Technology

59963 readers

3330 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

354

Let's Encrypt Announces New-Certificate-Every-6-Days Offering (letsencrypt.org)

submitted 2 days ago by misk@sopuli.xyz to c/technology@lemmy.world

101 comments fedilink hide all child comments

via https://it.slashdot.org/story/24/12/15/0059216/lets-encrypt-announces-new-certificate-every-6-days-offering

you are viewing a single comment's thread
view the rest of the comments

[–] jagged_circle@feddit.nl -4 points 1 day ago* (last edited 1 day ago) (1 children)

What part are you confused about, and are you a developer?

Edit: why was I downvoted for asking this?

[–] semi@lemmy.ml 12 points 1 day ago (1 children)

I'm a developer and would appreciate you going into more specifics about which certificates you suggest pinning.

[–] jagged_circle@feddit.nl 6 points 1 day ago* (last edited 1 day ago) (2 children)

I'm saying that if you're a developer of software that communicates between two nodes across the internet, you shouldn't rely on X.509 because the common root stores have historically been filled with compromised CAs, which would let someone with that CA decrypt and view the messages you send with TLS.

You should mint your own certs and pin their fingerprints so that your application will only send messages if the fingerprint of the cert on the other end matches your trusted cert.

[–] semi@lemmy.ml 6 points 1 day ago

OK, so cases where you control both ends of the communication. Thanks for the clarification.

[–] Pieisawesome@lemmy.world 3 points 1 day ago (2 children)

And your software stops functioning after X years due to this.

Don’t do this, this is a bad idea.

[–] TarantulaFudge@startrek.website 1 points 7 hours ago

Technically all certificates are pinned, especially with public CAs, most OS package the latest CA certs which will all go out of style within 10 years or so. You can see this by loading up any old distro or defunct version of windows.

[–] jagged_circle@feddit.nl -5 points 1 day ago (1 children)

Yeah, fuck the users. We can just slap "100% secure" on the box and who cares if some woman is raped and murdered because we decided not to follow best security practices, right? /s

[–] cheesemoo@lemmy.world 7 points 1 day ago

That's a hell of a leap there chief.