11 ms·

Or you just set a calendar reminder up ahead of time or have something like nagios set up to bug you when you get close. Why make "expiration date" not mean ex

Or you just set a calendar reminder up ahead of time or have something like nagios set up to bug you when you get close. Why make "expiration date" not mean expiration date? If my driver's license expires and I drive, I'm breaking the law. Sure, a judge or cop could be lenient, but there is no legal requirement (or justification?) for them to do so.

Retric 11y ago
You can generally keep driving a car for a few days after failing an inspection so you can take it to get fixed with minimal issues. EX: Cracked headlight, increases risks of a problem in the long term, but if it's working right now it's generally not an actual issue. IMO, tossing up a quick warning for the next month after expiration seems like a reasonable solution. Sure, something failed, but expired certificates are almost never a sign of a real problem.
- jimktrains2 11y ago
  > You can generally keep driving a car for a few days after failing an inspection so you can take it to get fixed with minimal issues. How does this have anything to do with the issue? With a mechanical object, you have risks and probability of failure. The certificate or driver's license or credit card doesn't _fail_, it expires.
  - Retric 11y ago
    It fails otherwise it would still be valid. The question is how you Handel failure. An expired certificate is clearly a lower risk than a revoked sertificate, so only haing one failure mode regardless of cause is unnessisary. PS: With an expired license the number of days past expiration is important in most states. Wait long enough and you need to retake the driving test, so clearly before that point it's still somewhat valid.
    - jimktrains2 11y ago
      > It fails otherwise it would still be valid. You're confusing things. The validation fails, as in it doesn't meet a certain requirement, the certificate; it isn't damaged or otherwise broken. A mechanical object fails in that it takes physical damage. You're striving for some semantic technicality to save your argument and I just don't think it's important. > An expired certificate is clearly a lower risk than a revoked certificate, so only having one failure mode regardless of cause is unnecessary. Why? You're just throwing an assertion out there that is false and expecting me to believe it's true. Additionally, if there is a 2-day window where an invalid certificate is valid, then all that does is make the expiration date 2-days into the future. If the certificate's owner doesn't notice an invalid certificate until after it doesn't validate, then they won't notice until after the window anyway. > PS: With an expired license the number of days past expiration is important in most states. Wait long enough and you need to retake the driving test, so clearly before that point it's still somewhat valid. That doesn't mean an expired license is valid. That simply means there is an implicit expiration date for the validity of your driver's exam.
      - Retric 11y ago
        > Why? Your not limited to a single response. You could turn the URL red for a week and then after that do a popup etc. hell you could stup a browser to ignore expiration dates with minimal impact. Remember, certificates are not some binary entity. You can have high and low trust certificates ex: trust to sign OS code, trust to sign user land code etc. Your stuck in binary terms which are useless from a security standpoint.
        jimktrains2 11y ago
        > You could turn the URL red for a week and then after that do a popup etc. And what does this buy you? Nothing, honestly. It just means that the expiration date is a week in the future from the date on the certificate. _You aren't actually changing the problem, just renaming it._ We could show red a week before the certificate is set to expire _now_; what does a grace period buy anyone? Also, there are still have users that don't understand how to check if you have an SSLed connection, and you expect them to make a judgment on if an expired certificate is safe? > hell you could setup a browser to ignore expiration dates with minimal impact. No, no you couldn't. This means that if an old key, or one you've lost, is compromised, someone would be able to impersonate you, and you may be _unable_ to revoke a certificate. At least now, there is a definite amount of time that a scenario like that could happen for, you're proposing it happen indefinitely. Moreover, it also becomes a forced upgrade requirement, viz sha2 certs currently. Sure, some longer-lived certificates may not have been updated (or supported currently), but they're not the rule. Most sites updated though a matter of course and never realized the security implications. Additionally, the revocation status of expired certificates isn't currently published. Granted, this is a bureaucratic decision, it keeps the CRL size much smaller than it would be otherwise. (And again, it assumes you still have the keys to revoke an old certificate!) > Your stuck in binary terms which are useless from a security standpoint. Right, security isn't a binary thing. However, it is often based upon binary things, as they are easy to check, understand, and present. I also resent you calling me "stuck" when you're essentially asking for the exact same thing, just differently.

Retric 11y ago

You can generally keep driving a car for a few days after failing an inspection so you can take it to get fixed with minimal issues. EX: Cracked headlight, increases risks of a problem in the long term, but if it's working right now it's generally not an actual issue. IMO, tossing up a quick warning for the next month after expiration seems like a reasonable solution. Sure, something failed, but expired certificates are almost never a sign of a real problem.

jimktrains2 11y ago
> You can generally keep driving a car for a few days after failing an inspection so you can take it to get fixed with minimal issues. How does this have anything to do with the issue? With a mechanical object, you have risks and probability of failure. The certificate or driver's license or credit card doesn't _fail_, it expires.
- Retric 11y ago
  It fails otherwise it would still be valid. The question is how you Handel failure. An expired certificate is clearly a lower risk than a revoked sertificate, so only haing one failure mode regardless of cause is unnessisary. PS: With an expired license the number of days past expiration is important in most states. Wait long enough and you need to retake the driving test, so clearly before that point it's still somewhat valid.
  - jimktrains2 11y ago
    > It fails otherwise it would still be valid. You're confusing things. The validation fails, as in it doesn't meet a certain requirement, the certificate; it isn't damaged or otherwise broken. A mechanical object fails in that it takes physical damage. You're striving for some semantic technicality to save your argument and I just don't think it's important. > An expired certificate is clearly a lower risk than a revoked certificate, so only having one failure mode regardless of cause is unnecessary. Why? You're just throwing an assertion out there that is false and expecting me to believe it's true. Additionally, if there is a 2-day window where an invalid certificate is valid, then all that does is make the expiration date 2-days into the future. If the certificate's owner doesn't notice an invalid certificate until after it doesn't validate, then they won't notice until after the window anyway. > PS: With an expired license the number of days past expiration is important in most states. Wait long enough and you need to retake the driving test, so clearly before that point it's still somewhat valid. That doesn't mean an expired license is valid. That simply means there is an implicit expiration date for the validity of your driver's exam.
    - Retric 11y ago
      > Why? Your not limited to a single response. You could turn the URL red for a week and then after that do a popup etc. hell you could stup a browser to ignore expiration dates with minimal impact. Remember, certificates are not some binary entity. You can have high and low trust certificates ex: trust to sign OS code, trust to sign user land code etc. Your stuck in binary terms which are useless from a security standpoint.
      - jimktrains2 11y ago
        > You could turn the URL red for a week and then after that do a popup etc. And what does this buy you? Nothing, honestly. It just means that the expiration date is a week in the future from the date on the certificate. _You aren't actually changing the problem, just renaming it._ We could show red a week before the certificate is set to expire _now_; what does a grace period buy anyone? Also, there are still have users that don't understand how to check if you have an SSLed connection, and you expect them to make a judgment on if an expired certificate is safe? > hell you could setup a browser to ignore expiration dates with minimal impact. No, no you couldn't. This means that if an old key, or one you've lost, is compromised, someone would be able to impersonate you, and you may be _unable_ to revoke a certificate. At least now, there is a definite amount of time that a scenario like that could happen for, you're proposing it happen indefinitely. Moreover, it also becomes a forced upgrade requirement, viz sha2 certs currently. Sure, some longer-lived certificates may not have been updated (or supported currently), but they're not the rule. Most sites updated though a matter of course and never realized the security implications. Additionally, the revocation status of expired certificates isn't currently published. Granted, this is a bureaucratic decision, it keeps the CRL size much smaller than it would be otherwise. (And again, it assumes you still have the keys to revoke an old certificate!) > Your stuck in binary terms which are useless from a security standpoint. Right, security isn't a binary thing. However, it is often based upon binary things, as they are easy to check, understand, and present. I also resent you calling me "stuck" when you're essentially asking for the exact same thing, just differently.