Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parse is down due to SSL certificate expiry

parse.com

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Parse is down due to SSL certificate expiry

#41

Post by leftnode »

ses wrote: post #10

It's an important reminder that most startups are run by a handful of people who are normal, fallible human beings. They generally don't have access to the infrastructure and manpower required to be on the ball and maintain near 100% uptime of their services. I think the important information to be gleaned about a company is how they deal with problems like this (not necessarily the fact that they encountered the pro…

But certificates cost almost nothing these days, why not just spend the $20-$40 and get a valid one in there?

Re: Parse is down due to SSL certificate expiry

#42

Post by leftnode »

campnic wrote: post #32
leftnode wrote: post #29

Earlier quoted context omitted.

Is there any value in companies like Parse selling their software as installable on your own servers (i.e., GitHub Enterprise). I ask, rhetorically, because I built a somewhat competing service that isn't doing too well and I'm looking to make it so you can install it on your own servers.

Yes. I think that is a useful business. If you could make a system that was scalable and provided an API like parse that sounds like something interesting. Have virtual machine images you can host. The hard part would be figuring out how to simplify scaling it out. That is one really nice thing about hosted solutions. I can forget the IT. I'd be happy to work in a middle ground where i traded the IT effort for additi…

Well I think as this issue with Parse shows, you can forget about the IT until you can't. If your app is down due to a mistake like this, it's even more frustrating because you have so little control on the situation.

Re: Parse is down due to SSL certificate expiry

#43

Post by xoail »

I started using Parse for my app and as I code I am starting to realize how painful it will be to move away from it in future. It would mean a complete rewrite of the app. Now, if they have problems like these (down due to certificate expiry), I am not sure what value I will get out from this service. Also, it is taking more time for me to learn their SDK than I thought, as I am beginning to write complex queries and relations. I encourage people to write data services on their own.

Re: Parse is down due to SSL certificate expiry

#44

Post by [deleted] »

dedene wrote: post #5
neya wrote: post #3

Earlier quoted context omitted.

Now, imagine the plight of all their customers who had built their apps based on their APIs. Hopefully, this is a very good lesson for all.

Indeed... we just finished our app building on Parse, but this and last week make me think hard about whether or not it was a good decision to be dependent on their infrastructure.

[deleted]

Re: Parse is down due to SSL certificate expiry

#45

Post by kogir »

Hint: the web is one thing, but if you're deploying a library that talks to your own server, consider embedding your own root certificate. In addition to verifying the traffic isn't being proxied[1], you can also issue 10 or 20 year certs and be done.

[1] Users can add their own root certs and watch your traffic (typically with the intent of breaking your app), or worse, companies can deploy roots to all their devices and sniff their employees' traffic. Why be complicit?

Re: Parse is down due to SSL certificate expiry

#46

Post by peterwwillis »

For a big org, SSL certs can sometimes be a bitch to manage. I recently started a project to track all the SSL-enabled devices on our medium-sized network, and it came out to something in the low four-digits. As you might assume, not all of them are CA-signed, and many of them expire without anyone ever realizing it.

I wrote a couple scripts to manage bulk-checking SSL certs on a network. One of them uses Curl's Mozilla root CA .pem file and follows the chain to verify a cert is really signed and not expired. https://github.com/psypete/public-bin/tree/public-bin/src/ne...

Re: Parse is down due to SSL certificate expiry

#47

Post by peterwwillis »

seiji wrote: post #15

Do yourself a favor and run this nightly: http://prefetch.net/code/ssl-cert-check A simple loop over your certs will solve so many problems: cd ssl/certs; for pem in *.pem; do ssl-cert-check -a -x 15 -e admin@yourdomain.com -q -c $pem; done [imagine a grumpy "silly companies with millions of dollars in funding, no actual processes, and too little systems knowledge" rant here. it's like a racecar driver who's team let…

I recommend doing the test against the live SSL server. Accidents happen, and sometimes webservers get configured with a different SSL cert than you have in /etc/ssl/certs/. Heck, i've seen orgs with a whole slew of certs created in their issuer's domain management page, and none of them were ever applied to the server. Nobody would know the certs loaded in the webserver were bad until they get a page error.
Post reply on HN