Government shutdown: TLS certificates not renewed, many websites are down • Hacker News Board

Re: Government shutdown: TLS certificates not renewed, many websites are down

#11

Post by shakna » Sat, Jan 12, 2019, 2:00 PM UTC

tyingq wrote: post #8

aboutruby wrote: post #2

From reddit: > This article is overly hyperbolic. Some obscure subdomains of government websites are serving expired x509 certificates. They're not down and this definitely doesn't compromise the encryption that protects any login credentials. Anyway, it is embarassing to see certificate renewal is not automated - it's something any good sysadmin would have set up. https://www.reddit.com/r/technology/comments/aeps41/…

Nothing to do with SSL, but a fair amount of US government websites are hard down, on purpose, due to the funding dilemma. Like: https://www.data.gov "Due to a lapse in government funding all Data.gov websites will be unavailable until further notice." Which is pretty odd, because putting up these blocker pages probably costs more than just letting the sites run unattended.

Also in the above thread, were a few government workers. One explained it was policy to powerdown all servers, except the one hosting that error page, though they weren't aware of the reason for such a policy.

Re: Government shutdown: TLS certificates not renewed, many websites are down

#12

Post by tyingq » Sat, Jan 12, 2019, 2:03 PM UTC

wlesieutre wrote: post #10

tyingq wrote: post #8

Earlier quoted context omitted.

Nothing to do with SSL, but a fair amount of US government websites are hard down, on purpose, due to the funding dilemma. Like: https://www.data.gov "Due to a lapse in government funding all Data.gov websites will be unavailable until further notice." Which is pretty odd, because putting up these blocker pages probably costs more than just letting the sites run unattended.

Maybe the worry is letting them run unattended when no one is allowed to do maintenance/security work in the event of a problem?

I guess, but it's likely the seldom used blocker page code has security and/or maintenance issues too.

Re: Government shutdown: TLS certificates not renewed, many websites are down

#13

Post by npapag7 » Sat, Jan 12, 2019, 2:06 PM UTC

I am afraid this is the beggining of the collapse of Us standard of living. Developer with 20 years of experience from greece and PhD. Working for goverment for 6 dollars per hour.

Re: Government shutdown: TLS certificates not renewed, many websites are down

#14

Post by tyingq » Sat, Jan 12, 2019, 2:09 PM UTC

Waterluvian wrote: post #9

tyingq wrote: post #8

Earlier quoted context omitted.

Nothing to do with SSL, but a fair amount of US government websites are hard down, on purpose, due to the funding dilemma. Like: https://www.data.gov "Due to a lapse in government funding all Data.gov websites will be unavailable until further notice." Which is pretty odd, because putting up these blocker pages probably costs more than just letting the sites run unattended.

Maybe. I know nothing about the offerings of these sites but they may be replacing interactive sites where you can access services with a static page.

The page seems to be coming from S3, I see "Server: AmazonS3" in the headers, and some other typical Amazon headers. Also has Google Analytics, which is interesting for a Government website.

Re: Government shutdown: TLS certificates not renewed, many websites are down

#15

Post by renholder » Sat, Jan 12, 2019, 2:13 PM UTC

aboutruby wrote: post #2

From reddit: > This article is overly hyperbolic. Some obscure subdomains of government websites are serving expired x509 certificates. They're not down and this definitely doesn't compromise the encryption that protects any login credentials. Anyway, it is embarassing to see certificate renewal is not automated - it's something any good sysadmin would have set up. https://www.reddit.com/r/technology/comments/aeps41/…

>Anyway, it is embarassing to see certificate renewal is not automated - it's something any good sysadmin would have set up.

From the original article[1]: "One such example is https://ows2.usdoj.gov, a U.S. Department of Justice website which uses a certificate that expired in the week leading up the shutdown. The certificate has been signed by a trusted certificate authority, GoDaddy, but it has not been renewed since it expired on 17 December 2018."

It was probably already renewed, there's just no sysadmin to import the fresh cert. =]

[1] - https://news.netcraft.com/archives/2019/01/10/gov-security-f...

Re: Government shutdown: TLS certificates not renewed, many websites are down

#16

Post by tossaccount123 » Sat, Jan 12, 2019, 2:15 PM UTC

TomK32 wrote: post #3

My bet what will trigger the next recession proper was on Brexit, but 45 is beating the Brits to it. Not shabby for a temper tantrum. This week I read up on Reagan's firing of 11000 flight controllers because the union that formerly supported him demanded better working conditions. It took a decade for air traffic control to regain the old levels.

Trump is asking for less than 1/1000 of our annual budget for border security. We spend 10x that on foreign aid annually. This entire thing is political BS over what amounts to a rounding error while congress almost unanimously approved $38 billion in money for Israel

Re: Government shutdown: TLS certificates not renewed, many websites are down

#17

Post by bartread » Sat, Jan 12, 2019, 2:18 PM UTC

Serious question for US members of HN: how do you tolerate these shutdowns?

I mean, apart from the loss of services, including websites, it seems like many federal workers aren't being paid. Will they be paid back after the shutdown impasse is resolved or is the money they didn't/couldn't earn lost to them. This seems unfair and, in the meantime, how are they supposed to go about their lives?

Overall it seems potentially damaging and disruptive for any organisation or individuals with dependencies on the government.

The reason I ask is I've been turning over what it might look like if a similar situation occurred in the UK, where it'a difficult to envisage a scenario that doesn't end with rioting in the streets.

Re: Government shutdown: TLS certificates not renewed, many websites are down

#18

Post by nostrebored » Sat, Jan 12, 2019, 2:19 PM UTC

bartread wrote: post #17

Serious question for US members of HN: how do you tolerate these shutdowns? I mean, apart from the loss of services, including websites, it seems like many federal workers aren't being paid. Will they be paid back after the shutdown impasse is resolved or is the money they didn't/couldn't earn lost to them. This seems unfair and, in the meantime, how are they supposed to go about their lives? Overall it seems potenti…

Government employees are paid, but contract workers like janitors are not

Re: Government shutdown: TLS certificates not renewed, many websites are down

#19

Post by TomK32 » Sat, Jan 12, 2019, 2:22 PM UTC

tossaccount123 wrote: post #16

TomK32 wrote: post #3

My bet what will trigger the next recession proper was on Brexit, but 45 is beating the Brits to it. Not shabby for a temper tantrum. This week I read up on Reagan's firing of 11000 flight controllers because the union that formerly supported him demanded better working conditions. It took a decade for air traffic control to regain the old levels.

Trump is asking for less than 1/1000 of our annual budget for border security. We spend 10x that on foreign aid annually. This entire thing is political BS over what amounts to a rounding error while congress almost unanimously approved $38 billion in money for Israel

As a European I find the US system to bind packages of laws slightly idiotic. The current fight is about a few sticks of steel yet unrelated federal agencies are cut off their funding. This is sabotage!

Re: Government shutdown: TLS certificates not renewed, many websites are down

#20

Post by untog » Sat, Jan 12, 2019, 2:23 PM UTC

bartread wrote: post #17

Serious question for US members of HN: how do you tolerate these shutdowns? I mean, apart from the loss of services, including websites, it seems like many federal workers aren't being paid. Will they be paid back after the shutdown impasse is resolved or is the money they didn't/couldn't earn lost to them. This seems unfair and, in the meantime, how are they supposed to go about their lives? Overall it seems potenti…

Because it doesn't actually impact most people yet. Obviously that's cold comfort to the government workers who are currently unpaid, but I guess people are selfish.

The shutdown is a cumulative thing. For instance, the FDA food inspections aren't happening. For a week, it's not likely to make a big difference. But a month? Three months? Eventually people will get sick and it'll be a huge issue. TSA agents have mostly been coming to work at airports, but Friday was payday, and they didn't get paid. More and more will call out sick. Same with housing benefits, farming loans... right now they all have a direct impact on a few individuals. But once the numbers start growing the government will be forced to act.

This is now the longest shutdown the US has had, so we're in uncharted territory. It'll undoubtedly have a bigger effect than previous shutdowns. Trump has even said the shutdown could last months, but of course you'd be an idiot to take him at his word.