Live data from Hacker News

Tell HN: Sci-Hub's TLS certificate has started failing

news.ycombinator.com

141–150 of 154 posts

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#141
post #127

Earlier quoted context omitted.

The Internet was a United States Department of Defense project to create a communications network that could still function despite damage. It had nothing to do with fast, nor open, communication. That was just a by-product during the 90s.

To answer both of your points, fast was implied by virtue of it being a communication network. The open part can be pedantically removed in the case of ARPAnet, but I've not met anyone who confuses the Internet with ARPAnet. The Internet, as it came to be called in the 90's with the rise of the World Wide Web, WAS at it's core 'open'. Pretty much everyone I've met who was around and working on the ARPAnet saw it as a…

> but I've not met anyone who confuses the Internet with ARPAnet.

Now you have! :) Unless you don't count online interaction.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#142
post #55

This type of thing is my number one objection to Certificate Authorities. In fact, it's my objection to computation illiteracy being acceptable in general amongst users. Devs and agencies cannot be trusted not to screw with things. If the average Joe cannot understand what is going on behind the curtains, they aren't free. Freedom is a scary thing to many groups, and unfortunately, more and more we are seeing the pen…

I don't know how the US Postal Service works, but I still can receive and send sensitive personal information through the US Mail without any real concern that it will fall into the wrong hands. For a variety of reasons, digital communications have never felt as secure. I think a lot of that is due to the lack of legal consequences in the digital realm relative to those in the physical realm (i.e. snail mail.)

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#143
post #44

Earlier quoted context omitted.

Firefox will happily accept self-signed certificates chaining to manually imported CAs. However, there are a lot of severely outdated guides on creating self-signed certificates out there, and many of the certificates produced that way won't be accepted by any modern browser. OpenSSL's terrible command-line UX certainly doesn't help matters. I've found easypki[1] to be the most convenient tool for this purpose. [1]:…

The person you're replying to doesn't have any problem with certs. Their problem is that they (or their employer) hijack a TLD for whatever ludicrous reason, and HSTS pre-loading applies to their hijacked names the same as it would to real names.

Are you sure? The initial post was about .dev being HSTS-preloaded, but the comment I was replying to was an answer to the suggestion that they could use self-signed certificates after importing them to the trust store.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#144

Earlier quoted context omitted.

Kids ride buses; I'm pretty sure they don't understand the marvels of engineering they're benefiting from. My point is: it should be possible to use something without fully understanding the minutiae of how it works. We call this “user interface design”. You should be allowed to live in a house without a full understanding of the architectural details that prevent it from falling down.

I'm sure no single person understands every detail of the diesel engine, arguably nobody so far can solve the Navier-Strokes equation exactly. But even children understand that the car needs fuel and they might now that it has an engine that can break if given the wrong fuel. They could, at least. The fact that there are those who don't only corroborated the fact that there are folks who don't know how ... what was t…

probably this

https://en.m.wikipedia.org/wiki/Navier%E2%80%93Stokes_equati...

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#145

Earlier quoted context omitted.

ISP/DNS-takedowns affect only customers of a single provider. Compelling every US provider is tedious and would still not affect people in other jurisdictions. CA-levy takedowns affect everyone.

A takedown against the hosting ISP would affect everyone, and DNS takedowns can involve changing the authoritative record.

The site can still move to a different jurisdiction and mirrors would still work. As evidenced by various takedown attempts against Sci-Hib.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#146
post #143

Earlier quoted context omitted.

The person you're replying to doesn't have any problem with certs. Their problem is that they (or their employer) hijack a TLD for whatever ludicrous reason, and HSTS pre-loading applies to their hijacked names the same as it would to real names.

Are you sure? The initial post was about .dev being HSTS-preloaded, but the comment I was replying to was an answer to the suggestion that they could use self-signed certificates after importing them to the trust store.

Yeah, and having read over this thread about three times I'm actually less sure than I was. I'll be checking today.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#147

Earlier quoted context omitted.

Keep in mind all of Weber's argument. Government has a monopoly on the legitimate use of force . Weber claims that the state is the "only human Gemeinschaft which lays claim to the monopoly on the legitimated use of physical force. However, this monopoly is limited to a certain geographical area, and in fact this limitation to a particular area is one of the things that defines a state."[2] In other words, Weber desc…

It sounds like a more fundamental question is, "Who authorized this Max Weber dude to dictate who may legitimately use force?" He has an opinion, I have an opinion, you have an opinion, Charles Koch has an opinion... everybody has an opinion. At some point, the answer to questions like this always comes down to "God," or "Nobody," or "Whoever has the most money/biggest weapons." It's an unsatisfying debate.

The point is that this is the justification that's been cited by, and is at the root of, the criticism of government (and, more covertly, taxes).

Koch uses this as his justification, but misstates and apparently misunderstands the concept. This is his prior, the lynchpin of his argument, and it is mis-applied.

The sentiments of Weber are not inconsistent with a long prior line.

Your "God or Nobody" presumption is incorrect. The principles also arise out of systems studies and ontology.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#148

Earlier quoted context omitted.

A takedown against the hosting ISP would affect everyone, and DNS takedowns can involve changing the authoritative record.

The site can still move to a different jurisdiction and mirrors would still work. As evidenced by various takedown attempts against Sci-Hib.

A site can move to a different CA and mirrors would still work.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#149
post #47

Earlier quoted context omitted.

There are plenty of reasons to pay for a certificate. Wildcard certificates only came out last month on LE, and people might still be weary to switch their primary site over so quickly. Additionally, there's still a few cases I can think of where a custom certificate might be needed. For instance, I recently consolidated my personal projects and site onto one server. I needed a single certificate that'd cover two dom…

You can definitely get certs from LetsEncrypt that have SANs for multiple unrelated domains. I haven’t tried out wildcard certificates at all yet, but I would be surprised if it didn’t allow combining those features…

It worked for me as soon as wildcards went live.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#150
post #55

This type of thing is my number one objection to Certificate Authorities. In fact, it's my objection to computation illiteracy being acceptable in general amongst users. Devs and agencies cannot be trusted not to screw with things. If the average Joe cannot understand what is going on behind the curtains, they aren't free. Freedom is a scary thing to many groups, and unfortunately, more and more we are seeing the pen…

I don't know how the US Postal Service works, but I still can receive and send sensitive personal information through the US Mail without any real concern that it will fall into the wrong hands. For a variety of reasons, digital communications have never felt as secure. I think a lot of that is due to the lack of legal consequences in the digital realm relative to those in the physical realm (i.e. snail mail.)

You are on the right track. Snail mail, letters, and correspondences were first class citizens in terms of things like protection by the Fourth Amendment. The postal service (at least as far as I am aware), is one of the few Third parties you can share that type of sensitive information with and have it by the letter of the law still be protected by an expectation of privacy.

(If there is a lawyer in the house who could let us know otherwise, that would be awesome).

The Supreme Court, however, has been reticent to apply any interpretive oomph to the idea that electronic message sending represents the same type of "private correspondence" that a snail mail letter represents.

In fact, if anything it has generally leaned in the opposite direction. The SC has ruled that sharing personal or private information with a third party thereby nullifies your expectation of privacy and protection of your information by due process. This happened in the early days of telephony I think.

"But that is only from the Government's point of view!", I hear from the gallery...

Yes... Unfortunately it does set a societal precedent through the institution, however.

I mean, if as an arbitrary business, I can hand your information to the government and they can make use of it, then surely I am free to share data I have about you with other people\businesses?

Once that becomes legally acceptable, and people are willing to pay me for as much info as I can give, suddenly the economic incentive is to collect and sell as much information as possible. Note that this isn't a tech problem, but a social one.

As long as we don't take a stand by making law to cover the issues of electronic activity being considered "protected correspondence" with a reasonable expectation of privacy, we will continue to see these blatant invasions into our personal affairs by business and government alike.

The thing that will hold back that lawmaking though is that there are some VERY deep pockets that would see incredibly vast revenue streams dry up by passing something like that.

One could see places like Alphabet, Microsoft, Facebook, and the other Silicon Valley darlings doing everything in their power to convince both the government and the populace that doing something like that would be a terrible idea.

And they would be right to a degree. Many "free" services would have to switch to to a subscription model or something similar, and it could mean major cutbacks for many tech companies that haven't matured enough to diversify away from an ad supported business model.

I can't speak for anyone else, but to me, that is a small price to pay to establish a right to the privacy of the exercise of our wills in the electronic realm. Thinking in the Internet age is truly an inspiring thing to behold. However, the Net that enables this capacity for collective thought is just a tool. We will get out of the Net what we as people put into it. To me, the Net has always been about empowering and uplifting every person by putting the collective knowledge and wisdom of humanity at each person's fingertips before anything else. One should always come away from the Net having found something, but at the same time, one has the right to use the Net and not have anything TAKEN. A "Right to Lurk" as it were.

If I had to choose something as the basis for a new Constitutional Amendment, it would be something that would explicitly codify the expansion of the legal "expectation of privacy" to encompass all electronic forms of communication, commerce, and assembly; protecting the aforementioned from search and seizure by the government without due process. It wouldn't do anything for SciHub sadly, but it would be a step back in the right direction in terms of curbing some of the more demonstrably harmful ills the Net has facilitated in our society.

P.S. Sorry for the mind dump. It felt great. If you are still reading, you're awesome.

Post reply on HN