17 ms·
Federal HTTPS domains that'll expire soon because of US government shutdown
- cordonbleu 8y agoI recall something about domain squatting being mitigated a little while ago, but what if someone was to somehow squat on all these domains and or certificates? that would be a big issue.
- tomohawk 8y agoAutomated renewal with letsencrypt is a thing. Blaming this on the shutdown rather than on not taking appropriate care to do this more robustly? Meh.
- jlarocco 8y agoTechcrunch doesn't load for me after I started blocking cookies, but is it about the renewal or paying for it? Automation doesn't matter if the spending isn't approved.
- umanwizard 8y agoThe article sort of implies both. > because so many federal workers have been sent home on unpaid leave — or worse, working without pay but trying to fill in for most of their furloughed department — expired certificates aren’t getting renewed. Renewing certificates doesn’t take much time or effort — sometimes just a click of a mouse. But some do cost money, and during a government shutdown there isn’t any. My personal guess is that the author of the article doesn't know which it is.
- smsm42 8y agoI am usually all for privatization but having .gov CA and issuing new certs without any spending sounds like something that would be a sensible idea even for the most hardcore libertarian. I don't see why government must buy certificates in retail instead of just having its own authority (which it has anyway in .gov domain btw).
- pavlov 8y agoThe employees tasked with clicking the "Renew Certificate" button every X months probably have no idea how they'd go about that. As a contracting project, I imagine it would be pretty expensive to upgrade every single website of the US federal government to use Let's Encrypt. How many different operating systems and web server setups there must be?
- tomohawk 8y agoMy point is that said employees / contractors should have a better plan than having to be there at a certain time to push a button. That's planning for failure. What if the contract has a problem? It happens. What if the approving official is out sick for a month? It happens. Not knowing how to set these things up? I don't really think that's an excuse. This should be addressed in the requirements.
- pavlov 8y agoFederal agencies have made websites for the past 25 years. Let's Encrypt launched in 2016. It's bleeding-edge technology as far as public sector requirements go.
- deleted 8y ago[deleted]
- beat 8y agoMethinks a lot of the eyerolling about not using Let's Encrypt is coming from people who have never touched a real legacy system in their lives.
- tomohawk 8y agoSpecifying requirements for uptime is not new. Federal agencies have many failure modes that are different than private sector, but those who work there know about them. Purchasing a 1 year cert can be extremely challenging, depending on the agency, due to procurement rules, etc. For such an important part of a site to be neglected when the above is known - an eye roll is about all the respect that can be afforded to it. Source: I've worked in and with the federal government for more than 25 years.
- merlincorey 8y ago> Automated renewal with letsencrypt is a thing. The article mentions it is a thing in the following cases: """Any website that’s hosted on cloud.gov, search.gov or federalist.18f.gov won’t go down as they rely on Let’s Encrypt certificates that automatically renew every three months."""
- jonas21 8y agoNot using Let's Encrypt automated renewal isn't necessarily due to a lack of care. Some of the sites listed use EV certificates, which aren't supported by Let's Encrypt. And using Let's Encrypt for automated renewal comes with risks of its own. Note, for example, that very few of the "major sponsors" listed on the Let's Encrypt website use Let's Encrypt for their own sites.
- jteppinette 8y agoWhat risks? Major sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. I don’t know why, but marketing usually doesn’t want engineering anywhere near their public sites...
- dvtrn 8y agoMajor sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. Immensely curious how you came about this conclusion of all the possibilities available
- jteppinette 8y agoMy experience working at tech companies. Also, not assuming that sponsors of Let’s Encrypt don’t trust their certificates.
- res0nat0r 8y agoI currently work for a fortune 5 company, we're not using letsencrypt yet because my team currently doesn't have the manpower to migrate our automation and code to something such as this. Note that I want to move to LE as soon as possible, but we're not on it yet, and folks citing that something like this is easily fixable in a snap just isn't informed on how things actually are working in real world environments.
- noir_lord 8y ago
- setum 8y ago> But some do cost money, and during a government shutdown there isn’t any.
- CydeWeys 8y agoAutomated renewal only works so long as your servers doing said renewal continue working. This is by no means guaranteed. How long do you think the average company's IT infrastructure would continue working if all employees instantly dropped dead? With no one to respond to any issues that crop up, and nothing that isn't 100% automated happening at all?
- jammygit 8y agoI was wondering something for a project I'm considering. If I build a web app for somebody and move on, am I even doing them a favour unless I maintain it for years too? Not experienced enough to have an answer
- umanwizard 8y agoIf it's a job, then that's their problem, just like how if I pay someone for a car, I still have to get the oil changed forever. If you're doing it for free as a favor for a non-technical friend then yes, almost certainly you will need to do at least some maintenance work in the future.
- rhizome 8y agoThat's what maintenance contracts are for.
- egwor 8y agoMost of the stuff that I wrote in my last job was designed to keep going whatever. I didn't want to be disturbed with issues and as a tiny team we automated and fixed everything that was likely to cause us issues. I left >6mo go and it is still running without issues now. If a box dies it flips to another box on another data centre etc.
- CydeWeys 8y agoThat's not truly unattended though, as there's still plenty of people working in that datacenter keeping things up and running. It's easy to have services working unattended for a long time when someone else is responsible for maintaining the hardware; even better if they're maintaining the OS updates too. Now if all the datacenter staff are furloughed too ... the first usually trivial issue might take everything down.
- Karunamon 8y agoWee bit misleading - this is about cert expiration, not domain expiration.
- jessriedel 8y agoNot just misleading, literally wrong based on the plain meaning of the words.
- jamieweb 8y agoI bet that domain names will be expiring too... of course the .gov domains should be fine as it's a restricted TLD, but many government organisations have other non-.gov domains too.
- aboutruby 8y agoisitdoneyet.gov Really?
- givehimagun 8y agoLooks like its a food safety website from the USDA recommending cooking temperatures. Is It Done Yet makes sense.
- rhacker 8y agoWell, except that it doesn't make sense for them to actually have a domain for it. The domain does a 301 directly to a page within the usda.gov site. The domain itself doesn't even come up on a search for isitdoneyet, instead just the forwarded page does. So no, while the content is useful, having a separate domain and SSL certificate, really isn't useful.
- function_seven 8y agoWhat's the URL for the 301 destination? (No cheating, I want to know from memory :)
- naniwaduni 8y agoYou can print "isitdoneyet.gov" on a PSA poster (like, on paper) and have people be able to type that into their browser. https://www.fsis.usda.gov/wps/portal/fsis/topics/food-safety-education/teach-others/fsis-educational-campaigns/is-it-done-yet https://www.fsis.usda.gov/wps/portal/fsis/topics/food-safety... not so much. An extra domain and a cert are essentially costless if you're managing more than a handful already, so what's the probem?
- sdfaaaaadfasd 8y ago> so what's the probem? muh small government
- dooglius 8y agoIt's a memorable URL, which I'd say is pretty useful.
- rebuilder 8y agoI'm not seeing a lot of sites that actually handle private data for the majority of users.
- woofcat 8y agoIs techcrunch.com now for people who are hard of sight? That's a massive font.
- maccio92 8y agowell most technies in silicon valley are painfully short-sighted
- nimbius 8y agoDisclosure: im a full-time diesel engine mechanic. my shop was due for a round of vessel inspections for our waste and fresh oil holding tanks last friday, but, no EPA. Without these inspections we can not technically order new oil or have oil recycled, because the EPA signoff is required as part of cradle-to-grave handling of hazmat substances. so how do we get around it? we now have half our back parking lot filled with 55 gallon drums of waste byproduct from engine work, which can be shipped without an EPA cert to recyclers. This is also outright illegal if it gets big enough, but we've been declaring it as required by the EPA. since we cant schedule a formal review of that either, we confirm the storage with their hotline for doing so, and since thats not staffed and the voicemail box is full, I have been mailing Kodak pictures and printed descriptions of the storage. our full-site inspection is due feb 2nd...without it, the federal government (if it were running) would cite us for a flagrant violation and shut us down. The guy who does that inspection called us and confirmed hes quitting to work for...of all places...the company that recycles our oil.
- el_benhameen 8y agoEvery time I read one of your comments I think “is that the same diesel guy?”, and so it is. You always have some of the most interesting things to say here.
- veb 8y agoHe has a tag 'diesel mechanic' on Momento: https://chrome.google.com/webstore/detail/momento-for-hacker-news/ldamdlljpkkejoiohakbapncdjfolgfh https://chrome.google.com/webstore/detail/momento-for-hacker... - it's actually pretty handy! :)
- femto113 8y agoI really wish browsers would deemphasize certificate expiry as a problem (say to just an ! on the lock icon)--it is literally meaningless from a cryptographic security perspective. I also think it is misleading users about the usefulness of certificates, since neither browsers nor certificate vendors track or report things that do meaningfully impact security, e.g. if the company that originally bought the certificate was sold to EvilCorp or the server has been compromised by hackers.
- kakarot 8y ago> it is literally meaningless from a cryptographic security perspective. Care to elaborate?
- jaytaylor 8y agoThey're probably trying to say the connection will still be securely encrypted, albeit without the guarantee that communication is between you and the party / identity you expect on the other end (possible MITM attack scenario).
- Kalium 8y agoThat strikes me as potentially a non-trivial difference.
- abugheratwork 8y agoI think it's one of those arguments that disappears once you account for context. No, the datestamp doesn't affect the quality of the encryption. Yes, it might matter if the last time this certificate was vouched for was 100 years ago for one year.
- Kalium 8y agoI mean, I'm one of those crazy people who thinks constantly auto-renewed certs with a one-hour lifetime are a good idea. Though really only achievable when you're working with a private CA, unfortunately. With a sufficiently short lifetime, you can throw up another barrier to compromises.
- belorn 8y agoI would be much more interested in domain names that will expire. If funding is stopped one would guess that domain registrars might start allowing some names to expire, which then anyone can try to catch.
- jacoblsievers 8y agoI doubt that "anyone" can grab a .gov address.
- belorn 8y agoI was more considering all the multitude of other domain names. Just like companies, government agencies and departments tend to have a lot of domains spread out on multiple registrars, tld's, and for many different reasons. It can be to cover misspellings, one-time projects, awareness campaign, and so on.
- empath75 8y agoYou can’t register .gov domains that way.
- systematical 8y agoJesus. I don't know who I am more disappointed in. The baby in the white house or the ones in the house.
- dragontamer 8y agoGenerally speaking: I blame the side which veto's the clean CR. In 2018, that was the Democrats for example, who veto'd the clean CR in hopes to pass immigration reform. Fortunately, that shutdown was pretty short. In 2019, there is a clear party which is refusing the clean CR agreement.
- ozi 8y agoyou mean the senate? the house has passed several spending bills since the shutdown. the senate won't bring them to a vote.
- daebersold 8y agoNevermind it would have taken 2 seconds to setup a cron job to autorenew their SSLs. Typical government.
- Karunamon 8y agoAssuming they were using best practices and something like LetsEncrypt (unlikely) or even a larger outfit that implements ACME (do those even exist yet?). No, more likely, there's a sysadmin somewhere that's furloughed, has the reminders in his inbox, and has to kick off an arduous procurement process involving three layers of bureaucratic horseshit involving five signoffs each, and at least a 60 day window before Verisign nee Symantec gets paid an exhorbitant amount of money and issues the all important bit of code. No doubt this is exaggerated, but I firmly believe that government/large enterprise procurement is one of the levels of hell. Take something that should be a simple, five minute process and stack layers upon layers of nonsense on top.
- flukus 8y agoMaybe designing things to break periodically without intervention wasn't such a good idea.
- fareesh 8y agoThe US government shutdowns of the past have seemed like political posturing over budgets, but this time the situation seems genuinely important - I have read so much about the gangs and violence and trafficking that is taking place in the border region. It's surprising that your politicians are able to take a genuine issue like this and turn it into a political one. It's also surprising that common people want the border to be unprotected. What sense does it make?
- asdff 8y agoWhat you've been reading has been a gross mischaracterization on the issues. Less than one half of one percent of border patrol agents surveyed by the Senate Homeland Security committee want a wall (1), and that's because a wall won't change the situation. It is well known that the overwhelming majority of illegal immigrants arrived by legal means through a port of entry and overstayed their visa. It is also well known that immigrant populations in the united states commit less crime per capita than native born populations. The whole idea of the wall has been around since Mexico declared independence from Spain, and has long been rooted in racism and fear, not fact or data (2) 1. https://www.nytimes.com/2019/01/05/us/politics/donald-trump-border-wall.html?emc=edit_th_190106&nl=todaysheadlines&nlid=879446810106 https://www.nytimes.com/2019/01/05/us/politics/donald-trump-... 2. https://www.sandiegouniontribune.com/news/nation-world/ct-mexico-border-wall-history-20190110-story.html#nws=mcnewsletter https://www.sandiegouniontribune.com/news/nation-world/ct-me...
- lamarpye 8y agoI want a wall because I think the reducing the supply of unskilled labor will tend to raised wages for unskilled workers in the United States.
- asdff 8y agoActually, the supply of unskilled labor is too low. On agriculture, large corporate farms like Tyson Foods can afford to invest in automation to deal with the lack of labor supply (1), however, many employers of unskilled labor do not have the resources that Tyson Foods does. Limiting immigration has never been good for the economy (2). When farmers cannot hire enough people to harvest a crop, the field goes fallow, and the farm folds. 1. https://www.nytimes.com/2018/11/20/us/farmworkers-immigrant-labor-robots.html?emc=edit_ca_20181121&nl=california-today&nlid=8794468120181121&te=1 https://www.nytimes.com/2018/11/20/us/farmworkers-immigrant-... 2. https://www.nytimes.com/2018/09/02/business/trump-legal-immigration-h1b-visas.html?action=click&module=RelatedCoverage&pgtype=Article®ion=Footer https://www.nytimes.com/2018/09/02/business/trump-legal-immi...
- deleted 8y ago[deleted]
- smaslennikov 8y agoMy favourite part is that some of these sites are effectively blocked by chrome due to HSTS (e.g. manufacturing.gov), which renders them unusable for most.
- smsm42 8y agomanufacturing.gov has 1-year cert ending on Jan 14. Why didn't they create a new one in November 2018? It's not like Jan 14 coming is any kind of surprise. I can understand where snowfall takes a city by surprise - after all, it's hard to predict when exactly the snow would fall. But it's kinda easy to predict when January 14th would happen. Why didn't they prepare? I'm not even saying why they don't have .gov CA with auto-renewal infrastructure - that'd be too much to ask. But at least some foresight?
- Symbiote 8y agoMinor inconveniences like this should reduce support for the government shutdown. Also, isn't this the longest ever?
- williesleg 8y agoNobody gives a shit. Except the media.
- NicoJuicy 8y agoI know that political subject are not wanted. But I have never seen the return between the wall, Trump and his real estate mentioned. Is it plausibel that he wants a shutdown, so he can earn more money by building a wall?
- peterwwillis 8y agoTaking this opportunity to again expound about how not all websites need HTTPS: First, most of these are basically info portals. Nobody is trying to steal or corrupt the data points for the fiscal budget expenditures this year, or the report on residential heating in remote arctic villages. In addition, none of the data is secret or private. So the data doesn't need to be protected. The other reason people say everything needs HTTPS is not data security, but attacks on the client. If you use HTTP, someone can subvert the packets to inject malware into your client, etc. But this would be impossible if the browsers had methods to cryptographically verify the data's integrity without needing to keep it private. In other words a checksum, possibly even out-of-bound. This can be done securely and without the need to constantly expire and re-issue a certificate, and it also enables several useful technologies which require inspection and passing of data content in different scenarios. Finally, the increased dependence on encryption for all communication makes our communication more fragile, and this is a great example. In the future, if everything uses https, and certs expire, either most of the content of the web will expire, or if we allow clients and tools to not verify certificates, we undermine the purpose of the certificates to begin with. Let's Encrypt cron jobs will not work forever (if you don't upgrade, eventually the crypto you were using for your cert will become obsolete), network operations can be attacked to prevent re-signing, not every domain has a server that runs cron jobs, there's no guarantee Let's Encrypt will be around forever, and it may not work in non-US countries. Unrelated, but I also think expiring certificates can be worked around. They force you to expire and re-sign them because they could get cracked or (less likely) the private key could leak. But certificates can also be revoked at any time. As far as I can tell, it's not possible to tell if a certificate has been revoked if an attacker doesn't want you to be able to tell, since PKI has to work offline. So you could be getting pwned all the way up to the cert expiring. Instead, we could simply expire certificates when we want to rotate them, rather than letting them auto-die and catch unaware admins with their pants around their ankles. Some people say we need to get rid of PKI, but I don't think that's a good idea. Rather than throw the baby out with the bath water, let's improve the baby. That goes for the registrars, CAs and DNS, too. (The way cert signing happens today is, I think, a bit of a joke, and registrars need to play a more key role)
- choward 8y agoMisleading title. I thought the domains were expiring and was wondering what that had to do with HTTPS. Their SSL certificates are expiring, not the domains.