4 ms·

Correct me if I’m wrong, but is this just another measure by Cisco to block off the second hand market for the equipment?

by wyxuan 7y ago

oarsinsync 7y ago
Doubtful. Cisco software code quality isn't the best, even in their specialist fields (see the number of BGP related bugs that are patched every year, still). This looks like just another stupid bug that has already been fixed in a future release.
- tialaramex 7y ago
  Yup. They have lots of smart people, but something has been badly wrong on the code quality front for decades. I remember not long after the turn of the century doing inter-continental live debug sessions with their team because the multicast IPv6 acceleration (MLD snooping, like IGMP snooping but for IPv6) they'd shipped was completely broken in our Catalyst 3750s. As usual the authorised workaround was to disable acceleration, destroying the value added by Cisco's incredibly expensive product so I was on Transatlantic conference calls after hours trying to get them to reproduce the issue so they could actually ship us a fix.
  - olyjohn 7y ago
    My theory is that the business is more focused on getting contracts and sales, and getting in some useless magic quadrant than they are on actually providing a quality product.
mcpherrinm 7y ago
You can just get a cert (from your corporate CA, or a public one, or just some one you spin up for the purpose) to fix this issue. It's very likely just somebody harcoded a date "in the distant future" in some OpenSSL config file or script that generates the self-signed cert.
jlgaddis 7y ago
Care to explain how you think this issue is even remotely related to the grey market for Cisco products? I'm having trouble trying to come up with any link between the two. --- In my opinion, with the exception of perhaps very small networks, no one who's "doing it right" should really be affected by this issue. I can kinda maybe understand folks using self-signed certificates for VPNs but, really, if you're doing much at all with certificates you should either be running your own internal PKI and/or getting certificates by somewhere else. My previous employer had literally hundreds of devices using their own self-signed certificates (for device management) on them. Many of them were the "default" certificates that shipped on the devices, so it was the same certificate shared across hundreds of devices. As someone who gives a shit about security, that drove me absolutely nuts but no one else gave a damn. (Even worse, since nearly all of these devices used the same credentials, you'd only need to MITM one of them in order to "pwn" damn near everything on the entire network!)

Correct me if I’m wrong, but is this just another measure by Cisco to block off the second hand market for the equipment?

by wyxuan 7y ago

Correct me if I’m wrong, but is this just another measure by Cisco to block off the second hand market for the equipment?

oarsinsync 7y ago

Doubtful. Cisco software code quality isn't the best, even in their specialist fields (see the number of BGP related bugs that are patched every year, still). This looks like just another stupid bug that has already been fixed in a future release.

tialaramex 7y ago
Yup. They have lots of smart people, but something has been badly wrong on the code quality front for decades. I remember not long after the turn of the century doing inter-continental live debug sessions with their team because the multicast IPv6 acceleration (MLD snooping, like IGMP snooping but for IPv6) they'd shipped was completely broken in our Catalyst 3750s. As usual the authorised workaround was to disable acceleration, destroying the value added by Cisco's incredibly expensive product so I was on Transatlantic conference calls after hours trying to get them to reproduce the issue so they could actually ship us a fix.
- olyjohn 7y ago
  My theory is that the business is more focused on getting contracts and sales, and getting in some useless magic quadrant than they are on actually providing a quality product.

mcpherrinm 7y ago

You can just get a cert (from your corporate CA, or a public one, or just some one you spin up for the purpose) to fix this issue. It's very likely just somebody harcoded a date "in the distant future" in some OpenSSL config file or script that generates the self-signed cert.

jlgaddis 7y ago

Care to explain how you think this issue is even remotely related to the grey market for Cisco products? I'm having trouble trying to come up with any link between the two. --- In my opinion, with the exception of perhaps very small networks, no one who's "doing it right" should really be affected by this issue. I can kinda maybe understand folks using self-signed certificates for VPNs but, really, if you're doing much at all with certificates you should either be running your own internal PKI and/or getting certificates by somewhere else. My previous employer had literally hundreds of devices using their own self-signed certificates (for device management) on them. Many of them were the "default" certificates that shipped on the devices, so it was the same certificate shared across hundreds of devices. As someone who gives a shit about security, that drove me absolutely nuts but no one else gave a damn. (Even worse, since nearly all of these devices used the same credentials, you'd only need to MITM one of them in order to "pwn" damn near everything on the entire network!)