Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

21–30 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#21

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

> I wanted a 4K monitor

You might want something like a Philips BDM4350UC then [1] - brought from the 'large monitor' section of your favourite IT retailer. No smart features whatsoever (and no tuner and no remote).

Unfortunately, they only go up to 43-inch - large for a monitor, but not exactly Frank's 2000-inch TV.

[1] https://www.philips.co.uk/c-p/BDM4350UC_00/brilliance-4k-ult...

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#22

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

Never add your WiFi credentials you your TV. It doesn’t let you remove them so you’re only option is to create a “dummy” network (ex: phone as a hotspot) and switch to it.

Also, watch out for clueless^helpful friends and relatives who try to “fix” your TV’s WiFi.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#23
post #15

Earlier quoted context omitted.

Problem some do connect to any non secured WiFi they can find.

I purposely bought and expensive one that’s pure android tv where you can disable all the tracking bits

You bought an Android device to avoid tracking? lol

As long as you're using binaries that were compiled by Google I wouldn't trust them one bit.

If you use LineageOS on your TV you might be a little better off.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#24

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

I like Amazon's model for this on the Kindle: Kindles are subsidized by ads, so you can buy what is effectively a REALLY cheap tablet from a well-known company if that's most important to you. OR, if you prefer, you can go pay a one-time fee an eliminate ads from the OS.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#25
If you have a current Firefox that first diagram may not be correct for you. Let's tell a brief story about why.

Servers, as Scott explains, are supposed to present a "chain" of certificates, in practice it's one leaf and then just anything else that might be useful for clients to assemble a trust path. If you do this everything works.

But lots of servers are misconfigured and present only the leaf certificate, not least because a lot of older software makes configuring the chain needlessly confusing/ complicated and it often "seems" to work anyway in some client software.

Given just a leaf, and a set of roots it trusts, a client can't make a useful trust decision, there's a gap. One option in this circumstance is to just give up and just tell the client's user this isn't secure. That's a poor UX.

Another idea is called AIA Chasing, many popular web browsers do this. When it can't get from the presented certificates to a trusted root the browser inspects the Authority Information Access field of a certificate to find a URL, hopefully this URL points to an intermediate certificate that plugs the gap. A problem with AIA chasing is that it reveals information about your browsing to the CA who otherwise have no reason to know. This privacy concern led Mozilla to reject AIA Chasing.

Yet another idea is to cache intermediate certificates for some period of time, then use that cache to fill any "gap" when making a trust path for other servers you connect to. This causes hard-to-predict errors for users, maybe the funny cat video site you enjoy works fine... unless you try to visit it first thing after turning on the PC. It can potentially represent a privacy risk within a session.

So ultimately Mozilla's workaround in current Firefox is to give Firefox a fairly complete set of intermediates, just as if it had cached them already. Essentially that right hand "embedded in browser" part of the diagram extends left to the intermediates too.

It made that happen through two means: Firstly m.d.s.policy required all root CAs to tell it about all unconstrained intermediates they had ever created, which was itself a revealing process because there sure are a lot of (mostly older) garbage intermediates that clearly are untrustworthy and shouldn't exist. More recently Certificate Transparency means any intermediates still in use must be in the CT logs because otherwise the leaf certificates won't be accepted by those logs, so Mozilla can "just" fetch that data.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#26

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

> Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this.

You know, I've wanted something like this as well for a while. I know next to nothing about startups or companies, but I wonder how hard it would be to create a hardware startup around this. On one hand, you arent really designing anything new, you're more or less creating a version of an existing product, with existing technologies, except removing undesirable parts. On the other hand, I have mo idea how someone could get started without previous experience in TV design / manufacturing.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#27

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

> Sony dropped playstation support for my 4K monitor in an irreversible software update

What kind of support does it need? Isn't it just an HDMI cable?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#28

Earlier quoted context omitted.

Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. To address your question, I think they’re all “smart” now. I ended up getting a low-end Samsung 4K a few months ago and it’s been good so far. It starts up very quickly, maybe 1-2 seconds.…

> Someone on HN recently floated the idea of a company that would make quality, non-smart electronics and appliances that would also be easily serviceable. I wish this existed and would pay significantly more for products like this. You know, I've wanted something like this as well for a while. I know next to nothing about startups or companies, but I wonder how hard it would be to create a hardware startup around th…

Doubt it would work. Hardware is commoditized and low margin. That's why TVs are embedding internet advertising, to make fat stacks from their otherwise barely profitable products.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#29

Earlier quoted context omitted.

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

> Sony dropped playstation support for my 4K monitor in an irreversible software update What kind of support does it need? Isn't it just an HDMI cable?

My guess is the TV must support DRM

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#30

Earlier quoted context omitted.

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

I like Amazon's model for this on the Kindle: Kindles are subsidized by ads, so you can buy what is effectively a REALLY cheap tablet from a well-known company if that's most important to you. OR, if you prefer, you can go pay a one-time fee an eliminate ads from the OS.

Or you can buy the cheap one with ads and keep it on aircraft mode, longer battery life, no ads. (Download content from PC via USB)
Post reply on HN