6 ms·

Maybe browsers should put up a warning when a certificate is about to expire; say two weeks away. Nobody should let their certificate get that close to expirin

by ta8645 6y ago

Maybe browsers should put up a warning when a certificate is about to expire; say two weeks away. Nobody should let their certificate get that close to expiring, but if it does, you'd rather it generate a lot of visible warnings before simply ceasing to work at all.

hannob 6y ago
Browsers are very careful in introducing warnings to users that are meant to go to admins. They dislike the indirect "but users will complain to admins" route and I can't blame them - every warning a user will see and not understand leads to warning fatigue.
diggan 6y ago
Or how about the responsible engineers/testers/managers/whatevers setup proper testing infrastructure for the multi-million projects run by their huge international corporate? Feels like it's not a lot to ask for the most basic testing like checking when certs expire, setup automation to renew it and have fail-safes/error reporting in case the renewal fails.
- KingOfCoders 6y ago
  Tests can have bugs too.
  - diggan 6y ago
    Indeed, that's true! Not only you have to write the tests, you also have to verify it's working, and have monitoring connected to ensure it's continuously working. But still, multi-million companies should surely be able to handle that.
    - KingOfCoders 6y ago
      Verify that it is working after changes, with a test? What is testing that test?
      - diggan 6y ago
        If you change something, don't you manually check that it's actually doing what you want it to? If I was an engineer changing a test regarding SSL certs expiry time, after a change, I'd test it with a cert that has expired, about to expire and one far in the future. Manually or automated doesn't really matter, but test your changes after you've done them. Really basic stuff.
        KingOfCoders 6y ago
        My point was, there is no way to guarantee bugfreeness in any way. You can reduce bugs by automating and another test layer, but each new layer can have bugs too. Even if you prove the code to be correct, you only proved your assumptions of the requirements which might be wrong (both your assumptions and the requirements). Because the comment said something like: There was a bug, so they didn't have a test, why don't they? And I replied: Tests can have bugs too.
  - s1k3s 6y ago
    It's partially cloudy in NY today.
    - KingOfCoders 6y ago
      It is it is!
nkrisc 6y ago
I don't agree. A cert that is just about to expire is as valid as one that's new. It only has two states: expired or not. For the user is either expired or not, they needn't be concerned until it actually is expired.
tfsh 6y ago
Crowd sourcing errors by relying on user generated reports is sometimes a good idea, however in this instance it's not. Cert expiry is something that can be automated and monitored because the expiry is deterministic. Crowd sourcing is for the non-deterministic.
mgkimsal 6y ago
perhaps a plugin which admins can add to their browsers to act as a reminder for themselves? having core browsers warn the general public about this all the time will lead to chaos.

by ta8645 6y ago

hannob 6y ago

Browsers are very careful in introducing warnings to users that are meant to go to admins. They dislike the indirect "but users will complain to admins" route and I can't blame them - every warning a user will see and not understand leads to warning fatigue.

diggan 6y ago

Or how about the responsible engineers/testers/managers/whatevers setup proper testing infrastructure for the multi-million projects run by their huge international corporate? Feels like it's not a lot to ask for the most basic testing like checking when certs expire, setup automation to renew it and have fail-safes/error reporting in case the renewal fails.

KingOfCoders 6y ago
Tests can have bugs too.
- diggan 6y ago
  Indeed, that's true! Not only you have to write the tests, you also have to verify it's working, and have monitoring connected to ensure it's continuously working. But still, multi-million companies should surely be able to handle that.
  - KingOfCoders 6y ago
    Verify that it is working after changes, with a test? What is testing that test?
    - diggan 6y ago
      If you change something, don't you manually check that it's actually doing what you want it to? If I was an engineer changing a test regarding SSL certs expiry time, after a change, I'd test it with a cert that has expired, about to expire and one far in the future. Manually or automated doesn't really matter, but test your changes after you've done them. Really basic stuff.
      - KingOfCoders 6y ago
        My point was, there is no way to guarantee bugfreeness in any way. You can reduce bugs by automating and another test layer, but each new layer can have bugs too. Even if you prove the code to be correct, you only proved your assumptions of the requirements which might be wrong (both your assumptions and the requirements). Because the comment said something like: There was a bug, so they didn't have a test, why don't they? And I replied: Tests can have bugs too.
- s1k3s 6y ago
  It's partially cloudy in NY today.
  - KingOfCoders 6y ago
    It is it is!

nkrisc 6y ago

I don't agree. A cert that is just about to expire is as valid as one that's new. It only has two states: expired or not. For the user is either expired or not, they needn't be concerned until it actually is expired.

tfsh 6y ago

Crowd sourcing errors by relying on user generated reports is sometimes a good idea, however in this instance it's not. Cert expiry is something that can be automated and monitored because the expiry is deterministic. Crowd sourcing is for the non-deterministic.

mgkimsal 6y ago

perhaps a plugin which admins can add to their browsers to act as a reminder for themselves? having core browsers warn the general public about this all the time will lead to chaos.