7 ms·

Everyone mentioning their quick and scrappy solutions to setting up TLS termination is completely missing the spirit of the author’s letter. Did y’all even read

by mmmeff 6y ago

Everyone mentioning their quick and scrappy solutions to setting up TLS termination is completely missing the spirit of the author’s letter. Did y’all even read it?

hawski 6y ago
You're right. Commenters seem to comment based strictly on their perception of the title. I think however, that authors point was moot already - your network connected machine can't be static, it shouldn't be in years. There are constantly new RCE's and other exploits since ages. Your network connected machine must be maintained, whether it's a basic web server or your phone.
- pmlnr 6y ago
  > your network connected machine can't be static, it shouldn't be in years. Why not? Imagine if it's a purpose built webserver on a microcontroller[^1] which only serves strictly static pages or text files. [^1]: http://tuxgraphics.org/electronics/200611/embedded-webserver.shtml http://tuxgraphics.org/electronics/200611/embedded-webserver...
  - pwinnski 6y ago
    Then it's pwned and useless-at-best as soon as an exploit is found, and can never be updated.
- hrktb 6y ago
  Wouldn’t there be a point where we run out of readily exploitable vulnerabilities against a specific platform ? For instance if I was running a server on an 50 yo IBM framework serving static pages, how many serious attack vectors have been left unpatched at this point ? (ignoring DDOS type of issues where the content is not compromised)
  - lmm 6y ago
    There was a 26-year-old bash bug a few years back. How would you ever know when you'd found the last bug? Unless you do some formal verification of that 50yo IBM framework, I certainly wouldn't trust it to be exposed to the internet.
    - pmlnr 6y ago
      I would. It's so obscure that it deflects script kiddies with just that and the serious ones would break anything anyway.
      - lmm 6y ago
        You're modeling ability as a binary when it's more like a bell curve. Most attackers are somewhere in the middle and old systems are going to be most vulnerable to them.
- josteink 6y ago
  > There are constantly new RCE's and other exploits since ages. And many/most of them connected to the TSL/HTTPS-stack, due to the complexity it brings.
White_Wolf 6y ago
You might be right but still let me see if can get this analogy right: The author is upset that we have to build a new house and we can't live in the old huts because they are not considered safe anymore. The scrappy solution would be to to keep the hut as it is and build a wall around it. You still risk someone jumping over the fence though.
- La1n 6y ago
  I think in this analogy the issue I see it that we treat a one-man hut and airport terminal the same. For some buildings it's fine to have higher risks than others. Of course people would need to be educated on those risks, which would probably be the biggest issue.
  - Avamander 6y ago
    > Of course people would need to be educated on those risks, which would probably be the biggest issue. Frankly, that's impossible in any reasonable timeframe compared to just not allowing unsafe "huts".
- toyg 6y ago
  It’s more that you can’t live in a house now, you have to stay in a flat built and continuously maintained by others. Where before you could have built a simple, sturdy, and drafty castle that would stand for centuries, now you get a flat in a modern super-secure condo, which is very energy-efficient but requires constant maintenance not to crumble and decay.
  - pja 6y ago
    Every building needs upkeep. Whether it’s a castle or a cottage. If you don’t keep up the repairs, eventually the roof fails, rain gets in & then it’s a relatively quick slide into total ruin.
    - toyg 6y ago
      Some upkeep =/= having to repaint the whole thing every 3 months.
user5994461 6y ago
You mean the point that "you could have set up a web server in 2000 and it could still be running today, working perfectly well" Try to setup a windows 98 machine as a web server and see how it goes (Windows XP only came out in 2002). It doesn't do HTTP/1.1 so it's good question whether clients would be able to connect at all.
- isabelc 6y ago
  Windows XP came out in 2001.
- morganvachon 6y ago
  > Try to setup a windows 98 machine as a web server and see how it goes Windows 98 was a client OS, it was never intended for this. A proper test would be Windows NT 4.0 Server. Or more realistically for the time frame, Solaris 7 or 8.
  - anthk 6y ago
    W98 had a simple HTTP home server available for install, as did BeOS I think. Nothing comparable to Apache/IIS, but it was a thing. Obviously forget about any security.
  - snowwrestler 6y ago
    Any web server software set up in 2000 and still running today unpatched could be pwned quickly. Including and especially NT 4.0. When you're running a server, TLS is not the only service you are dependent on; you're also dependent on security updates. If they're not backported, you'll need to make version upgrades. Arguably it's better to think of every piece of software running on a server like it's a service, to maintain security and performance in an Internet full of hostile actors. I don't even understand the mindset of wanting to run a live server on ancient software, aside from doing it as a hobby. In which case, it's pretty typical for such hobbies to require extra work and care. Driving around in a car from 1940s takes more maintenance work, and is less safe, than a modern car, and everyone gets that.
    - 6y ago
WilliamEdward 6y ago
Yes, making websites secure requires work and maintenance and modernisation. The author even admits this. I think i'm ok with what's being lost in this transition.

by mmmeff 6y ago

Everyone mentioning their quick and scrappy solutions to setting up TLS termination is completely missing the spirit of the author’s letter. Did y’all even read it?

hawski 6y ago

You're right. Commenters seem to comment based strictly on their perception of the title. I think however, that authors point was moot already - your network connected machine can't be static, it shouldn't be in years. There are constantly new RCE's and other exploits since ages. Your network connected machine must be maintained, whether it's a basic web server or your phone.

pmlnr 6y ago
> your network connected machine can't be static, it shouldn't be in years. Why not? Imagine if it's a purpose built webserver on a microcontroller[^1] which only serves strictly static pages or text files. [^1]: http://tuxgraphics.org/electronics/200611/embedded-webserver.shtml http://tuxgraphics.org/electronics/200611/embedded-webserver...
- pwinnski 6y ago
  Then it's pwned and useless-at-best as soon as an exploit is found, and can never be updated.
hrktb 6y ago
Wouldn’t there be a point where we run out of readily exploitable vulnerabilities against a specific platform ? For instance if I was running a server on an 50 yo IBM framework serving static pages, how many serious attack vectors have been left unpatched at this point ? (ignoring DDOS type of issues where the content is not compromised)
- lmm 6y ago
  There was a 26-year-old bash bug a few years back. How would you ever know when you'd found the last bug? Unless you do some formal verification of that 50yo IBM framework, I certainly wouldn't trust it to be exposed to the internet.
  - pmlnr 6y ago
    I would. It's so obscure that it deflects script kiddies with just that and the serious ones would break anything anyway.
    - lmm 6y ago
      You're modeling ability as a binary when it's more like a bell curve. Most attackers are somewhere in the middle and old systems are going to be most vulnerable to them.
josteink 6y ago
> There are constantly new RCE's and other exploits since ages. And many/most of them connected to the TSL/HTTPS-stack, due to the complexity it brings.

White_Wolf 6y ago

You might be right but still let me see if can get this analogy right: The author is upset that we have to build a new house and we can't live in the old huts because they are not considered safe anymore. The scrappy solution would be to to keep the hut as it is and build a wall around it. You still risk someone jumping over the fence though.

La1n 6y ago
I think in this analogy the issue I see it that we treat a one-man hut and airport terminal the same. For some buildings it's fine to have higher risks than others. Of course people would need to be educated on those risks, which would probably be the biggest issue.
- Avamander 6y ago
  > Of course people would need to be educated on those risks, which would probably be the biggest issue. Frankly, that's impossible in any reasonable timeframe compared to just not allowing unsafe "huts".
toyg 6y ago
It’s more that you can’t live in a house now, you have to stay in a flat built and continuously maintained by others. Where before you could have built a simple, sturdy, and drafty castle that would stand for centuries, now you get a flat in a modern super-secure condo, which is very energy-efficient but requires constant maintenance not to crumble and decay.
- pja 6y ago
  Every building needs upkeep. Whether it’s a castle or a cottage. If you don’t keep up the repairs, eventually the roof fails, rain gets in & then it’s a relatively quick slide into total ruin.
  - toyg 6y ago
    Some upkeep =/= having to repaint the whole thing every 3 months.

user5994461 6y ago

You mean the point that "you could have set up a web server in 2000 and it could still be running today, working perfectly well" Try to setup a windows 98 machine as a web server and see how it goes (Windows XP only came out in 2002). It doesn't do HTTP/1.1 so it's good question whether clients would be able to connect at all.

isabelc 6y ago
Windows XP came out in 2001.
morganvachon 6y ago
> Try to setup a windows 98 machine as a web server and see how it goes Windows 98 was a client OS, it was never intended for this. A proper test would be Windows NT 4.0 Server. Or more realistically for the time frame, Solaris 7 or 8.
- anthk 6y ago
  W98 had a simple HTTP home server available for install, as did BeOS I think. Nothing comparable to Apache/IIS, but it was a thing. Obviously forget about any security.
- snowwrestler 6y ago
  Any web server software set up in 2000 and still running today unpatched could be pwned quickly. Including and especially NT 4.0. When you're running a server, TLS is not the only service you are dependent on; you're also dependent on security updates. If they're not backported, you'll need to make version upgrades. Arguably it's better to think of every piece of software running on a server like it's a service, to maintain security and performance in an Internet full of hostile actors. I don't even understand the mindset of wanting to run a live server on ancient software, aside from doing it as a hobby. In which case, it's pretty typical for such hobbies to require extra work and care. Driving around in a car from 1940s takes more maintenance work, and is less safe, than a modern car, and everyone gets that.
  - 6y ago

WilliamEdward 6y ago

Yes, making websites secure requires work and maintenance and modernisation. The author even admits this. I think i'm ok with what's being lost in this transition.