hg35h4

"I can't immediately think of a reason why you'd need a publicly trusted certificate if you're pinning a specific public key"

Inter-finance systems mostly, some government. Sometimes they pin the CA issuer, sometimes IP based although with dynamic cloud IPs that is disappearing, sometimes inside a VPN, and other times just the cert issues themselves. Same service handing public users while making bidirectional API calls to other interfaces that are more locked down.

Not everyone is a monolithic copy and paste Wordpress hosting site, a new cloud native cash rich startup, or a massive Google/Amazon/Microsoft with huge teams to orchestrate everything using their own architecture and systems they developed themselves. Private PKI? Even more orchestration layers for enrollment especially in places with BYOD.

There is no point to low expiry certs anyways. If a server is hacked, the primary concern is what data were they able to exfiltrate and for how long - not that a keypair was maybe stolen to be used in a very complicated and unlikely attack to intercept some of the same data they already stole.

Your ATC comment seems to continue your theme that everyone should run a private PKI instead. Airports are full of interconnections between themselves, other airports, airlines, ground crews, satellite relays, and weather monitoring systems. So then all these parties need to do all the same actions as the public PKI - root key signing , cert issue logging, secure interface for issuing certs, develop a trust across all parties and make them install your root in all their systems ..... or, just use the public PKI services which already does that. You are just reinventing the wheel and probably will get it wrong. Maybe for some strictly backend systems, or things like server out of band management it works well, but not anything involving multiple companies.

The CAs work with large and complex business understand these complexes and voted for 2 year duration. The owners of the browsers just wanted to further their own cloud bottom lines.

"Alternatively, if companies cannot handle the rotation, then they likely should re-evaluate if WebPKI is even appropriate for their use-case."

I hate hearing this awful take, as if every IT organization has the same neat and tidy systems deployed as they do. Never had to deal with 3rd party SaaS vendors certificate pinning requiring service tickets to change, don't have any hardware devices or appliance based software images each with their own web interface to update certs...

Yes companies should have a plan to do their minimum yearly certificate rotates. Yes those companies should have a security plan to rotate affected certificate issues, but in those cases the business users are ok with an outage to remediate a real security issue.

But what happened here is that Digicert invalided the entire domain's worth of certs. All those service.companyname.com certs or duplicates under that domain validation were affected in bulk. In some companies there could be thousands of certs under that domain. Digicert screwed up their system implementation and made their customers suffer.

"It's really disheartening that publicly trusted CAs just ignore their contractual obligations however they see fit."

It's also disheartening to see browsers in the CA consortium ignore the CA resolutions as well. Like how everyone voted for 2 year certs and Apple did their own thing anyways. Any punishment for Apple come? So why pick on the others?

Still not free-riding when you consider the data they are collecting from viewers even with ad-blockers. People still have accounts to save channels/videos, lots of people or households have Android phones that makes it stupidly easy to link to people, places and purchases. There is significantly more value they still gain from it even if youtube itself operates at a loss.

Maybe if they weren't allowed to collect so much information, or had to pay back the users they are collecting data on could I see the point that ad-blocking is free-riding.

You are only looking at one small part. Total immigration affecting housing & jobs are regular immigrants + temporary foreign workers + students (who often also work and have had most work restrictions removed). Each group also has their own path to citizenship. Our government is unfortunately targeting >500,000 per year even though housing cannot catch up. When people have kids they take almost 20 years to need their own space, direct adult immigration like this takes a housing unit away from an already tight market.

Everything about this sounds terrible for mobile, lossy or even medium latency connections. Non-blocking background updates are unnoticeable, but imagine your website being jammed like a stuck video every time you click or scroll?

He describes a "please wait buffering" future of web software. No thanks.

Doesn't work since big tech all works together to crush dissent and anything that goes against their business model.

Look at how attacked any right wing site is - they go after their ISPs, their CDNs, their DNS registrars, their hosting companies.

The Internet has got to the point that you cannot even operate a business if it goes against the "values" of big tech, or they chop all your arms off.

Traditional media companies vs big tech oligarchs.

Not sure which I dislike more. Liars and thieves the lot of them. Can they both lose for our sakes?

Good thing they aren't making rockets with this stuff. Or if they are they have controls to take over. Oh wait....

It was a fine simple solution until DoH. In some internal environments the internal traffic volume can be much higher than the few services that might be publicly exposed.

Sure lots of ways you could do it - get a fat edge firewall to hairpin the traffic + support Internet access but you end up paying a lot more for all the threat licenses on the oversized edge. Could add many more tiers, maybe more translations or overlays... but why bother with a lot more complexity or especially more cost just because someone saw a threat in another country and are trying to solve a problem that does not apply to most.

Further more there can be internal only host names that are now getting probed and exposed externally. Exfiltration to a US company in the name of "security"

It's horrible for environments with split horizon DNS. It presumes that the only network that should exist are home users consuming public Internet cloud services.

For privacy it's a discussion of do I trust my obnoxious non-US ISP or a US based .com with seeing all my browsing habits based on DNS queries. At least I could have legal recourse with my ISP in my own country, and there is slightly better privacy laws.

   ]D=.~. S=.

I thought I was looking at a sendmail config file at first!

> I have a GSuite legacy account for my personal domain name. Most of my family is on it. It was free.

Oh boy they've been really trying to push people off GSuite legacy hard. I started missing incoming emails, testing would show a server error about a high email flow for maybe a dozen per day. Zero support, and they erased my posts on their support board. You can't change the primary domain as free, you can't use any email diag tools, you can't do anything.

I ended up moving to Zoho. Sure it's not free, but it's not outrageous for personal/family use. Decent migration tools as well. It really started a hard de-Googlification. I nix any chatter about using Google at work now as well.