11 ms·

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders gets it's way. Especially with the W3C marginalized and a mix of corporations and corporate-centric standards groups running things now. Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.

derefr 7y ago
CAs have always been third-party services, though. Their APIs just used to involve humans talking to humans, rather than machines talking to machines. But that's no less of an operational dependency. In a systems engineering plan (e.g. a NASA long-term project), both kinds of dependencies are considered liabilities that must be engineered for long-term reliability, fault-tolerance, etc.
- superkuh 7y ago
  In the past browsers did not scaremonger so much about self-signed certs and search engines would index sites that were just http and this didn't effect their ranking.
  - gruez 7y ago
    >In the past browsers did not scaremonger so much about self-signed certs That's necessary because people tend to be fixated on whatever task they're doing, and that causes them to click pass any warnings regardless of risk or comprehension.
  - benibela 7y ago
    Search engines have stopped listing http sites? Since when? I do not have https for my site (unclear if sourcefoge allows https for custom domains)
  - threeseed 7y ago
    I can't tell if you are serious here. You want self signed certs to be trusted and the web to move back to the days of HTTP where anybody could just intercept your traffic ?
    - gsich 7y ago
      That's not what he said.
- luckylion 7y ago
  It's different if you can "buy" a cert and be "safe" for a few years vs needing to renew it every 90 days. If they choose not to renew your cert, you're out after what ever time is left on your cert. Let's lower that to 60 ... 45 ... 15 .. ah, let's just renew all certs every day, that's the only way to keep control centralized.
jhoechtl 7y ago
I am telling you there is a conspiracy going on to end the open and free web. We should fiercefully start to fight back otherwise those who made the internet great (the open source hackers working on LAMP) will loose everything.
- diminish 7y ago
  Does apple try to kill the web? Does Google try to take it over? Why doesn't Apple kill a million sh.tty apps just trying to grab attention doing nothing useful? It's time to get rid of Apple/Google browsers really
- Reelin 7y ago
  I'll agree that modern mainstream browsers (and devices!) have an increasingly centralized security model that isn't at all conducive to an open web. But given the current state of the FOSS ecosystem, I'm not terribly concerned in the long term so long as the network layer remains open to all. (Consider: QtWebEngine, PinePhone, SiFive, OpenTitan, IPFS, DAT, Solid, ...)
  - Mirioron 7y ago
    I think the web is already a lost battle. It'll just take time (a lot of it) for the control to fully sink in. But I think that once this control becomes mainstream then there will be something else with more freedom. Some form of an alternate internet that will have barriers to entry. Something like tor. It'll probably be based on p2p.
    - dublin 7y ago
      Gab's rework of Mastodon is starting to look like this.
  - cutler 7y ago
    How is the network layer open when legit SMTP servers with proper SPF records are blacklisted by Google and Microsoft with no accountability. The internet is owned by these organisations. It's a fait accompli. It's only a matter of time before sites not hosted on cloud platforms become blacklisted due to the pitfalls of self-hosted certification. Jeeezus.
bad_user 7y ago
With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting services like Netlify or GitHub Pages are now providing HTTPS certificates and installing it on your own server is pretty painless, if you're into managing your own server. And if your hosting provider doesn't support Let's Encrypt, you can always put Cloudflare in front of it. So I don't really understand what you're talking about, when the price and ongoing maintenance of HTTPS certificates has gone significantly down for hobbyists.
- superkuh 7y ago
  >So I don't really understand what you're talking about, That's because you didn't finish reading my post. >Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.
  - threeseed 7y ago
    You mean like how it has been for decades ? You have always needed at minimum hosting, SSL and domain service providers.
    - WillPostForFood 7y ago
      You definitely didn’t need, and most sites didn’t use SSL a decade ago.
      - wbl 7y ago
        DNS you always needed.
        ryandrake 7y ago
        Not strictly necessary, but convenient. All browsers I know of allow you to browse to an IP address.
snek 7y ago
You already have to rely on a third party to get a domain (and to get an IP address)
- TeMPOraL 7y ago
  Every additional third party is an extra problem. It's an extra relationship to track.
jchw 7y ago
> Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future. I mean... How do you expect to have a valid, trusted TLS certificate without a third party? Nobody says it has to be Lets Encrypt or Cloudflare or Amazon load balancers or ... so forth. Some certificate authorities even already have APIs....
- mikedilger 7y ago
  No third party is strictly necessary. You have to know what the servers public key is in a reliable way. That doesn't necessarily mean a third party has to be involved. Maybe you call them on the phone and check the fingerprint. Maybe it's your server and you sneakernet the key to your client. And to appease the dumb protocol you wrap it up as a certificate (self-signed) and accept yourself as trustworthy (what a concept!). Even if you use a third party, it doesn't have to be some big company that everybody is functionally obligated to trust. It could be a mutual friend making an introduction. And certificates are not the only or necessarily the right solution to this problem in all domains. For example, if you have to go and check OCSP every time to see if the certificate might have been revoked, then you are relying on an online trusted source; but if you have an online trusted source, why don't they just tell you the current key and dispense with the certificate mechanism altogether? X.509 was designed for X.500 and concepts that were relevant for X.500 continue to plague us all. I deployed corporate PKIs back in the 1990s for Sun and Pfizer and worked with other clients. What I remember best from those times was how ridiculous the whole thing is, over-engineered by parties who clearly didn't keep focus on the fundemental problem that public key cryptography is meant to solve.
  - xg15 7y ago
    For the more concrete goal of having a valid TLS certificate that is trusted by browsers, you absolutely need a third party however.
  - jchw 7y ago
    My point is that this news item does not change reliance on a third party at all. Not that it’s impossible to exist.
greglindahl 7y ago
What about people who want to share information about things they love with privacy and security? This change seems likely to enhance my privacy and security.
est31 7y ago
You can always run your own company-internal or limited-to-your-home CA and add it as custom root CA to every browser in that domain. These maximum certificate validity rules IIRC don't affect custom root CAs you added. I agree with you that the web is being commercialized, but limiting certificate lifetimes isn't the problem. It's rather stuff like the .org domain sale, google amp, Chrome killing the file:// protocol (after all, html files don't have ads inside them, can't be indexed and they don't make any money for Google), FLOSS projects adopting discord, etc.
jsjddbbwj 7y ago
Sorry if this sounds dumb but this is a non sequitur for me. How does the for-profit web benefit from being able to revoke certificates? And why does revocation not work in practice? I thought all major browsers check their own lists to see if certs are revoked
- hoistbypetard 7y ago
  This paper: https://cseweb.ucsd.edu/~schulman/docs/imc15-revocation.pdf https://cseweb.ucsd.edu/~schulman/docs/imc15-revocation.pdf is slightly dated but gives a very good rundown of how revocation checks fail in practice along with different attempts to improve them.
cutler 7y ago
Fsck certificates, period. Make an exception for ecommerce and banking sites but leave the rest of us alone. Certificates have become the equivalent of the UK's national policy of building road humps 50 metres apart to thwart speeding drivers.

derefr 7y ago

CAs have always been third-party services, though. Their APIs just used to involve humans talking to humans, rather than machines talking to machines. But that's no less of an operational dependency. In a systems engineering plan (e.g. a NASA long-term project), both kinds of dependencies are considered liabilities that must be engineered for long-term reliability, fault-tolerance, etc.

superkuh 7y ago
In the past browsers did not scaremonger so much about self-signed certs and search engines would index sites that were just http and this didn't effect their ranking.
- gruez 7y ago
  >In the past browsers did not scaremonger so much about self-signed certs That's necessary because people tend to be fixated on whatever task they're doing, and that causes them to click pass any warnings regardless of risk or comprehension.
- benibela 7y ago
  Search engines have stopped listing http sites? Since when? I do not have https for my site (unclear if sourcefoge allows https for custom domains)
- threeseed 7y ago
  I can't tell if you are serious here. You want self signed certs to be trusted and the web to move back to the days of HTTP where anybody could just intercept your traffic ?
  - gsich 7y ago
    That's not what he said.
luckylion 7y ago
It's different if you can "buy" a cert and be "safe" for a few years vs needing to renew it every 90 days. If they choose not to renew your cert, you're out after what ever time is left on your cert. Let's lower that to 60 ... 45 ... 15 .. ah, let's just renew all certs every day, that's the only way to keep control centralized.

jhoechtl 7y ago

I am telling you there is a conspiracy going on to end the open and free web. We should fiercefully start to fight back otherwise those who made the internet great (the open source hackers working on LAMP) will loose everything.

diminish 7y ago
Does apple try to kill the web? Does Google try to take it over? Why doesn't Apple kill a million sh.tty apps just trying to grab attention doing nothing useful? It's time to get rid of Apple/Google browsers really
Reelin 7y ago
I'll agree that modern mainstream browsers (and devices!) have an increasingly centralized security model that isn't at all conducive to an open web. But given the current state of the FOSS ecosystem, I'm not terribly concerned in the long term so long as the network layer remains open to all. (Consider: QtWebEngine, PinePhone, SiFive, OpenTitan, IPFS, DAT, Solid, ...)
- Mirioron 7y ago
  I think the web is already a lost battle. It'll just take time (a lot of it) for the control to fully sink in. But I think that once this control becomes mainstream then there will be something else with more freedom. Some form of an alternate internet that will have barriers to entry. Something like tor. It'll probably be based on p2p.
  - dublin 7y ago
    Gab's rework of Mastodon is starting to look like this.
- cutler 7y ago
  How is the network layer open when legit SMTP servers with proper SPF records are blacklisted by Google and Microsoft with no accountability. The internet is owned by these organisations. It's a fait accompli. It's only a matter of time before sites not hosted on cloud platforms become blacklisted due to the pitfalls of self-hosted certification. Jeeezus.

bad_user 7y ago

With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting services like Netlify or GitHub Pages are now providing HTTPS certificates and installing it on your own server is pretty painless, if you're into managing your own server. And if your hosting provider doesn't support Let's Encrypt, you can always put Cloudflare in front of it. So I don't really understand what you're talking about, when the price and ongoing maintenance of HTTPS certificates has gone significantly down for hobbyists.

superkuh 7y ago
>So I don't really understand what you're talking about, That's because you didn't finish reading my post. >Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.
- threeseed 7y ago
  You mean like how it has been for decades ? You have always needed at minimum hosting, SSL and domain service providers.
  - WillPostForFood 7y ago
    You definitely didn’t need, and most sites didn’t use SSL a decade ago.
    - wbl 7y ago
      DNS you always needed.
      - ryandrake 7y ago
        Not strictly necessary, but convenient. All browsers I know of allow you to browse to an IP address.

snek 7y ago

You already have to rely on a third party to get a domain (and to get an IP address)

TeMPOraL 7y ago
Every additional third party is an extra problem. It's an extra relationship to track.

jchw 7y ago

> Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future. I mean... How do you expect to have a valid, trusted TLS certificate without a third party? Nobody says it has to be Lets Encrypt or Cloudflare or Amazon load balancers or ... so forth. Some certificate authorities even already have APIs....

mikedilger 7y ago
No third party is strictly necessary. You have to know what the servers public key is in a reliable way. That doesn't necessarily mean a third party has to be involved. Maybe you call them on the phone and check the fingerprint. Maybe it's your server and you sneakernet the key to your client. And to appease the dumb protocol you wrap it up as a certificate (self-signed) and accept yourself as trustworthy (what a concept!). Even if you use a third party, it doesn't have to be some big company that everybody is functionally obligated to trust. It could be a mutual friend making an introduction. And certificates are not the only or necessarily the right solution to this problem in all domains. For example, if you have to go and check OCSP every time to see if the certificate might have been revoked, then you are relying on an online trusted source; but if you have an online trusted source, why don't they just tell you the current key and dispense with the certificate mechanism altogether? X.509 was designed for X.500 and concepts that were relevant for X.500 continue to plague us all. I deployed corporate PKIs back in the 1990s for Sun and Pfizer and worked with other clients. What I remember best from those times was how ridiculous the whole thing is, over-engineered by parties who clearly didn't keep focus on the fundemental problem that public key cryptography is meant to solve.
- xg15 7y ago
  For the more concrete goal of having a valid TLS certificate that is trusted by browsers, you absolutely need a third party however.
- jchw 7y ago
  My point is that this news item does not change reliance on a third party at all. Not that it’s impossible to exist.

greglindahl 7y ago

What about people who want to share information about things they love with privacy and security? This change seems likely to enhance my privacy and security.

est31 7y ago

You can always run your own company-internal or limited-to-your-home CA and add it as custom root CA to every browser in that domain. These maximum certificate validity rules IIRC don't affect custom root CAs you added. I agree with you that the web is being commercialized, but limiting certificate lifetimes isn't the problem. It's rather stuff like the .org domain sale, google amp, Chrome killing the file:// protocol (after all, html files don't have ads inside them, can't be indexed and they don't make any money for Google), FLOSS projects adopting discord, etc.

jsjddbbwj 7y ago

Sorry if this sounds dumb but this is a non sequitur for me. How does the for-profit web benefit from being able to revoke certificates? And why does revocation not work in practice? I thought all major browsers check their own lists to see if certs are revoked

hoistbypetard 7y ago
This paper: https://cseweb.ucsd.edu/~schulman/docs/imc15-revocation.pdf https://cseweb.ucsd.edu/~schulman/docs/imc15-revocation.pdf is slightly dated but gives a very good rundown of how revocation checks fail in practice along with different attempts to improve them.

cutler 7y ago

Fsck certificates, period. Make an exception for ecommerce and banking sites but leave the rest of us alone. Certificates have become the equivalent of the UK's national policy of building road humps 50 metres apart to thwart speeding drivers.