Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Public CA is down

status.pki.goog

Post reply on HN
Print view View original

151–160 of 166 posts

Re: Google Public CA is down

#151

Post by philprx »

codys wrote: post #122
kyledrake wrote: post #112

People went ballistic on me a few months ago for bringing this up, but this is exactly the kind of outage that makes me really, really worried about extremely short lived certificates. https://news.ycombinator.com/item?id=46118371

I'm not sure I follow. This outage seems like it occurred for less than 1 day. The post you link to is about having certificates expire after 45 days. What's the connection you see?

that's roughly 1/45th probable downtime window = 2.22% downtime probability (yeah, it's a figure not a real proba ;-) )

compared to say, roughly 1/365 probable downtime window for a 398 days cert lifetime = 0.25% downtime probability

let's pray you don't need to rotate when it's down...

Dan Geer famously said: "Dependency is the root cause of risk"...

PS: even stricter shortlived durations in some context:

Internal/Private 1 – 7 days Corporate VPNs, Internal apps

Ephemeral 5 mins – 1 hour Docker containers, CI/CD runners

Re: Google Public CA is down

#152

Post by h4ch1 »

ddtaylor wrote: post #28
h4ch1 wrote: post #9

Thought my Revanced patch got outdated for a second. Phew.

Have you had to update microG yet?

Yes I had to, the v20.14.43 I patched a month ago broke just today; but updating it was pretty easy; just have to update[0] and repatch 20.14.43 with an updated GMS patch.

[0] https://github.com/ReVanced/GmsCore/releases/tag/v0.3.13.2.2...

Re: Google Public CA is down

#153

Post by shabloney »

jeroenhd wrote: post #139
codys wrote: post #122

Earlier quoted context omitted.

I'm not sure I follow. This outage seems like it occurred for less than 1 day. The post you link to is about having certificates expire after 45 days. What's the connection you see?

Some CAs are experimenting with shorter, 7 day certificates as well. still not an outage that would endanger anyone's ability to renew in time, but for small or extremely shitty CAs (and there are a lot of those) such an outage may take enough time to cause issues in theory I guess?

It doesn't have to be small or more shitty than average. If Google has a compliance issue and can meet it in 8 hours then its a pretty clear one. They could have an issue that needs round trips of discussions with auditors before resuming. etc. I'm not familiar with 24/7 auditor services.

Re: Google Public CA is down

#154

Post by kmm »

philprx wrote: post #151
codys wrote: post #122

Earlier quoted context omitted.

I'm not sure I follow. This outage seems like it occurred for less than 1 day. The post you link to is about having certificates expire after 45 days. What's the connection you see?

that's roughly 1/45th probable downtime window = 2.22% downtime probability (yeah, it's a figure not a real proba ;-) ) compared to say, roughly 1/365 probable downtime window for a 398 days cert lifetime = 0.25% downtime probability let's pray you don't need to rotate when it's down... Dan Geer famously said: "Dependency is the root cause of risk"... PS: even stricter shortlived durations in some context: Internal/P…

That's only if you delay renewal until the last day of the lifetime of the certificate. If you renew at day 30 you'd only get in trouble if there's more than two weeks of downtime.

Re: Google Public CA is down

#155

Post by andwur »

aaomidi wrote: post #133
rconti wrote: post #131

> The fix has been rolled out and the issuance flow has been undrained. We again apologize for the inconvenience. issuance flow has been undrained?

Draining is terminology they use for draining traffic from a service.

"Undrain" is not idiomatic, at least outside of Google. One might drain a tank or creek to empty it, the reverse isn't "undraining" to fill it back up. "issuance flow has been restored" might be a more widely understood phrasing.

Admittedly, a nitpick, however the tech industry has a tendency to invent new words when they could say the exact same thing in plain English and be better understood by a wider audience.

Re: Google Public CA is down

#156

Post by dns_snek »

devsda wrote: post #150
jacquesm wrote: post #147

Earlier quoted context omitted.

You're joking, but still: that's one very possible outcome of both requiring centrally issued certificates for security reasons and browsers refusing to display websites without. Effectively certificates are now a license to publish.

On a PC we atleast have an out. On mobile, user certs are pretty much ignored unless opted in by apps. Even firefox allows user certs (for now) but only via an obscure hidden config. This means we cannot use self-hosted services even using a VPN with official apps without getting a signed cert.

> This means we cannot use self-hosted services even using a VPN with official apps without getting a signed cert.

What do you mean by this? Any service that is designed to be self-hosted will have an app that accepts user-installed CAs. HomeAssistant, for example.

Re: Google Public CA is down

#157

Post by tialaramex »

disruptiveink wrote: post #148
jacquesm wrote: post #146

Earlier quoted context omitted.

Something is badly borked when the protections against an imaginary problem cause a real problem.

Baseline requirements are not an imaginary problem. All of them have a legitimate reason for existing. You could argue that some "are not that big of a deal", but that's exactly the point, the overbearing and overly specific requirements serve both their own purpose and double as Van Halen's "no brown M&Ms" clause: if the CA screws them up, either by malice or incompetence and doesn't immediately catch them and self-…

Yes. Brown M&M tests are exactly what's called for here. You want a strong psychological urge to obey rules just because they're rules. There are roles where this isn't the right thing, but operating a Certificate Authority isn't one of them.

In my experience every case in the Web PKI where we found what seems obviously to be either gross incompetence or outright criminality there were also widespread technical failures at the same CA. Principles who aren't obeying the most important rules also invariably don't care about merely technical violations, which are easier to identify.

For example, CrossCert had numerous technical problems to go along with the fact that obviously nobody involved was obeying important rules. I remember at one point asking, so, this paperwork says you issue only for (South) Korea, but, these certs are explicitly not for Korea, so, what technical measure was in place to ensure you didn't issue them and why did it fail? And obviously the answer is they didn't give a shit, they'd probably never read that paperwork after submitting it, they were just assuming it doesn't matter...

Re: Google Public CA is down

#158

Post by cluckindan »

TMEHpodcast wrote: post #67
14 wrote: post #61

Earlier quoted context omitted.

Well one must also argue the opposite. I myself have gained immense knowledge from YouTube. I have learned things like phone screen replacements or phone battery replacements. I call myself a mechanic from the school of YouTube and have saved myself at minimum $10k in repairs doing the work myself. I have learned to make endless food recipes or create things like giant bubbles or slime for my kids. My point is that I…

Congratulations! You’ve successfully avoided YouTube Shorts.

You can avoid the infinite scroll by taking the short video ID and inserting it into the regular player URL.

Re: Google Public CA is down

#159

Post by Analemma_ »

philprx wrote: post #151
codys wrote: post #122

Earlier quoted context omitted.

I'm not sure I follow. This outage seems like it occurred for less than 1 day. The post you link to is about having certificates expire after 45 days. What's the connection you see?

that's roughly 1/45th probable downtime window = 2.22% downtime probability (yeah, it's a figure not a real proba ;-) ) compared to say, roughly 1/365 probable downtime window for a 398 days cert lifetime = 0.25% downtime probability let's pray you don't need to rotate when it's down... Dan Geer famously said: "Dependency is the root cause of risk"... PS: even stricter shortlived durations in some context: Internal/P…

You’re supposed to renew your cert way in advance of the expiration time. For 47-day certs the general expectation is that you renew them monthly, so in the worst case you’d need more than two weeks of CA outage before anything went wrong.

Re: Google Public CA is down

#160

Post by jofla_net »

aaomidi wrote: post #132
kyledrake wrote: post #112

People went ballistic on me a few months ago for bringing this up, but this is exactly the kind of outage that makes me really, really worried about extremely short lived certificates. https://news.ycombinator.com/item?id=46118371

You know there’s more than one CA?

but only one browser
Post reply on HN