Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over a month later and Comcast still doesn't know how to SSL

forums.comcast.com

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Over a month later and Comcast still doesn't know how to SSL

#31

Post by kalms »

mmcnickle wrote: post #30

The "I was using the internet before there was an internet" argument is not helpful to anyone in this situation. The first tier support has no way of verifying the claim and even if they did, they still might not be able to escalate the issue before asking the documented questions. The questions in this case seemed quite sensible, I've been caught out with SSL certs expiring before realising my time wasn't syncing. I…

I thought he was very polite. He made sure everyone was on the same page, thus avoiding a lot of unneeded commentary.

Re: Over a month later and Comcast still doesn't know how to SSL

#32

Post by DavidWoof »

It's pretty funny that an ISP can't get their certs together, but geez, temporarily accept the cert, read the service agreement and get on with your life. Are you seriously worried about a man-in-the-middle attack here?

Trying to impress first tier forum support with your long history with computers isn't helpful to anyone, and sounding off about a serious legal issue in bold and italics is probably just making the lawyers giggle. It's nice to report the problem and follow up on it. There's no reason to be a dick about it.

Re: Over a month later and Comcast still doesn't know how to SSL

#33

Post by TazeTSchnitzel »

A little OT, but using HTTPS Everywhere has shown me how badly SSL is configured on many sites. Default certs for root domain being used on subdomains, scripts and styles loaded over HTTP (and hence blocked by Chrome - by far the most common and most annoying), HTTPS port listened on but no site served, default certs for completely unrelated sites showing up, etc.

Re: Over a month later and Comcast still doesn't know how to SSL

#34

Post by mike-cardwell »

kevinconroy wrote: post #4

The SSL certificate expired Tuesday, May 8, 2012. Pro tip: Set up monitoring alerts on your SSL certs to alert your sys admin when they are getting close. For example, here's a Nagios SSL expiration alert: http://exchange.nagios.org/directory/Plugins/Network-Protoco...

I wrote an application a while ago which would connect to an SSL service and print out how many days until expiry. It works with network ranges and supports IPv6 also. It was designed with the aim of having something useful to stick in a cron job. So if you specify "--expires-within 14" for example, it will only output data for certificates that will expire within the next 14 days. For example:

  mike@alfa:~$ sslScanner.pl contracts.comcast.com news.ycombinator.com smtp.gmail.com:465
                               IP Address   Port  Days Left  Common Name
                             130.94.78.15    443       -172  contracts.comcast.com
                          174.132.225.106    443        934  news.ycombinator.com
                           173.194.78.108    465        222  smtp.gmail.com
                           173.194.78.109    465        222  smtp.gmail.com
              2a00:1450:400c:c00:0:0:0:6d    465        222  smtp.gmail.com
  mike@alfa:~$
You can get it from https://github.com/mikecardwell/sslScanner

Re: Over a month later and Comcast still doesn't know how to SSL

#35

Post by sdfjkl »

harshreality wrote: post #14
kevinconroy wrote: post #4

The SSL certificate expired Tuesday, May 8, 2012. Pro tip: Set up monitoring alerts on your SSL certs to alert your sys admin when they are getting close. For example, here's a Nagios SSL expiration alert: http://exchange.nagios.org/directory/Plugins/Network-Protoco...

Respectable CAs (perhaps that's an oxymoron) will email the contact email address ahead of time warning about the expiration.

Respectable CAs will email you a warning about a month before it expires.

Disreputable CAs will email you 3-4 months before it expires, emphasising that you need to "ACT NOW" (GoDaddy is guilty of this).

Re: Over a month later and Comcast still doesn't know how to SSL

#36

Post by alexkus »

redler wrote: post #11
drivebyacct2 wrote: post #9

Earlier quoted context omitted.

Look at the dates on the posts in the thread. He gave them a month before coming back and chastizing them again to find out they'd closed the ticket without fixing it. This is pretty damn pathetic (1), that's all I can think to even say. (1) esp given that the cert expired in MAY.

This is a problem that could take up to dozens of dollars to solve, and tens of minutes. Check back in early 2013?

Probably. Never underestimate the bureaucracy of a big corporate entity (specifically when it comes to having to pay money to fix something).

Possible causes:-

   * General ineptitude
   * It's not something they monitor.
   * The main www site is up, what's the problem?
   * The technical contact for the previous certificate is no longer at the company. So the "expiring soon" notification was never received.
   * The PO is awaiting 'approval', or Finance are sitting on it whilst arguing whether it's CapEx or OpEx, or the "Business Justification" was rejected by someone who doesn't understand, etc, etc.

Re: Over a month later and Comcast still doesn't know how to SSL

#37

Post by chris_j »

runn1ng wrote: post #23
biturd wrote: post #21

Earlier quoted context omitted.

I would guess that 99% of users don't know the difference between expired, hacked, bad, or any number of things. They just see "ERROR" and stop dead.

99% of users say "stop bugging me, computer, I just want my site" and click on "ignore warning".

One problem with this is that it trains the user to ignore a security warning which might not be crying wolf next time.

Re: Over a month later and Comcast still doesn't know how to SSL

#39

Post by phasetransition »

In my personal experience, @ComcastBill, a fellow named Bill Gerth in Ohio(?), has been a responsive and helpful face inside Comcast. On two occasions short, specific queries his way resulted in receiving direct, actionable contact from inside Comcast.

I sent him a tweet about this specific issue, and hopefully he can make this little embarrassment disappear: https://twitter.com/Roadstead/status/262544429490003968

Re: Over a month later and Comcast still doesn't know how to SSL

#40

Post by dkrich »

DavidWoof wrote: post #32

It's pretty funny that an ISP can't get their certs together, but geez, temporarily accept the cert, read the service agreement and get on with your life. Are you seriously worried about a man-in-the-middle attack here? Trying to impress first tier forum support with your long history with computers isn't helpful to anyone, and sounding off about a serious legal issue in bold and italics is probably just making the l…

I agree. To me the story here is that Comcast is a huge company that takes way too long to process simple changes. But in reality, who the fuck cares if the cert for that page expired? It's not like their collecting your bank records.
Post reply on HN