Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Manjaro website off-line again due to lapsed certificate

distrowatch.com

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Manjaro website off-line again due to lapsed certificate

#21

Post by AuthAuth »

arcanemachiner wrote: post #11
ddtaylor wrote: post #6

A lot of repositories and similar go offline randomly. It hasn't happened in a few months but usually the Microsoft package mirrors go past their Azure limits and I get reminders.

This is like the third or fourth time this has happened to them. The Manjaro team has also caught flak for a bunch of other stuff. There's a page or two our there that detail the issues, which I'm too lazy to link here. But let's just say this isn't their first rodeo.

The page is pretty nitpicky with its issues. There is only 1 that was actually something to concern over iirc.

Re: Manjaro website off-line again due to lapsed certificate

#22

Post by 9dev »

toddgardner wrote: post #18

If you never want this to happen again to your systems, we’re building a tool that bakes monitoring and validation into automatic cert renewals. https://www.certkit.io/ >

Paying for certificates..? Manually copying cert files? Man, this reads like it was 2010 or something. Best of luck, but I don’t know why I wouldn’t just use acme.sh and systemd timers instead of this.

Re: Manjaro website off-line again due to lapsed certificate

#23

Post by harmonics »

dijit wrote: post #17
9cb14c1ec0 wrote: post #10

Just use Caddy. It's that simple.

"I use arbitrarily complex software that has a rapid SDLC to obfuscate the issue with the fact that we have to have military grade encryption for displaying the equivalent of a poster over the internet". The state of our industry is such that there will be a lot of people arguing for this absurdity in the replies to me. (or I'll be flagged to death). Package integrity makes sense, and someone will make the complicate…

Nah, you've simply never lived in a country which is afraid of its own population and does (or tried to) MITM internet traffic. Mine does both, there was a scandal several years ago:

https://news.ycombinator.com/item?id=20472179

I'll take enforced HTTPS for absolutely everything, thank you very much. Preferably with certificate pinning and similar aggressive measures to thwart any attempts to repeat this.

Re: Manjaro website off-line again due to lapsed certificate

#25

Post by ratorx »

dijit wrote: post #17
9cb14c1ec0 wrote: post #10

Just use Caddy. It's that simple.

"I use arbitrarily complex software that has a rapid SDLC to obfuscate the issue with the fact that we have to have military grade encryption for displaying the equivalent of a poster over the internet". The state of our industry is such that there will be a lot of people arguing for this absurdity in the replies to me. (or I'll be flagged to death). Package integrity makes sense, and someone will make the complicate…

Changing the links and doing nothing else would be a pretty dumb MITM. You could do a more complex variant which is not so easy to spot (targeting specific networks, injecting malware whilst modifying the checksum)

The key property of SSL that is useful for tamper resistance is that it’s hard to do silently. A random ASN doing a hijack will cause an observable BGP event and theoretically preventable via RPKI. If your ISP or similar does it, you can still detect it with CT logs.

Even the issuance is a little better, because LE will test from multiple vantage points. This doesn’t protect against an ISP interception, but it’s better than no protection.

Re: Manjaro website off-line again due to lapsed certificate

#26

Post by ChadNauseam »

peeters wrote: post #5
Mond_ wrote: post #4

I used Manjaro for a few years. That's how I learned a pretty important lesson about software engineering that still informs how I work to this day. "A layer of abstraction on top of a stateful legacy system often doesn't result in a simpler system, it just introduces exciting new failure possibilities. This especially applies when the owners of the legacy system have no responsibility over the abstraction layer."

This comment made a lot more sense to me once I realized we weren't talking about an aggressively marketed weight loss drug.

It's still true. Your metabolic system is probably not simpler after taking terzepatide. Although, just because it's not simpler doesn't mean it can't be better. I'm very glad for the C++ abstraction layer over assembly, even if the stack is more complicated than if it were just assembly

Re: Manjaro website off-line again due to lapsed certificate

#27

Post by hug »

dijit wrote: post #17
9cb14c1ec0 wrote: post #10

Just use Caddy. It's that simple.

"I use arbitrarily complex software that has a rapid SDLC to obfuscate the issue with the fact that we have to have military grade encryption for displaying the equivalent of a poster over the internet". The state of our industry is such that there will be a lot of people arguing for this absurdity in the replies to me. (or I'll be flagged to death). Package integrity makes sense, and someone will make the complicate…

People will argue with you because your initial quoted sentence is chock full of fallacies.

* Caddy's complexity (especially when it comes to TLS) is not arbitrary, it's to meet the needs of auto-renewal and ... y'know, hosting sites on TLS.

* Caddy's SDLC is not, as far as I understand it, especially rapid.

* Implying that "military grade" is some level of encryption beyond the minimum level of encryption you would ever want to use is silly.

* The Manjaro website is not "the equivalent of a poster", and in fact hosts operating system downloads. Operating system integrity is kinda important.

You may have reasonable arguments for sites that are display only, do not out-link, and do not provide downloads, but this is not one of those circumstances.

Re: Manjaro website off-line again due to lapsed certificate

#28

Post by PaulCarrack »

I'm often stuck at my desk for long hours, which made it difficult to maintain a healthy weight. I started using Manjaro a few months ago, and it's had a significant impact. It helped control my appetite and reduced the constant cravings I'd usually get, making it easier to make healthier choices. I've lost around 15-20 lbs so far, and I feel much more in control of my eating habits. I know it's a bit anecdotal but it's been an important part of my weight loss journey

Re: Manjaro website off-line again due to lapsed certificate

#29

Post by alexpotato »

arcanemachiner wrote: post #11
ddtaylor wrote: post #6

A lot of repositories and similar go offline randomly. It hasn't happened in a few months but usually the Microsoft package mirrors go past their Azure limits and I get reminders.

This is like the third or fourth time this has happened to them. The Manjaro team has also caught flak for a bunch of other stuff. There's a page or two our there that detail the issues, which I'm too lazy to link here. But let's just say this isn't their first rodeo.

Going to play devil's advocate and say that they make minimal to no revenue off of their website so it being down is not a huge deal.

It's exactly the opposite to what happens if the the main ad server for a company in the ad serving business looks at things.

Or another example:

From an inventory management perspective, it's ok to be out of stock for low margin items b/c the opportunity cost is low.

Post reply on HN