13 ms·

Government shutdown: TLS certificates not renewed, many websites are down

87 points by sanqui 8y ago

nodesocket 8y ago
Nasa.gov[1] and justice.gov[2] resolving and have valid TLS certificates for me. > In the end, nothing good will come out of this shutdown. Some people believe increasing border security and funding to reduce crime, reduce sex trafficking, and better protect border agents and law enforcement as good. [1] https://www.ssllabs.com/ssltest/analyze.html?d=nasa.gov&latest [2] http://ssllabs.com/ssltest/analyze.html?d=justice.gov&latest
- lowercased 8y ago
  There's been little disagreement about the broader idea of "increasing border security". Poll I saw the other day showed (IIRC) something like 80%+ of polled people saw a need for 'increased border security'. The phrase is incredibly broad. What is in dispute is what to spend money on, but I suspect you already know that.
- danso 8y ago
  Border security is part of all the previously passed funding resolutions.
- JamesBarney 8y ago
  It seems like the two things that should be taken under consideration when taking the government hostage is, "is it worth it", and "can we win". I personally don't think border security is that important but I understand lots of people feel differently. But I really don't think the Republicans can win this argument. When they controlled both houses and the presidency they couldn't pass the wall funding. So I'm not sure why they think they can do it after losing the houses. Especially since this politically hurts them among independents far more than it hurts the Democrats.
aboutruby 8y ago
From reddit: > This article is overly hyperbolic. Some obscure subdomains of government websites are serving expired x509 certificates. They're not down and this definitely doesn't compromise the encryption that protects any login credentials. Anyway, it is embarassing to see certificate renewal is not automated - it's something any good sysadmin would have set up. https://www.reddit.com/r/technology/comments/aeps41/government_shutdown_tls_certificates_not_renewed/ https://www.reddit.com/r/technology/comments/aeps41/governme...
- TomK32 8y ago
  I've dealt with expired ssl certs on api servers run by school districts and no, they don't automate this stuff, neither do i for my own servers, shamefully.
  - lowercased 8y ago
    i did some work for my state, and I couldn't automate ssl stuff, because the dept who handled the certs didn't provide for automation to be consumed - I got emailed certs (IIRC - been a couple of years now). By contrast, for most projects, I have standard cert/le automatically updating every 2-3 months. LE was just becoming a thing a couple years ago, and they'd never heard of it. I'm not saying they should all use LE, but the initial time investment of providing an automated process to renew and update via API would pay dividends in the long run (but the people that feel that the most don't have the clout/power to lobby for such things, usually).
    - theartfuldodger 8y ago
      I work with many large health and insurance companies, although we recommend that this be automated and are fully capable, internal IT staff at the companies seem to need to complicate the matter for job security and require they are involved although we do all the certain, often they are delayed in action due to either incompetence or other job duties. Not surprising to me to see this is the case for local and federal govt too.
- 8y ago
TomK32 8y ago
My bet what will trigger the next recession proper was on Brexit, but 45 is beating the Brits to it. Not shabby for a temper tantrum. This week I read up on Reagan's firing of 11000 flight controllers because the union that formerly supported him demanded better working conditions. It took a decade for air traffic control to regain the old levels.
- tossaccount123 8y ago
  Trump is asking for less than 1/1000 of our annual budget for border security. We spend 10x that on foreign aid annually. This entire thing is political BS over what amounts to a rounding error while congress almost unanimously approved $38 billion in money for Israel
  - TomK32 8y ago
    As a European I find the US system to bind packages of laws slightly idiotic. The current fight is about a few sticks of steel yet unrelated federal agencies are cut off their funding. This is sabotage!
    - dtech 8y ago
      Wait until you hear about the debt limit [1] [1] https://www.youtube.com/watch?v=KIbkoop4AYE https://www.youtube.com/watch?v=KIbkoop4AYE
    - rplst8 8y ago
      They don't have to do it this way. They call the packages Omnibus bills and its supposed to be some sort of way to make the process more efficient and strike deals. You get your pet project and I get mine. https://en.m.wikipedia.org/wiki/Omnibus_bill https://en.m.wikipedia.org/wiki/Omnibus_bill
  - atonse 8y ago
    Maybe we can stop being obtuse? The senate can end this by passing a budget and override the president's veto. They're choosing not to.
npapag7 8y ago
I am afraid this is the beggining of the collapse of Us standard of living. Developer with 20 years of experience from greece and PhD. Working for goverment for 6 dollars per hour.
bartread 8y ago
Serious question for US members of HN: how do you tolerate these shutdowns? I mean, apart from the loss of services, including websites, it seems like many federal workers aren't being paid. Will they be paid back after the shutdown impasse is resolved or is the money they didn't/couldn't earn lost to them. This seems unfair and, in the meantime, how are they supposed to go about their lives? Overall it seems potentially damaging and disruptive for any organisation or individuals with dependencies on the government. The reason I ask is I've been turning over what it might look like if a similar situation occurred in the UK, where it'a difficult to envisage a scenario that doesn't end with rioting in the streets.
- thaumasiotes 8y ago
  > Serious question for US members of HN: how do you tolerate these shutdowns? > Overall it seems potentially damaging and disruptive for any organisation or individuals with dependencies on the government. Most people do not have dependencies on the government. You could live through a shutdown without noticing it had happened if not for the news coverage.
  - aaronbrethorst 8y ago
    Not if you enjoy eating food or flying. Or are dependent on SNAP benefits. Or are a Native American. Or are trying to use constituent services with a freshman member of Congress. https://www.npr.org/2019/01/09/683642605/how-is-the-shutdown-affecting-america-let-us-count-the-ways https://www.npr.org/2019/01/09/683642605/how-is-the-shutdown...
    - ta8347 8y ago
      "Most people"
    - Spivak 8y ago
      Last I checked, grocery stores and restruants are still open and planes are still in the sky. The remainder are people who are on the invisible end of society. This isn't to say that the shutdown isn't a big deal but it should be grounded in the reality of who and what it actually affects. The typical American could, at this point, realistically not notice anything is happening if it weren't for the news.
foolzcrow 8y ago
The government is so useless we didn't even notice them being gone over at my place.
foolzcrow 8y ago
Yes very are fucking free. God damn the government is truly incompetent.
lgregg 8y ago
It’s been interesting reading the public info posted for furloughed employees. For example, I didn’t know that Equifax has a workforce management division and that they manage parts of NASA’s workforce.
davidhyde 8y ago
They should have used Lets Encrypt. TLS certificate renewal should be completely automated. No excuse.

87 points by sanqui 8y ago

Nasa.gov[1] and justice.gov[2] resolving and have valid TLS certificates for me. > In the end, nothing good will come out of this shutdown. Some people believe increasing border security and funding to reduce crime, reduce sex trafficking, and better protect border agents and law enforcement as good. [1] https://www.ssllabs.com/ssltest/analyze.html?d=nasa.gov&latest [2] http://ssllabs.com/ssltest/analyze.html?d=justice.gov&latest

lowercased 8y ago
There's been little disagreement about the broader idea of "increasing border security". Poll I saw the other day showed (IIRC) something like 80%+ of polled people saw a need for 'increased border security'. The phrase is incredibly broad. What is in dispute is what to spend money on, but I suspect you already know that.
danso 8y ago
Border security is part of all the previously passed funding resolutions.
JamesBarney 8y ago
It seems like the two things that should be taken under consideration when taking the government hostage is, "is it worth it", and "can we win". I personally don't think border security is that important but I understand lots of people feel differently. But I really don't think the Republicans can win this argument. When they controlled both houses and the presidency they couldn't pass the wall funding. So I'm not sure why they think they can do it after losing the houses. Especially since this politically hurts them among independents far more than it hurts the Democrats.

aboutruby 8y ago

From reddit: > This article is overly hyperbolic. Some obscure subdomains of government websites are serving expired x509 certificates. They're not down and this definitely doesn't compromise the encryption that protects any login credentials. Anyway, it is embarassing to see certificate renewal is not automated - it's something any good sysadmin would have set up. https://www.reddit.com/r/technology/comments/aeps41/government_shutdown_tls_certificates_not_renewed/ https://www.reddit.com/r/technology/comments/aeps41/governme...

TomK32 8y ago
I've dealt with expired ssl certs on api servers run by school districts and no, they don't automate this stuff, neither do i for my own servers, shamefully.
- lowercased 8y ago
  i did some work for my state, and I couldn't automate ssl stuff, because the dept who handled the certs didn't provide for automation to be consumed - I got emailed certs (IIRC - been a couple of years now). By contrast, for most projects, I have standard cert/le automatically updating every 2-3 months. LE was just becoming a thing a couple years ago, and they'd never heard of it. I'm not saying they should all use LE, but the initial time investment of providing an automated process to renew and update via API would pay dividends in the long run (but the people that feel that the most don't have the clout/power to lobby for such things, usually).
  - theartfuldodger 8y ago
    I work with many large health and insurance companies, although we recommend that this be automated and are fully capable, internal IT staff at the companies seem to need to complicate the matter for job security and require they are involved although we do all the certain, often they are delayed in action due to either incompetence or other job duties. Not surprising to me to see this is the case for local and federal govt too.
8y ago

TomK32 8y ago

My bet what will trigger the next recession proper was on Brexit, but 45 is beating the Brits to it. Not shabby for a temper tantrum. This week I read up on Reagan's firing of 11000 flight controllers because the union that formerly supported him demanded better working conditions. It took a decade for air traffic control to regain the old levels.

tossaccount123 8y ago
Trump is asking for less than 1/1000 of our annual budget for border security. We spend 10x that on foreign aid annually. This entire thing is political BS over what amounts to a rounding error while congress almost unanimously approved $38 billion in money for Israel
- TomK32 8y ago
  As a European I find the US system to bind packages of laws slightly idiotic. The current fight is about a few sticks of steel yet unrelated federal agencies are cut off their funding. This is sabotage!
  - dtech 8y ago
    Wait until you hear about the debt limit [1] [1] https://www.youtube.com/watch?v=KIbkoop4AYE https://www.youtube.com/watch?v=KIbkoop4AYE
  - rplst8 8y ago
    They don't have to do it this way. They call the packages Omnibus bills and its supposed to be some sort of way to make the process more efficient and strike deals. You get your pet project and I get mine. https://en.m.wikipedia.org/wiki/Omnibus_bill https://en.m.wikipedia.org/wiki/Omnibus_bill
- atonse 8y ago
  Maybe we can stop being obtuse? The senate can end this by passing a budget and override the president's veto. They're choosing not to.

npapag7 8y ago

I am afraid this is the beggining of the collapse of Us standard of living. Developer with 20 years of experience from greece and PhD. Working for goverment for 6 dollars per hour.

bartread 8y ago

Serious question for US members of HN: how do you tolerate these shutdowns? I mean, apart from the loss of services, including websites, it seems like many federal workers aren't being paid. Will they be paid back after the shutdown impasse is resolved or is the money they didn't/couldn't earn lost to them. This seems unfair and, in the meantime, how are they supposed to go about their lives? Overall it seems potentially damaging and disruptive for any organisation or individuals with dependencies on the government. The reason I ask is I've been turning over what it might look like if a similar situation occurred in the UK, where it'a difficult to envisage a scenario that doesn't end with rioting in the streets.

thaumasiotes 8y ago
> Serious question for US members of HN: how do you tolerate these shutdowns? > Overall it seems potentially damaging and disruptive for any organisation or individuals with dependencies on the government. Most people do not have dependencies on the government. You could live through a shutdown without noticing it had happened if not for the news coverage.
- aaronbrethorst 8y ago
  Not if you enjoy eating food or flying. Or are dependent on SNAP benefits. Or are a Native American. Or are trying to use constituent services with a freshman member of Congress. https://www.npr.org/2019/01/09/683642605/how-is-the-shutdown-affecting-america-let-us-count-the-ways https://www.npr.org/2019/01/09/683642605/how-is-the-shutdown...
  - ta8347 8y ago
    "Most people"
  - Spivak 8y ago
    Last I checked, grocery stores and restruants are still open and planes are still in the sky. The remainder are people who are on the invisible end of society. This isn't to say that the shutdown isn't a big deal but it should be grounded in the reality of who and what it actually affects. The typical American could, at this point, realistically not notice anything is happening if it weren't for the news.

foolzcrow 8y ago

The government is so useless we didn't even notice them being gone over at my place.

foolzcrow 8y ago

Yes very are fucking free. God damn the government is truly incompetent.

lgregg 8y ago

It’s been interesting reading the public info posted for furloughed employees. For example, I didn’t know that Equifax has a workforce management division and that they manage parts of NASA’s workforce.

davidhyde 8y ago

They should have used Lets Encrypt. TLS certificate renewal should be completely automated. No excuse.