61 ms·

Bug 647959 – Add Honest Achmed's root certificate (2011)

111 points by Moral_ 11y ago

AdamGibbins 11y ago
Previous post: https://news.ycombinator.com/item?id=2463762 https://news.ycombinator.com/item?id=2463762
reedloden 11y ago
Just use Let's Encrypt. :) Signed, The guy who marked that bug report invalid.
- kuschku 11y ago
  That is not a solution for everyone, as they offer no wildcart certificates yet. Also no EV auth. At the current moment, it is questionable why some CAs – TURKTRUST comes to mind – are considered trustworthy, when they are barely more trustworthy than your random street dealer.
  - mikeash 11y ago
    Are wildcard certs still necessary if you can get a cert issued automatically with no delay?
    - ytjohn 11y ago
      Probably not for most use cases, but definitely if you have a dynamic host-based addressing scheme. In fact, my company uses a wildcard for an S3 compatible object storage service we've built in house. A wildcard cert for example.com covers any <bucketname>.example.com our users create. Going round trip on requesting and issuing certs for each bucket would add significant delays.
      - mikeash 11y ago
        Makes sense. I can't quite figure out Let's Encrypt's (what an odd construction) policy on ultimately supporting wildcard certificates, but it sounds like they're generally opposed but not completely decided. Maybe they'll end up supporting it eventually.
viraptor 11y ago
I'm really disappointed that www.honestachmed.dyndns.org/cert.der didn't work :(
- SchizoDuckie 11y ago
  That means it's up for grabs, although dyndns.org now asks $40 A YEAR?!?!?!
  - voltagex_ 11y ago
    I am still looking for an easily configurable self-hosted dynamic DNS solution. Signed updates to BIND9 are tricky. I really just want to delegate *.d.voltagex.org for when I have to move to an ISP that doesn't offer static v4/v6 IPs.
    - Yetanfou 11y ago
      Some registrars offer an API to their own (free) DNS service which makes it possible to update records automagically. An example of such is Gandi (https://gandi.net https://gandi.net), which also happens to be the one you use (according to whois). This way you're free to do any sort of DNS trickery, including simple dynamic updates through a cron job on the router. Given that you already have a domain with them and use the Gandi name servers it should be easy to set up something to do just what you want. You'll need to get an API key first, for more info check http://www.gandi.net/domain/api http://www.gandi.net/domain/api
      - majewsky 11y ago
        I use Gandi, too, for the same purpose. A bonus is that the corporate proxy at work (which blocks DynDNS domains for reasons that are beyond me) does not mind me accessing my personal server. GitHub has a script for DynDNS using the Gandi API: https://github.com/jasontbradshaw/gandi-dyndns https://github.com/jasontbradshaw/gandi-dyndns
    - LeoPanthera 11y ago
      Have you tried Hurricane Electric DNS? https://dns.he.net https://dns.he.net You can update your IP with curl!
jheriko 11y ago
i'm usually quite thick skinned about these things... and maybe I am reading too much into it, but using a stereotypically racist American/English misspelling of an arab name to convey some amount of untrustworthyness? (the same could be said about used car salesmen... but i am not one of those) this rubs me up a bit wrong... as humorous as the intent is.
- 13of40 11y ago
  > a stereotypically racist American/English misspelling I think the author of the bug was British. If you look at the user agent line at the top of the bug, the culture is "en-GB", and the phrase "who knows a bit about computers" sounds like British (or possibly Indian) English.
  - anonymfus 11y ago
    British English locale is sometimes used by people with anti-American political views.
    - 13of40 11y ago
      Huh? Citation? There's also the time stamp. When the bug was submitted, it was 4:31 AM in Alabama, but 10:31 AM in Greenwich.
    - jheriko 11y ago
      ...like the british english themselves. </stereotype> XD
  - jheriko 11y ago
    i used the slash to express that it was an option. not to explicitly state "american".
- zenir 11y ago
  It rubs me wrong that nobody here considers that maybe the guy is really called Achmed. But then the joke is on you I guess
vmorgulis 11y ago
Tor author approves: https://bugzilla.mozilla.org/show_bug.cgi?id=647959#c4 https://bugzilla.mozilla.org/show_bug.cgi?id=647959#c4
sparky_ 11y ago
Is there some context to this? I am assuming it's a parody of some then-current controversy? Edit: Appears to be a parody of Comodo issuing rogue certs. More - http://www.scmagazine.com/experts-weigh-in-on-comodo-ssl-certificate-fraud/article/199109/ http://www.scmagazine.com/experts-weigh-in-on-comodo-ssl-cer...

111 points by Moral_ 11y ago

AdamGibbins 11y ago

Previous post: https://news.ycombinator.com/item?id=2463762 https://news.ycombinator.com/item?id=2463762

reedloden 11y ago

Just use Let's Encrypt. :) Signed, The guy who marked that bug report invalid.

kuschku 11y ago
That is not a solution for everyone, as they offer no wildcart certificates yet. Also no EV auth. At the current moment, it is questionable why some CAs – TURKTRUST comes to mind – are considered trustworthy, when they are barely more trustworthy than your random street dealer.
- mikeash 11y ago
  Are wildcard certs still necessary if you can get a cert issued automatically with no delay?
  - ytjohn 11y ago
    Probably not for most use cases, but definitely if you have a dynamic host-based addressing scheme. In fact, my company uses a wildcard for an S3 compatible object storage service we've built in house. A wildcard cert for example.com covers any <bucketname>.example.com our users create. Going round trip on requesting and issuing certs for each bucket would add significant delays.
    - mikeash 11y ago
      Makes sense. I can't quite figure out Let's Encrypt's (what an odd construction) policy on ultimately supporting wildcard certificates, but it sounds like they're generally opposed but not completely decided. Maybe they'll end up supporting it eventually.

viraptor 11y ago

I'm really disappointed that www.honestachmed.dyndns.org/cert.der didn't work :(

SchizoDuckie 11y ago
That means it's up for grabs, although dyndns.org now asks $40 A YEAR?!?!?!
- voltagex_ 11y ago
  I am still looking for an easily configurable self-hosted dynamic DNS solution. Signed updates to BIND9 are tricky. I really just want to delegate *.d.voltagex.org for when I have to move to an ISP that doesn't offer static v4/v6 IPs.
  - Yetanfou 11y ago
    Some registrars offer an API to their own (free) DNS service which makes it possible to update records automagically. An example of such is Gandi (https://gandi.net https://gandi.net), which also happens to be the one you use (according to whois). This way you're free to do any sort of DNS trickery, including simple dynamic updates through a cron job on the router. Given that you already have a domain with them and use the Gandi name servers it should be easy to set up something to do just what you want. You'll need to get an API key first, for more info check http://www.gandi.net/domain/api http://www.gandi.net/domain/api
    - majewsky 11y ago
      I use Gandi, too, for the same purpose. A bonus is that the corporate proxy at work (which blocks DynDNS domains for reasons that are beyond me) does not mind me accessing my personal server. GitHub has a script for DynDNS using the Gandi API: https://github.com/jasontbradshaw/gandi-dyndns https://github.com/jasontbradshaw/gandi-dyndns
  - LeoPanthera 11y ago
    Have you tried Hurricane Electric DNS? https://dns.he.net https://dns.he.net You can update your IP with curl!

jheriko 11y ago

i'm usually quite thick skinned about these things... and maybe I am reading too much into it, but using a stereotypically racist American/English misspelling of an arab name to convey some amount of untrustworthyness? (the same could be said about used car salesmen... but i am not one of those) this rubs me up a bit wrong... as humorous as the intent is.

13of40 11y ago
> a stereotypically racist American/English misspelling I think the author of the bug was British. If you look at the user agent line at the top of the bug, the culture is "en-GB", and the phrase "who knows a bit about computers" sounds like British (or possibly Indian) English.
- anonymfus 11y ago
  British English locale is sometimes used by people with anti-American political views.
  - 13of40 11y ago
    Huh? Citation? There's also the time stamp. When the bug was submitted, it was 4:31 AM in Alabama, but 10:31 AM in Greenwich.
  - jheriko 11y ago
    ...like the british english themselves. </stereotype> XD
- jheriko 11y ago
  i used the slash to express that it was an option. not to explicitly state "american".
zenir 11y ago
It rubs me wrong that nobody here considers that maybe the guy is really called Achmed. But then the joke is on you I guess

vmorgulis 11y ago

Tor author approves: https://bugzilla.mozilla.org/show_bug.cgi?id=647959#c4 https://bugzilla.mozilla.org/show_bug.cgi?id=647959#c4

sparky_ 11y ago

Is there some context to this? I am assuming it's a parody of some then-current controversy? Edit: Appears to be a parody of Comodo issuing rogue certs. More - http://www.scmagazine.com/experts-weigh-in-on-comodo-ssl-certificate-fraud/article/199109/ http://www.scmagazine.com/experts-weigh-in-on-comodo-ssl-cer...