I'm glad to see people move off old browsers, in general.
I'm glad to see people move off old browsers, in general. SHA1 is far from the biggest problem with Windows XP SP2; in fact, I'd probably say SHA1 is one of the most secure aspects of the OS. The actual weaknesses in SHA1 which have been identified are very serious, but still requiring on the order of 2^61 operations to cause a collision, and there is a fairly indirect path between hash collision and end of the world for many protocols. The problem I have is how Google is doing this. There was a pretty clearly announced date. Google used a random browser meeting's minutes to make what is essentially a major policy change, and then assumed CAs would notify their customers. The victims here are end users and site operators; CAs benefit because people buy new certs (and at worst, it's customers who have already bought something which breaks...). There was no real incentive for CAs to communicate with sites, and they're not really known as responsive businesses anyway. Doing this with effect during the holiday season is kind of the definition of dick move. Pushing it out 6 mo wouldn't have appreciably hurt the SHA1 migration efforts, but would have dramatically reduced pain for end users and site admins. Providing direct notice to the world (such as this blog post), so users and site admins would actually see it, is how notice should be given; not an obscure forum or relying on CAs with no business interest.
Posted by rdl on Sep 5, 2014, 11:16 PM
Tags
Related issues
- > Because they don't believe the disasters were inflicted by them.
- Hehe, yeah I'm not sure when John Stewart would have worked there or what the pain points were for him, but he worked there for a bit.
- https://www.apple.com/shop/product/mxcl3ll/a/magic-keyboard-...
- If first-order hybrids made up only a small proportion of the total population of humans and Neanderthals, then the probability that a pa...
- Well, I'd be interested to hear what some of those nuances are, personally.
- My biggest Amazon annoyance.
Raise real-world problems, find people facing the same issue, and discuss solutions.9,000 issues0 comments
hackernews (E-commerce)
> Because they don't believe the disasters were inflicted by them.
Hehe, yeah I'm not sure when John Stewart would have worked there or what the pain points were for him, but he worked there for a bit.
https://www.apple.com/shop/product/mxcl3ll/a/magic-keyboard-...
If first-order hybrids made up only a small proportion of the total population of humans and Neanderthals, then the probability that a pa...
Well, I'd be interested to hear what some of those nuances are, personally.
My biggest Amazon annoyance.
> There's not really an unmet need for innovation in broadband delivery; the issue is running new wires broadband has costs, and in a lot...
Speaking of Amazon's account process, I have a really annoying problem with theirs.
I'm glad to see people move off old browsers, in general.
I'm glad to see people move off old browsers, in general. SHA1 is far from the biggest problem with Windows XP SP2; in fact, I'd probably say SHA1 is one of the most secure aspects of the OS. The actual weaknesses in SHA1 which have been identified are very serious, but still requiring on the order of 2^61 operations to cause a collision, and there is a fairly indirect path between hash collision and end of the world for many protocols. The problem I have is how Google is doing this. There was a pretty clearly announced date. Google used a random browser meeting's minutes to make what is essentially a major policy change, and then assumed CAs would notify their customers. The victims here are end users and site operators; CAs benefit because people buy new certs (and at worst, it's customers who have already bought something which breaks...). There was no real incentive for CAs to communicate with sites, and they're not really known as responsive businesses anyway. Doing this with effect during the holiday season is kind of the definition of dick move. Pushing it out 6 mo wouldn't have appreciably hurt the SHA1 migration efforts, but would have dramatically reduced pain for end users and site admins. Providing direct notice to the world (such as this blog post), so users and site admins would actually see it, is how notice should be given; not an obscure forum or relying on CAs with no business interest.
Comments (0)
No comments yet. Start the discussion.