3 ms·

Amazing. A company like Microsoft could afford to hire an entire department to do nothing but make sure certificates don't expire, but this still happens. Joke

by _bxg1 7y ago

Amazing. A company like Microsoft could afford to hire an entire department to do nothing but make sure certificates don't expire, but this still happens. Jokes aside, I don't understand how this problem hasn't been solved in the general case.

wnevets 7y ago
>I don't understand how this problem hasn't yet been solved in the general case. isn't that what ACME is suppose to do? https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment https://en.wikipedia.org/wiki/Automated_Certificate_Manageme...
- _bxg1 7y ago
  And yet
  - naikrovek 7y ago
    Microsoft are not even close to the only company this happens to. The problem is a human one - as people change positions within a company, or leave a company, responsibility for this kind of thing can fall through the cracks. Happens all the time, even if ACME is employed, and it's unlikely to ever stop happening.
    - _bxg1 7y ago
      All I'm saying is, that downtime probably cost them a lot of money, and resulted from something that's extremely preventable. Even if it is a human problem, one would think they'd allocate the resources necessary to solve it.
      - naikrovek 7y ago
        yes, in an ideal world it wouldn't happen. and if you really make it a priority you can certainly mitigate it.
hinkley 7y ago
I worked on a code signing system years ago. It was amazing to me how much of an air of mystery there was around keygen. Generating keys is just a little bit of memorization or note-taking. Protecting them once you have them was the hard part (which is why I won't make you some keys and send them to you, buddy). Initially, I made light of a requirement that we send out automated nag emails starting a couple months before the keys expired. With a bit more time and observation it became pretty clear this was a valid concern. I eventually came around, and while I didn't implement the feature, I did create the integration tests. Making certs is stupid simple. Maintaining them takes some support and we don't always have it at the ready. Remembering to do something once a year or two years isn't something we're particularly built for. We have a habit of forgetting these duties when we hand projects over to others. I wonder, has Lets Encrypt solved this?

by _bxg1 7y ago

wnevets 7y ago

>I don't understand how this problem hasn't yet been solved in the general case. isn't that what ACME is suppose to do? https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment https://en.wikipedia.org/wiki/Automated_Certificate_Manageme...

_bxg1 7y ago
And yet
- naikrovek 7y ago
  Microsoft are not even close to the only company this happens to. The problem is a human one - as people change positions within a company, or leave a company, responsibility for this kind of thing can fall through the cracks. Happens all the time, even if ACME is employed, and it's unlikely to ever stop happening.
  - _bxg1 7y ago
    All I'm saying is, that downtime probably cost them a lot of money, and resulted from something that's extremely preventable. Even if it is a human problem, one would think they'd allocate the resources necessary to solve it.
    - naikrovek 7y ago
      yes, in an ideal world it wouldn't happen. and if you really make it a priority you can certainly mitigate it.

hinkley 7y ago

I worked on a code signing system years ago. It was amazing to me how much of an air of mystery there was around keygen. Generating keys is just a little bit of memorization or note-taking. Protecting them once you have them was the hard part (which is why I won't make you some keys and send them to you, buddy). Initially, I made light of a requirement that we send out automated nag emails starting a couple months before the keys expired. With a bit more time and observation it became pretty clear this was a valid concern. I eventually came around, and while I didn't implement the feature, I did create the integration tests. Making certs is stupid simple. Maintaining them takes some support and we don't always have it at the ready. Remembering to do something once a year or two years isn't something we're particularly built for. We have a habit of forgetting these duties when we hand projects over to others. I wonder, has Lets Encrypt solved this?