Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Impending Doom of Expiring Root CAs and Legacy Clients

scotthelme.co.uk

Post reply on HN
Print view View original

191–200 of 209 posts

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#191

Post by charrondev »

geerlingguy wrote: post #3

I begrudgingly bought a 'Smart TV' just because I wanted a 4K monitor. But I use it as a dumb monitor and watch app-based content through an Apple TV. At least I'm reasonably sure the Apple TV will be updated for 5-10 years, and is a lot more disposable than a giant TV. My last TV worked great for about 12 years. No way Panasonic would've kept supporting it that long. Honestly, the thing I hate most about smart TVs,…

My LG turns on very quickly, and actually has decent UI.

I’m guessing they have a decently powerful processor to power WebOS in there.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#192

Post by GoblinSlayer »

AshamedCaptain wrote: post #79

"Impending" doom? Devices from 10 years ago are _already_ useless online. Not only are the root certificates completely expired, but let's see which protocols does an openssl 0.9.8 build from a decade ago have in common with, say, current Gmail's IMAPS server: NONE.

ISRG root is 2 years old. And even uses RSA.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#193

Post by GoblinSlayer »

gregmac wrote: post #17
devit wrote: post #7

Having expiring certificates/key rotation might be a net negative: if you keep the private key secure, there is no need to rotate it, and it avoids a lot of hassle. Also, if you have a revocation mechanism, then rotation doesn't add that much for keys that are only used for signing and not for encryption (like the CA keys). Of course in some cases like domains it's necessary since the domain can be transferred, but t…

It's a good point. At any given time, the key is either compromised or it's not. And you may or may not know either way. If it's compromised, and you know, then it should be revoked -- if your only mechanism to revoke it is waiting some amount of time (several days, months, or even a decade) you have a pretty big problem. If you don't have a way to detect if it's compromised, rotating a precaution almost makes sense…

I'd say sign the next root certificate with previous root key, then you can rotate root key automatically. Browser update works the same way: you download new browser with new root certificate authenticated by previous root key.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#194

Post by Drdrdrq »

superkuh wrote: post #56

Once again the persuit of security theater to meet the requirements of commerce (which most of the web doesn't share) cause problems accessing the large parts of the normal web. When are people going to learn that centralized cert authorities are just for commerce and only hurt the non-commercial web?

Curious - what do you suggest for non-commercial web, taking into account both privacy and security?

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#195

Post by quickthrowman »

chrisweekly wrote: post #188
DaiPlusPlus wrote: post #157

Earlier quoted context omitted.

AVRs are a huge hassle to deal with, and overkill when you only have 2 or 3 devices to switch between and/or don’t have many audio-only devices. AVRs made more sense during the days when we’d have CD players, tape decks, VCRs and DVD player, vinyl record players, cable/satellite STBs, and a game console or two all hooked up. Now it’s just an STB (if you aren’t a cord-cutter), a Roku/AppleTV/Chromecast/FireTV, and may…

It seems our experiences and priorities are quite different. I've never found any "hassle" in using an AVR for its intended, dedicated purpose: centrally managing various audio and video inputs and outputs and driving surround speakers & subwoofer. Inputs include Cable box/DVR, PS4, AppleTV, and (sometimes) Nintendo Switch. Audio out leverages our home theater surround system, and video out is a single HDMI into the…

I have the inverse of your setup. PS4, Apple TV, and Blu Ray Player use the 3 HDMI inputs on the TV, with an optical out audio cable to an input on my Sony receiver.

My receiver is older and doesn’t have HDMI in, but this solution works well with the TV I have. When a device is turned on, the TV wakes up and switches to that input. If the PS4 is on and I turn on the Apple TV, it will auto-switch. I never need to touch the TV remote at all since the devices go to sleep automatically, which is nice. Apple TV remote handles the receiver volume, and the audio input never changes on the receiver, so I don’t need the TV or receiver remotes at all.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#196

Post by myself248 »

ce4 wrote: post #178
myself248 wrote: post #37

Earlier quoted context omitted.

Specifically for TVs, you can get a new display driver board for whatever panel is in there. Eats HDMI/DP, spits out eDP or VBO or whatever the panel format is. Often these are pretty basic, with a minimal OSD pasted in by the Shenzhen seller who configures the thing to your order. Personally I'm trying to get my hands on the SDK for the software that runs in the driver chip (does the OSD and the scaling and everythi…

Any pointers to forums/projects or sellers of these? Sounds like a bit of a rabbit hole, tbh :-)

These guys are doing it somewhat commercially: http://zisworks.com/

I've stumbled into a pile of panels and I have several orders of different driver boards on their way to me from Shenzhen, but nothing in-hand to say if they work yet.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#197

Post by myself248 »

jiggawatts wrote: post #163
myself248 wrote: post #37

Earlier quoted context omitted.

Specifically for TVs, you can get a new display driver board for whatever panel is in there. Eats HDMI/DP, spits out eDP or VBO or whatever the panel format is. Often these are pretty basic, with a minimal OSD pasted in by the Shenzhen seller who configures the thing to your order. Personally I'm trying to get my hands on the SDK for the software that runs in the driver chip (does the OSD and the scaling and everythi…

> Specifically for TVs, you can get a new display driver board for whatever panel is in there. Is this something that is practical and commonly done, or only theoretically possible? I have an older model Sony 4K TV (pre-Android) that is so slow now after its recent firmware updates that it responds to button presses only after 2-3 seconds. It's unbearable! I'd love to be able to just pop in a new driver board and ref…

Get the part number of the panel (some reviews will mention this, if you don't want to open the case), and search for it on Panelook and Aliexpress.

Right now I'm working on a project with some M315DJJ-K30 and MV238QUM-N20 panels, but parts are still in shipping so I don't have anything to show for it yet.

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#198

Post by a1a1a1a1a1a1 »

dsl wrote: post #122
a1a1a1a1a1a1 wrote: post #97

Earlier quoted context omitted.

I believe a lot of television manufacturers already offer the equivalent of that as "commercial TVs" or "digital signage" they are marketed toward businesses. I think they're typically more expensive because they don't collect and sell data to subsidize cost, but that might be what you're looking for. Here's an example of a Samsung digital signage TV https://www.samsung.com/us/business/products/displays/4k-uhd...

They are more expensive because they generally have higher quality components and are not made to be disposable, and commercial applications have a higher price tolerance than consumers. Despite the common trope, "selling data" doesn't lower the price of consumer devices. You only see price-less-than-cost plays when companies are trying to buy market share (think Alexa, Google Home, early Kindle, etc).

From what I've found it looks like you're right. The commercial TVs come with different port sets, and are built to be more durable, brighter, and allow cooling in more orientations. https://image-us.samsung.com/SamsungUS/b2b/resource/2016/07/...

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#199

Post by chrisweekly »

quickthrowman wrote: post #195
chrisweekly wrote: post #188

Earlier quoted context omitted.

It seems our experiences and priorities are quite different. I've never found any "hassle" in using an AVR for its intended, dedicated purpose: centrally managing various audio and video inputs and outputs and driving surround speakers & subwoofer. Inputs include Cable box/DVR, PS4, AppleTV, and (sometimes) Nintendo Switch. Audio out leverages our home theater surround system, and video out is a single HDMI into the…

I have the inverse of your setup. PS4, Apple TV, and Blu Ray Player use the 3 HDMI inputs on the TV, with an optical out audio cable to an input on my Sony receiver. My receiver is older and doesn’t have HDMI in, but this solution works well with the TV I have. When a device is turned on, the TV wakes up and switches to that input. If the PS4 is on and I turn on the Apple TV, it will auto-switch. I never need to touc…

Yep, different strokes for different folks. :) I've never had a TV w decent audio out (nor reasonable input sec switching), rather started w focus on amazing sound (Hsu Research Ventriloquist 7.1 w down-firing sub), and eventually the receiver's role was expanded to encompass video. Whatever works for you!

Re: The Impending Doom of Expiring Root CAs and Legacy Clients

#200

Post by WorldMaker »

user5994461 wrote: post #183
imtringued wrote: post #179

Earlier quoted context omitted.

Why not just get a 43" monitor instead of trying to misuse a TV as a monitor?

Because the 43" TV is $200 while an equivalent computer display is double or triple that.

YGWYPF? The price difference can sometimes just be the ads, bundled apps, and other "smart" features designed to put a couple bucks back into the hands of the manufacturer selling that TV at low or now margin.
Post reply on HN