Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I no longer have an old-school cert on my HTTPS site

rachelbythebay.com

Post reply on HN
Print view View original

421–430 of 437 posts

Re: Why I no longer have an old-school cert on my HTTPS site

#421

Post by Sammi »

josephg wrote: post #420
Sammi wrote: post #407

Earlier quoted context omitted.

There are easy workarounds to getting bigints in JSON: https://github.com/GoogleChromeLabs/jsbi/issues/30#issuecomm...

Sure; and I can encode maps and sets as entry lists. Binary data as strings and so on. But I don’t want to. I shouldn’t have to. The fact remains that json doesn’t have native support for any of this stuff. I want something json-like which supports all this stuff natively. I don’t want to have to figure out if some binary data is base64 encoded or hex encoded or whatever, and hack around jackson or serde or javascrip…

Agree. JSON definitely needs an update so we can get better ergonomics built in.

In code you control you can choose to use JSON5: https://json5.org/

Re: Why I no longer have an old-school cert on my HTTPS site

#422

Post by tomhow »

distantsounds wrote: post #133
Arnavion wrote: post #122

If you want to actually implement an ACME client from first principles, reading the RFC (plus related RFCs for JOSE etc) is probably easier than you think. I did exactly that when I made a client for myself. I also wrote up a digested description of the issuance flow here: https://www.arnavion.dev/blog/2019-06-01-how-does-acme-v2-wo... It's not a replacement for reading the RFCs, but it presents the information in th…

[flagged]

Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes.

Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something.

https://news.ycombinator.com/newsguidelines.html

Re: Why I no longer have an old-school cert on my HTTPS site

#423

Post by josephg »

Sammi wrote: post #421
josephg wrote: post #420

Earlier quoted context omitted.

Sure; and I can encode maps and sets as entry lists. Binary data as strings and so on. But I don’t want to. I shouldn’t have to. The fact remains that json doesn’t have native support for any of this stuff. I want something json-like which supports all this stuff natively. I don’t want to have to figure out if some binary data is base64 encoded or hex encoded or whatever, and hack around jackson or serde or javascrip…

Agree. JSON definitely needs an update so we can get better ergonomics built in. In code you control you can choose to use JSON5: https://json5.org/

Cool. Pity it still doesn’t support bigint, binary data, maps, sets, non-string keys or dates though.

Re: Why I no longer have an old-school cert on my HTTPS site

#424

Post by chipsa »

shiandow wrote: post #304
kangalioo wrote: post #139

Earlier quoted context omitted.

But what's wrong with sending the number as a string? `"65537"` instead of `"AQAB"`

Converting large integers to decimal is nontrivial, especially when you don't trust languages to handle large numbers. Why you wouldn't just use the hexadecimal that everyone else seems to use I don't know. There seems to be a rather arbitrary cutoff where people prefer base64 to hexadecimal.

Size: base 64 is 2/3 the number of bytes as hex.

Re: Why I no longer have an old-school cert on my HTTPS site

#425

Post by mholt »

wlonkly wrote: post #378
benlivengood wrote: post #237

Apache (is anyone else still using that?) now ships with an official ACME module, which is nice. Professionally it's been cert-manager. I haven't paid for a TLS certificate in almost a decade I guess.

The Caddy[1] webserver also has built-in ACME. It has all the problems Rachel mentioned, of course, because now it's an ACME client embedded in an even bigger piece of software, but it's handy for sure! I don't know much about Caddy scalability but it's worked great for my personal sites. [1] https://caddyserver.com/

It scales to hundreds of thousands of sites.

Re: Why I no longer have an old-school cert on my HTTPS site

#426

Post by tialaramex »

skissane wrote: post #414
tialaramex wrote: post #34

One of the things this gestures at might as well get a brief refresher here: Subject Alternative Name (SAN) is not an alternative in the sense that it's an alias, SANs exist because the X.509 certificate standard is, as its name might suggest, intended for the X.500 directory system, a system from the 20th century which was never actually deployed. Mozilla (back then the Netscape Corporation) didn't like re-inventing…

> the X.500 directory system, a system from the 20th century which was never actually deployed X.500 really was deployed – never at the scale the designers originally intended, as a single global directory system – but, as an enterprise directory system, yes it was – and it still survives in that role today, albeit as a legacy niche. LDAP is a direct descendant of X.500 – it was basically taking the X.500 Directory A…

That's fair, there's a bunch of LDAP at the large organisation I work for - and yes even if in some cases the technology today no longer has any idea it's descended from an X.500 system it's very obvious when you see O=Foo OU=Bar that we're looking at the exact same directory concept.

I was thinking about the global directory rather than individual local X.500 instances but I didn't say that explicitly and I should have.

Re: Why I no longer have an old-school cert on my HTTPS site

#427

Post by oneplane »

lmz wrote: post #262
oneplane wrote: post #107

Earlier quoted context omitted.

Imagine writing your own security software when there are proven systems that just take that problem out of your hands so you don't need to complain about it.

I'm agreeing with you that the author is complaining too much. Going the other way they would probably go "and then we have to somehow encode the numbers '1 2 840 113549 1 1' somehow to mark the key type".

I'm agreeing with you in agreeing that the author is complaining too much. I suppose I could have worded it better.

Re: Why I no longer have an old-school cert on my HTTPS site

#428

Post by Moni_Mac »

mkup wrote: post #325
nickf wrote: post #282

Earlier quoted context omitted.

ZeroSSL is owned by Identrust, but the infra is operated by another CA. Also Microsoft killed EV codesigning early last year - not stopping it working, just making it identical to ‘normal’ codesigning certs.

Could you please provide more info on this topic, e.g. a link? I intended to buy EV code signing certificate as a sole proprietor to fix long-standing problem with my software when Windows Defender pops up every time I release a new version. Is EV code signing certificate no longer a viable solution to this problem? Is there no longer a difference between EV and non-EV code signing certificate?

After Microsoft's March 2024 update, EV Code signing certs don't offer instant Microsoft Defender reputation. Now, OV and EV both code signing certificates can be installed and stored on FIPS 140 Level 2 or Common Criteria EAL 4+ certified HSM, tokens, or cloud HSMs. So, you can consider EV Code Signing as higher security and higher validation with no more difference. If u want to buy code signing at affordable cost, I recommend: https://signmycode.com/cheap-code-signing-certificates

Re: Why I no longer have an old-school cert on my HTTPS site

#429

Post by egorfine »

imtringued wrote: post #316
Y_Y wrote: post #119

Earlier quoted context omitted.

Fixing all of those at once might be a bit too much to ask, but I have some quick suggestions. I'd say for a more robust JSON you could try Dhall. If you just want to exchange lumps of data between programs I'd use Protobuf. If you want simple and freeform I'd go with good old sexps. https://github.com/dhall-lang/dhall-lang https://protobuf.dev/ https://en.wikipedia.org/wiki/S-expression

Suggesting protobuf as alternative to JSON is crazy talk.

And this is why I was asking the question in the first place.

Not that I'm a fan of JSON, but I fail to conceive anything better as a general purpose protocol.

Re: Why I no longer have an old-school cert on my HTTPS site

#430

Post by immibis »

tialaramex wrote: post #340
immibis wrote: post #330

Earlier quoted context omitted.

Still sounds better than nothing. And gives companies an incentive to register under their actual names.

I'm not convinced on either, the mindless automation is always effective so you just don't need to think about it, whereas for EV you need to intimately understand exactly which transactions you verified and what that means - the login HTML was authentic but you didn't check the Javascript? The entire login page was checked but HTTP POST of your password was not? The redirect to payment.mybank.example wasn't checked?…

Why would you have to verify every transaction? If the page is from Big Bank Corp Of America, they're responsible for the whole page. Including any Javascript viruses they ill-advisedly include on their page.
Post reply on HN