4 ms·
Browsers and CAs still deciding for the user what's best with yet another centralized database that we have to "trust" is complete and implemented correctly. I
by ok_dad 4y ago
Browsers and CAs still deciding for the user what's best with yet another centralized database that we have to "trust" is complete and implemented correctly. I don't see how this is so hard: just let us download the CRLs. Maybe add them on a torrent-like system so they can be shared (and validated) peer-to-peer, or at least have hundreds or thousands of mirrors that can provide that data. All this "it's too big and the user would have to download it" bullshit is just pushing us more and more into "computing as a service"; aka: we OWN your digital life.
Edit: I was partly wrong, this is a good thing because you CAN download the CRLs now (see comments below here for info), whereas previously you couldn't. Your browser still probably won't support a full CRL download, but I could be pleasantly surprised.
- agwa 4y ago> I don't see how this is so hard: just let us download the CRLs Previously, you couldn't do this, because not all CAs published CRLs. Beginning October 1, you will be able to just download the CRLs, because Apple and Mozilla are requiring it. It's therefore unclear what your beef is,
- ok_dad 4y ago> Beginning October 1, you will be able to just download the CRLs Correction: Apple and Mozilla will be able to just download the CRLs. Not me. The link in the post SPECIFICALLY says us common plebes don't get that right.
- agwa 4y agoWhere does the post say that? If you think it's because the URLs will be disclosed in the CCADB, note that the contents of the CCADB are published here: https://www.ccadb.org/resources https://www.ccadb.org/resources Specifically, the CRL URLs can be found in this CSV file: http://ccadb-public.secure.force.com/ccadb/AllCertificateRecordsCSVFormat http://ccadb-public.secure.force.com/ccadb/AllCertificateRec...
- ok_dad 4y agoI was pretty sure this section meant what I said but maybe you can get them from that database without being a BigCo?: “Our new CRL URLs will be disclosed only in CCADB, so that the Apple and Mozilla root programs can consume them without exposing them to potentially large download traffic from the rest of the internet at large.”
- chrisfosterelli 4y agoI assumed what they meant is that the database is publicly available but that browser implementations won't be directly pulling CRLs. Instead the browser providers pull the CRLs and create a compressed version that their browser users download. In the same way that you can technically query the DNS root servers yourself but you don't tend to do that because your computer will query a more downstream DNS server.
- agwa 4y agoYes, that's exactly what it means.
- agwa 4y agoI have a cron job that pulls that CSV file once a day. I assure you I am not a BigCo.
- ok_dad 4y agoI was wrong, thanks for correcting me :)
- mholt 4y ago"The connection has timed out. An error occurred during a connection to ccadb-public.secure.force.com."
- agwa 4y agoWorks for me, though the time to first byte is currently rather long.