Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

Post reply on HN
Print view View original

41–50 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#41

Post by thisisnico »

save_ferris wrote: post #5
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

I recently started looking for a new TV since my old “dumb” TV is starting to have image issues and they all seem to be “smart” these days. Seems like manufacturers have slashed prices by adding adware to the GUI of TV’s. Needless to say, I’ve been incredibly frustrated with my search.

Luckily I bought an RCA 55" 4K TV for like 400 CAD, it's 100% dumb, HDMI and other inputs only. Got this two years ago it's probably not like this anymore.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#42

Post by jjoonathan »

beervirus wrote: post #27
jjoonathan wrote: post #6

Earlier quoted context omitted.

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

> Sony dropped playstation support for my 4K monitor in an irreversible software update What kind of support does it need? Isn't it just an HDMI cable?

Nope. It was a specific HDMI codec that was common to early 4k TVs and monitors, and it worked great until they decided it shouldn't anymore. Something about HDMI 1.4 vs HDMI 2.0.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#43

Post by danpalmer »

topkai22 wrote: post #31

Certificates suck. They are monumentally user unfriendly and complex. How many major internet properties have had outages driven by certificate renewal in the last several years? Half? I know that enterprises I work with seem to have some sort of work impacting certificate problem every month. The ecosystem needs to become a lot more robust and user friendly in general. Unfortunately, I’m just a user of certificates…

While I empathise with your viewpoint, that the ecosystem is hard to work with, I'm afraid I don't think there are any quick solutions to this.

> certificate warning date

If this is user-visible then for most companies this would be nearly as bad as expiry, and if it's not user visible then it's not useful.

> Make it easier for people to acquire and renew certs

Let's Encrypt pretty much solves this problem. The places where it doesn't work are companies that lock down the use of that sort of software. I don't think there's an easy way around that.

> Formalize a way to solve the key distribution problem described in the article

This problem isn't just the problem described in the article, it's _THE_ Key Distribution Problem. It has a Wikipedia entry, it's a chapter in most security textbooks, it's a lecture in most cryptography modules at universities. It's a _hard problem_. The practice of including Root CA certs on devices is the best thing we've come up with yet that has the security and scalability trade-offs necessary.

If the "replaces" concept was viable in the general case I think we'd have likely implemented it, but I suspect it's too vulnerable, and likely only pushes back the problem.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#44

Post by jjoonathan »

hanklazard wrote: post #11
jjoonathan wrote: post #6

Earlier quoted context omitted.

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

That last part is my nightmare ... which company is it?

TCL. The screens are cheap, but they get you with the ads.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#45

Post by afwaller »

We had to deal with the sectigo / addtrust expiration. It was annoying because we reached out to our cert vendor and they had claimed it would not affect us (only affecting “legacy” systems or old browsers), but then of course it did affect us. It was an easy resolution, but still annoying.

Of course, we still have people working on our stuff. If it were some abandoned hardware product I could see this being a disaster.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#46

Post by lreeves »

LeonM wrote: post #29
beervirus wrote: post #27

Earlier quoted context omitted.

> Sony dropped playstation support for my 4K monitor in an irreversible software update What kind of support does it need? Isn't it just an HDMI cable?

My guess is the TV must support DRM

That's only for Bluray playback, for gaming the PS4 doesn't care about HDCP.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#47

Post by cptskippy »

save_ferris wrote: post #5
geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

I recently started looking for a new TV since my old “dumb” TV is starting to have image issues and they all seem to be “smart” these days. Seems like manufacturers have slashed prices by adding adware to the GUI of TV’s. Needless to say, I’ve been incredibly frustrated with my search.

I can't speak for their latest and greatest but the LG TVs I've used running webOS (Oled and LCD) work fine without ever being connected to a network. I have a C7P panel I've connected via Ethernet a couple times to update the firmware and it has continued to work offline just fine.

They also support CEC so if the devices you're plugging into them support CEC you can just put the TV remove into a drawer and not worry about ever accidentally triggering the SMART features.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#48

Post by teddyh »

To quote myself¹ from two years ago:

Any Internet-connected device is, in fact, a server, and must be seen and managed as one. This means strict control of installed services and, first and foremost, regular updates of all its software components (including firmware). If you acquire and install such a server which either can’t be updated or one which you know, realistically, won’t get any updates six months after installation, that’s asking to lose.

1. https://news.ycombinator.com/item?id=18019343

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#49

Post by jjoonathan »

TallGuyShort wrote: post #24
jjoonathan wrote: post #6

Earlier quoted context omitted.

Sony dropped playstation support for my 4K monitor in an irreversible software update, forcing me to buy a smart TV :/ Also: the new smart TV bootloops if it can't connect to the internet for more than a couple weeks at a time (it wants to refresh its screensaver ads). You can run, but you can't hide.

I like Amazon's model for this on the Kindle: Kindles are subsidized by ads, so you can buy what is effectively a REALLY cheap tablet from a well-known company if that's most important to you. OR, if you prefer, you can go pay a one-time fee an eliminate ads from the OS.

Yeah, I would be less upset about the ad situation if they had made it clear up front and given me a choice like Amazon does with the Kindle.

That said, when companies price the ad-free premium at 1000x the expected ad revenue, it gets aggravating again.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#50

Post by ansible »

geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

> ... I wanted a 4K monitor.

To all the folks reading at home... I would remind everyone that a TV is not a monitor.

I got a relatively inexpensive LG 43in TV to use as a desktop monitor. I've had issues. Beyond the usual "make sure your graphics card actually supports 4K" and such, you also need to take some time to dig through the TV settings when you are using it on a PC.

In particular, you definitely want to turn on "game mode" or whatever it will be called. This turns off the internal image processing that can add hundreds of milliseconds of lag to the display output. You'll also need to find the settings to turn off the overscan. Many TVs will, by default, zoom into the center of the image, cutting off the edges a little.

I've mostly gotten over the other issues with using a TV as a monitor (color settings and such), but if you want to save yourself some hassle, just get an actual monitor.

Post reply on HN