Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I no longer have an old-school cert on my HTTPS site

rachelbythebay.com

Post reply on HN
Print view View original

311–320 of 437 posts

Re: Why I no longer have an old-school cert on my HTTPS site

#311

Post by nssnsjsjsjs »

comex wrote: post #164
kangalioo wrote: post #139

Earlier quoted context omitted.

But what's wrong with sending the number as a string? `"65537"` instead of `"AQAB"`

The question is how best to send the modulus, which is a much larger integer. For the reasons below, I'd argue that base64 is better. And if you're sending the modulus in base64, you may as well use the same approach for the exponent sent along with it. For RSA-4096, the modulus is 4096 bits = 512 bytes in binary, which (for my test key) is 684 characters in base64 or 1233 characters in decimal. So the base64 version…

Ah OK so: readable, efficient, consistent; pick 2.

Re: Why I no longer have an old-school cert on my HTTPS site

#312

Post by tialaramex »

bostik wrote: post #284
tialaramex wrote: post #200

Earlier quoted context omitted.

You really shouldn't need CN (but it's convenient for humans) however there are a bunch of other interesting things in the X.509 certificate, lets look at the one for this site: Issuer: We need to know who issued this cert, then we can check whether we trust them and whether the signature on the certificate is indeed from them, and potentially repeat this process - this cert was issued by Let's Encrypt's E5 intermedi…

> You really shouldn't need CN (but it's convenient for humans) Is this finally the case now? About 5 years back IIS would fail to load a certificate without a CN, despite the field being deprecated since 2000. And who would run IIS? A bunch of janky/dodgy/shady marketing affiliates, at least. Quite common in the gambling industry.

I am definitely not telling you that it will work in all software, yeah. Only that it should work and well, that's not useful engineering advice.

Re: Why I no longer have an old-school cert on my HTTPS site

#313

Post by rr808 »

eadmund wrote: post #61

> So, yes, instead of saying that "e" equals "65537", you're saying that "e" equals "AQAB". Aren't you glad you did those extra steps? Oh JSON. For those unfamiliar with the reason here, it’s that JSON parsers cannot be relied upon to treat numbers properly. Is 4723476276172647362476274672164762476438 a valid JSON number? Yes, of course it is. What will a JSON parser due with it? Silently truncate it to a 64-bit or 6…

> JSON is better than XML

hard disagree on that one.

Re: Why I no longer have an old-school cert on my HTTPS site

#314

Post by nssnsjsjsjs »

mort96 wrote: post #294
agarren wrote: post #273

Earlier quoted context omitted.

Why? I can understand the argument that you don’t want an ISP or a middlebox injecting ads or scripts (valid I think even if I’ve never encountered it to my knowledge), but otherwise you’re publishing content intended for the world. There’s presumably nothing especially sensitive that you need to hide on the wire.

> (valid I think even if I’ve never encountered it to my knowledge) Visitors to your website may encounter it. Do you not care that your visitors may be seeing ads? You're also leaking what your visitors are reading to their ISPs and governments. Maybe you don't consider anything you write about to be remotely sensitive, but how critically do you examine that with every new piece you write? If you wrote something whi…

I agree but SSL doesn't encrypt the IP so there is that information leaked. That isn't to say don't use SSL but more it isn't 100% privacy protection from middlemen.

Re: Why I no longer have an old-school cert on my HTTPS site

#315

Post by nssnsjsjsjs »

GoblinSlayer wrote: post #300
foobiekr wrote: post #184

Earlier quoted context omitted.

The reason is to prevent your site from becoming a watering hole where malicious actors use it to inject malware into the browsers of your users. TLS isn't for you, it's for your readers.

Ads will inject it anyway.

If there are ads.

Re: Why I no longer have an old-school cert on my HTTPS site

#316

Post by imtringued »

Y_Y wrote: post #119
egorfine wrote: post #67

Earlier quoted context omitted.

> JSON is [...] What would you suggest instead given all these cons?

Fixing all of those at once might be a bit too much to ask, but I have some quick suggestions. I'd say for a more robust JSON you could try Dhall. If you just want to exchange lumps of data between programs I'd use Protobuf. If you want simple and freeform I'd go with good old sexps. https://github.com/dhall-lang/dhall-lang https://protobuf.dev/ https://en.wikipedia.org/wiki/S-expression

Suggesting protobuf as alternative to JSON is crazy talk.

Re: Why I no longer have an old-school cert on my HTTPS site

#317

Post by Y_Y »

imtringued wrote: post #316
Y_Y wrote: post #119

Earlier quoted context omitted.

Fixing all of those at once might be a bit too much to ask, but I have some quick suggestions. I'd say for a more robust JSON you could try Dhall. If you just want to exchange lumps of data between programs I'd use Protobuf. If you want simple and freeform I'd go with good old sexps. https://github.com/dhall-lang/dhall-lang https://protobuf.dev/ https://en.wikipedia.org/wiki/S-expression

Suggesting protobuf as alternative to JSON is crazy talk.

You must not have seen the abject misuses of JSON I've seen then

Re: Why I no longer have an old-school cert on my HTTPS site

#318

Post by sevensor »

JackSlateur wrote: post #188
eadmund wrote: post #61

> So, yes, instead of saying that "e" equals "65537", you're saying that "e" equals "AQAB". Aren't you glad you did those extra steps? Oh JSON. For those unfamiliar with the reason here, it’s that JSON parsers cannot be relied upon to treat numbers properly. Is 4723476276172647362476274672164762476438 a valid JSON number? Yes, of course it is. What will a JSON parser due with it? Silently truncate it to a 64-bit or 6…

Is this ok ? Python 3.13.3 (main, May 21 2025, 07:49:52) [GCC 14.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import json >>> json.loads('47234762761726473624762746721647624764380000000000000000000000000000000000000000000') 47234762761726473624762746721647624764380000000000000000000000000000000000000000000

Just cross your fingers and hope for the best if your data is at any point decoded by a json library that doesn’t support bigints? Python’s ability to handle them is beside the point of they get mangled into ieee754 doubles along the way.

Re: Why I no longer have an old-school cert on my HTTPS site

#319

Post by mort96 »

nssnsjsjsjs wrote: post #314
mort96 wrote: post #294

Earlier quoted context omitted.

> (valid I think even if I’ve never encountered it to my knowledge) Visitors to your website may encounter it. Do you not care that your visitors may be seeing ads? You're also leaking what your visitors are reading to their ISPs and governments. Maybe you don't consider anything you write about to be remotely sensitive, but how critically do you examine that with every new piece you write? If you wrote something whi…

I agree but SSL doesn't encrypt the IP so there is that information leaked. That isn't to say don't use SSL but more it isn't 100% privacy protection from middlemen.

Yeah, it's unfortunate that it doesn't hide the IP address you connect to. But my thinking is: for someone to hypothetically get in trouble for reading my blog if I don't use SSL, their ISP/government just needs to inspect the packets they receive and scan for particular words or phrases, and they'll have hard proof that the person accessed a particular article. If I use SSL, those governments must have specifically flagged my web server's IP address, and they won't have any hard proof about what content was accessed.

So while it's not perfect, it's pretty good, and a very low investment for me as a website owner :)

Re: Why I no longer have an old-school cert on my HTTPS site

#320

Post by bandrami »

akerl_ wrote: post #265
bandrami wrote: post #260

Earlier quoted context omitted.

Phishers also got EV certs. The big problem with PKI is that there are known bad (or at least sketchy) actors on the big CA lists that realistically can't be taken off that list.

What's an example? We're in an era where browsers have forced certificate transparency and removed major vendor CAs when they've issued certificates in violation of the browsers' requirements. The concern about bad/sketchy CAs in the list feels dated.

Look at the list of state actors in your certificates bundle, for a start
Post reply on HN