's compromised, rotating a precaution almost makes sense -- but then the valid time should be very short. I'm not exactly sure how short, but definitely the decade or two used for CA certs is too long. Make it shorter than a year and automated renewal becomes necessary, but if you have that mechanism why not check for revocations?

The only other reason I can think of to expire non-compromised certificates is to force them to be regenerated to use newer signature algorithms, but even that's difficult to predict. We're currently using SHA-2 for PKI, but is that still going to be reasonable in 5, 10 years? Someone could figure out a potential weakness at any time, which would start the move to something else.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#18

Post by Spooky23 »

geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

You have to shop for TVs by sorting from high to low pricewise... the cheap TVs are subsidized. For a project a few years ago, I bought a few Samsung commercial signage TVs for a customer whose security requirements prohibited anything like a "smart" TV.

At the time they were dumb panels, not sure if that is still true today. You had to understand what you were buying, as some of these displays are designed to show static content.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#19

Post by ryanianian »

pletnes wrote: post #4
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

What we did for our old tv, was to get a chromecast after 3-4 years. This might be a cheaper and more environmentally friendly approach than yours, as we then buy one «smart-device», but you might end up with 2, over 12 years. But then some (all?) smart tv offerings have issues with terms and conditions, privacy, etc which may make them undesirable for you.

Pro-tip: you can usually un-accept privacy policies on Smart TVs and this reverts them to "dumb" TVs. This disables built-in apps and may make "software updates" unavailable but that's actually what you want anyway.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#20

Post by idbehold »

tialaramex wrote: post #12

> If we take a look at similar data for iOS, it's a very different story. This fits the prevailing narrative, and for all I know it's true, but Scott does not in fact illustrate it. The "similar data" to a table of all Android API versions versus popularity turns out to be a chart of recent iOS versions in which everything that isn't current is just grouped as "Other" at 16.28% Maybe if we ungrouped "Other" it would…

He links directly to the source of that data and on that site you can download a CSV of the aggregated data.

  "iOS 13.3",27.03
  "iOS 12.4",16.19
  "iOS 12.3",14.2
  "iOS 13.1",10.22
  "iOS 12.2",7.89
  "iOS 12.1",4.16
  "iOS 13.4",4.02
  "iOS 13.2",2.68
  "iOS 10.3",2.31
  "iOS 11.4",2.14
  "iOS 9.3",1.94
  "iOS 11.2",1.03
  "iOS 12.0",0.86
  "iOS 13.0",0.82
  "iOS 11.0",0.81
  "iOS 11.3",0.72
  "iOS 6.0",0.45
  "iOS 10.2",0.4
  "iOS 11.1",0.32
  "iOS 7.1",0.18
  "iOS 13.5",0.17
  "iOS 10.1",0.17
  "iOS 9.1",0.15
  "iOS 7.0",0.15
  "iOS 10.0",0.14
  "iOS 6.1",0.13
  "iOS 5.1",0.12
  "iOS 9.2",0.12
  "iOS 8.4",0.11
  "iOS 8.1",0.1
  "iOS 8.3",0.06
  "iOS 9.0",0.06
  "iOS 5.0",0.04
  "iOS 8.0",0.03
  "iOS 4.3",0.03
  "iOS 8.2",0.02
  "iOS 3.2",0.01
  "Other",0.02
Post reply on HN