Over a month later and Comcast still doesn't know how to SSL • Hacker News Board

Re: Over a month later and Comcast still doesn't know how to SSL

#21

Post by biturd » Sun, Oct 28, 2012, 4:53 AM UTC

uiri wrote: post #15

I know the warnings are in place for a reason, but why don't the affected people just bypass the warning. There is no reason to think that just because the date changed that Comcast's certificate is now compromised. If the certificate was issued with an expiry date of five years or more, I'd understand not taking the chance; especially considering how long Comcast is taking to review their certificate - if their cert…

I would guess that 99% of users don't know the difference between expired, hacked, bad, or any number of things. They just see "ERROR" and stop dead.

Re: Over a month later and Comcast still doesn't know how to SSL

#22

Post by veemjeem » Sun, Oct 28, 2012, 5:01 AM UTC

dfc wrote: post #5

A month after what? September 27th is what?

5 months to be exact :-)

Pretty sad for a company selling internet access to be so naive about basic things.

Re: Over a month later and Comcast still doesn't know how to SSL

#23

Post by runn1ng » Sun, Oct 28, 2012, 5:26 AM UTC

biturd wrote: post #21

uiri wrote: post #15

I know the warnings are in place for a reason, but why don't the affected people just bypass the warning. There is no reason to think that just because the date changed that Comcast's certificate is now compromised. If the certificate was issued with an expiry date of five years or more, I'd understand not taking the chance; especially considering how long Comcast is taking to review their certificate - if their cert…

I would guess that 99% of users don't know the difference between expired, hacked, bad, or any number of things. They just see "ERROR" and stop dead.

99% of users say "stop bugging me, computer, I just want my site" and click on "ignore warning".

Re: Over a month later and Comcast still doesn't know how to SSL

#24

Post by deafbybeheading » Sun, Oct 28, 2012, 5:31 AM UTC

uiri wrote: post #15

I know the warnings are in place for a reason, but why don't the affected people just bypass the warning. There is no reason to think that just because the date changed that Comcast's certificate is now compromised. If the certificate was issued with an expiry date of five years or more, I'd understand not taking the chance; especially considering how long Comcast is taking to review their certificate - if their cert…

>I know the warnings are in place for a reason, but why don't the affected people just bypass the warning.

Not caring about certificate expiration may be a sign of not caring about other, more serious, security issues.

Re: Over a month later and Comcast still doesn't know how to SSL

#25

Post by sliverstorm » Sun, Oct 28, 2012, 5:59 AM UTC

nvr219 wrote: post #7

I love when shit like this happens. Edit: love when it happens to other people.

If you said, "I love when shit like this happens, because I've made the same mistake a million times and it makes me feel better seeing the big players do it" you probably would have even received a few upvotes.

HN doesn't really tolerate straight up mean comments.

Re: Over a month later and Comcast still doesn't know how to SSL

#26

Post by freehunter » Sun, Oct 28, 2012, 6:27 AM UTC

biturd wrote: post #18

It;s been more than a month, perhaps not this particular one, but I have reported to them on twitter multiple times that their SSL certs are dead. Their IP to geolocation is also way off, something they don't seem to care about. I think the worst was I contacted them on twitter about several hosts that were hammering one of our mail servers, around a million lookups for usernames a day for each domain. I blocked the…

If they can't open a tar, there's a good chance they can't open gzip either. I'd be willing to bet they run Windows on their desktops. Sending it as a Windows-standard zip might have been the better option.

Re: Over a month later and Comcast still doesn't know how to SSL

#27

Post by smsm42 » Sun, Oct 28, 2012, 6:37 AM UTC

biturd wrote: post #18

It;s been more than a month, perhaps not this particular one, but I have reported to them on twitter multiple times that their SSL certs are dead. Their IP to geolocation is also way off, something they don't seem to care about. I think the worst was I contacted them on twitter about several hosts that were hammering one of our mail servers, around a million lookups for usernames a day for each domain. I blocked the…

If they didn't know what tar file is, sending any format to that person would be useless - obviously, it's not the right person to talk to on this question, they are not nearly knowledgeable enough. I would guess it's some low-level support that is probably not even allowed to escalate the issue, and is not able to handle it, most they can do is to put the data into some kind of internal database where it quietly dies.

As for the question how to get the right person, I'd like to know a way...

Re: Over a month later and Comcast still doesn't know how to SSL

#28

Post by eric_bullington » Sun, Oct 28, 2012, 7:38 AM UTC

chriscareycode wrote: post #17

Dobbs wrote: post #13

Earlier quoted context omitted.

The standard https check has it built-in with the right flags. Use -h or --help to figure it out. (They provide different output)

That would be /usr/lib/nagios/plugins/check_http --ssl -C 30 -H contracts.comcast.com CRITICAL - Certificate expired on 05/08/2012 23:59.

You can also use openssl's built-in utility* to see that the certificate has expired:

  openssl s_client -showcerts -connect contracts.comcast.com:443

*You may also need to specify the path to your certificates using something like: -CApath /etc/ssl/certs/

To get the exact expiration date, it appears you have to do:

1) download cert:

  openssl s_client -connect hostname:port > cert.pem

2) verify date:

  openssl x509 -in cert.pem -noout -enddat

Re: Over a month later and Comcast still doesn't know how to SSL

#29

Post by blindfly » Sun, Oct 28, 2012, 8:29 AM UTC

To be fair to Comcast you're running into a few things. In a non-technical kind of way and in no order...

Comcast.com is (stop laughing) a high value domain. You're not likely to get any CA to just hand over a certificate in 2 seconds. It will get flagged for manual inspection and further details will be required.

Large companies like this aren't as simple to handle. If it were a small startup with 3 people you want to bet your pants it would be fixed right away. But I bet you there are e-mails flying around into underpaid mailboxes waiting for a response. Not every corporate office is a well-oiled machine.

But on the flip side it is unfortunate they're struggling with it. The poor front line customer service rep (Carole) has no choice but to assure you they're currently working on it and move on to the next squeaky wheel. Like any person in customer service, her job is to assure you and move on.

Re: Over a month later and Comcast still doesn't know how to SSL

#30

Post by mmcnickle » Sun, Oct 28, 2012, 9:16 AM UTC

The "I was using the internet before there was an internet" argument is not helpful to anyone in this situation. The first tier support has no way of verifying the claim and even if they did, they still might not be able to escalate the issue before asking the documented questions. The questions in this case seemed quite sensible, I've been caught out with SSL certs expiring before realising my time wasn't syncing. It's not helpful to the OP because it comes across as arrogant and they're not going to endear themselves to the support agent.

Best for everyone is to remain polite, responsive to the agent's requests (however seemingingly inane) and the process will move a lot quicker.