4 ms·

Gfycat has been down for two days due to an expired SSL certificate

96 points by thorum 3y ago

philipkglass 3y ago
I tried disabling certificate validation so I could browse the site again. It looks like there's still text and some generic images there, but I wasn't able to load a couple of user-uploaded content images that I already had the URLs for. The site appears to be hollowed out from the inside, regardless of the cert problems.
- thorum 3y ago
  From other discussions on Reddit, it seems that the upload function has been broken since March.
  - Aachen 3y ago
    Upload worked for me, I think in April some time, but my gif never made it into the search, I can only direct link its page. Thought it was some untrusted new account issue
- KomoD 3y ago
  I picked a few images randomly from their API and I can view them just fine.
RulerOf 3y ago
I'm a little surprised by this. They're using an AWS Certificate which means the entire certificate lifecycle should be fully automated[1]. Assuming they use DNS validation, I speculate that somebody deleted the validation CNAME record and then the doom-and-gloom renewal emails went to an unmonitored mailbox. Then they ignored it so long it ended up on HN. Gfycat publishes an HSTS header, so they're under _hard_ downtime too. 1: https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html https://docs.aws.amazon.com/acm/latest/userguide/managed-ren...
- web007 3y ago
  Most likely someone stopped paying the AWS bill. If you `curl -k` to avoid the HSTS problem you see that CloudFront and/or lambda aren't working either.
  - KomoD 3y ago
    Works just fine for me when I bypass HSTS...
- aaomidi 3y ago
  An RFC draft I’ve been working on tries to address this somewhat: https://datatracker.ietf.org/doc/draft-todo-chariton-dns-account-01/ https://datatracker.ietf.org/doc/draft-todo-chariton-dns-acc...
- ehPReth 3y ago
  they're also HSTS preloaded in https://source.chromium.org/chromium/chromium/src/+/main:net/http/transport_security_state_static.json https://source.chromium.org/chromium/chromium/src/+/main:net...
tpmx 3y ago
"Gfycat is currently owned by Snapchat." (Wikipedia.) Edit: That appears to have been incorrectly removed by someone who was probably reading my comment. News of Snap Inc acquiring Gfycat can be seen here: https://www.linkedin.com/company/gfycat/about/ https://www.linkedin.com/company/gfycat/about/ > Gfycat (acquired by Snap Inc) https://finance.yahoo.com/news/meta-fights-overturn-uk-order-171627927.html https://finance.yahoo.com/news/meta-fights-overturn-uk-order... (Reuters, april 2022) > Snap later acquired Gfycat, a competitor to Giphy. https://www.adweek.com/social-marketing/meta-loses-tribunal-appeal-and-must-sell-off-giphy/ https://www.adweek.com/social-marketing/meta-loses-tribunal-... (oct 2022) > and Snap, which owns Gfycat.
- Aachen 3y ago
  Huh, I thought it was Facebook's. The source on Wikipedia has a surprisingly helpful title: > Meta fights to overturn UK order to sell Giphy
- paulgb 3y ago
  This has been removed. It seems that whoever added it confused Gfycat with Giphy (afaik they have no relation) https://en.m.wikipedia.org/wiki/Special:MobileDiff/1156016633 https://en.m.wikipedia.org/wiki/Special:MobileDiff/115601663...
  - tpmx 3y ago
    Incorrectly removed.
    - ihuman 3y ago
      It was restored
    - paulgb 3y ago
      Oh you’re right, I missed this line in the cited article: > Snap later acquired Gfycat, a competitor to Giphy.
      - deleted 3y ago
jeroenhd 3y ago
If you're looking to archive/download/whatever the images on gfycat.com, you can do the following: 0. This process only works in Chrome(-based) browsers 1. Open each of the following domains: - gfycat.com - api.gfycat.com - weblogin.gfycat.com - thumbs.gfycat.com 2. You will see a scary HTTPS warning. This is fine. 3. Type "thisisunsafe" into the page (no need to select anything or click and input field). This overrides any and all HTTPS errors that aren't technical issues. 4. After doing this for every domain, the HTTPS errors will be ignored for the rest of the session and the site will work again. If anything is still broken, hit F12 for the dev tools and check the network tab to see what domains failed and maybe try the above again. Two days of downtime starting on a week day is not a good sign. Back up any images you want to keep!
- tommoor 3y ago
  > Type "thisisunsafe" into the page great tip
- yegle 3y ago
  https://chromium.googlesource.com/chromium/src/+log/refs/heads/main/components/security_interstitials/core/browser/resources/interstitial_large.js https://chromium.googlesource.com/chromium/src/+log/refs/hea... and here's where this is defined in the source code. It's a way to bypass the SSL errors due to the HSTS headers.
- bscphil 3y ago
  Does anyone know of a similar workaround on Firefox for HSTS?
Animats 3y ago
Do we really need full encryption and signing for cat videos?
- aaomidi 3y ago
  Yes. https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/
  - Lammy 3y ago
    Strong disagree. Requiring TLS has made the web less private, not more, because now every request has to hit origin servers and can't be proxied at network edges like I used to do with Squid. Every single connection now gives away metadata about my browsing habits. It doesn't matter that the contents of those connections are encrypted: https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad... I run TLS on all of my sites, but it's one more thing making hosting harder for an average person and one more thing driving people into walled gardens. Even "professional" sites now fall apart if not maintained as evidenced by the submission we're commenting on. Even automatic LetsEncrypt is still a moving part that has the possibility to fail in <x> number of ways that plain-files-in-a-directory-behind-httpd never could. Snowden showed us that the Internet is a giant spy machine, and our response was to get Google Analytics running over TLS and to make sure every independent site now comes with a built-in expiration date. Cosmic irony.
    - bastawhiz 3y ago
      > now every request has to hit origin servers and can't be proxied at network edges like I used to do with Squid And presumably you ran your own DNS servers as well? And ensured your proxy wasn't in turn being monitored? And what's stopping you from middleboxing your own traffic and re-encrypting it with a root certificate? Your technically complex privacy solution is still technically possible. > making hosting harder for an average person The average person isn't running squid. And the average person uses a service to host their website which will take care of the certificate for them. > Even automatic LetsEncrypt is still a moving part that has the possibility to fail in <x> number of ways that plain-files-in-a-directory-behind-httpd never could. In all my life, I've never had downtime due to an automatic certificate renewal failing. And I get an email when my certificates are almost ready for renewal. But I have had downtime because the httpd logs filled up the disk. And because my box had gotten popped because I was on an insecure, outdated kernel. And once because I was FTPing plain-files-in-a-directory at the same time as someone else was FTPing those same plain-files-in-a-directory. The web never has been some impervious concrete thing that has been made complicated and brittle with HTTPS. We live in an era where HTTPS is fewer than five commands that you run a single time. And if you truly need anonymity to the point where you don't want to reveal the origins you're connecting to, use Tor.
explaininjs 3y ago
Is there any actual benefit to auto-expiring SSL certs? Presumably if your SSL cert is leaked, you would like to have the ability to revoke it without waiting a full year or whatever. On the flip side, if your SSL cert isn’t leaked it benefits quite precisely nobody to have it become invalid just because a caesium-133 atom has gone through however many transitions. The only benefit I’ve heard voiced is that it forces organizations to develop processes for cycling said certs - but that’s absolutely bogus. Imagine if S3 auto-deleted all buckets after a number of days and said “This is a good thing! Us auto-deleting these buckets forces you to set up processes to deal with us auto-deleting these buckets! You’re welcome.”
- kobalsky 3y ago
  the custom probably comes from the era when people had to pay for SSL certificates, but it's still good security hygiene. it's easy to revoke a certificate that you know was compromised, but what if you don't know it was? a temporal security gap could expose your eternal private key. with a short shelf-life it doesn't give attackers a lot of room to maneuver. otherwise, they could wait for an opportunity to chain it with another exploit and really ruin your day.
- sbierwagen 3y ago
  Scenario: you register foo.com and generate a certificate. You get bored and let the domain lapse. A decade later, a bank re-registers the domain. At best, they can only revoke your cert after it's used in a MITM attack, and a single fraudulent bank transfer from a rich person can net you a million bucks.
  - explaininjs 3y ago
    Is it impossible to query for (then revoke) existing certs for a domain you have just acquired? If not, that seems like the system failure here. Otherwise you have a ~year of MITM to worry about for any domain you obtain, regardless of expirations.

96 points by thorum 3y ago

I tried disabling certificate validation so I could browse the site again. It looks like there's still text and some generic images there, but I wasn't able to load a couple of user-uploaded content images that I already had the URLs for. The site appears to be hollowed out from the inside, regardless of the cert problems.

thorum 3y ago
From other discussions on Reddit, it seems that the upload function has been broken since March.
- Aachen 3y ago
  Upload worked for me, I think in April some time, but my gif never made it into the search, I can only direct link its page. Thought it was some untrusted new account issue
KomoD 3y ago
I picked a few images randomly from their API and I can view them just fine.

RulerOf 3y ago

I'm a little surprised by this. They're using an AWS Certificate which means the entire certificate lifecycle should be fully automated[1]. Assuming they use DNS validation, I speculate that somebody deleted the validation CNAME record and then the doom-and-gloom renewal emails went to an unmonitored mailbox. Then they ignored it so long it ended up on HN. Gfycat publishes an HSTS header, so they're under _hard_ downtime too. 1: https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html https://docs.aws.amazon.com/acm/latest/userguide/managed-ren...

web007 3y ago
Most likely someone stopped paying the AWS bill. If you `curl -k` to avoid the HSTS problem you see that CloudFront and/or lambda aren't working either.
- KomoD 3y ago
  Works just fine for me when I bypass HSTS...
aaomidi 3y ago
An RFC draft I’ve been working on tries to address this somewhat: https://datatracker.ietf.org/doc/draft-todo-chariton-dns-account-01/ https://datatracker.ietf.org/doc/draft-todo-chariton-dns-acc...
ehPReth 3y ago
they're also HSTS preloaded in https://source.chromium.org/chromium/chromium/src/+/main:net/http/transport_security_state_static.json https://source.chromium.org/chromium/chromium/src/+/main:net...

tpmx 3y ago

"Gfycat is currently owned by Snapchat." (Wikipedia.) Edit: That appears to have been incorrectly removed by someone who was probably reading my comment. News of Snap Inc acquiring Gfycat can be seen here: https://www.linkedin.com/company/gfycat/about/ https://www.linkedin.com/company/gfycat/about/ > Gfycat (acquired by Snap Inc) https://finance.yahoo.com/news/meta-fights-overturn-uk-order-171627927.html https://finance.yahoo.com/news/meta-fights-overturn-uk-order... (Reuters, april 2022) > Snap later acquired Gfycat, a competitor to Giphy. https://www.adweek.com/social-marketing/meta-loses-tribunal-appeal-and-must-sell-off-giphy/ https://www.adweek.com/social-marketing/meta-loses-tribunal-... (oct 2022) > and Snap, which owns Gfycat.

Aachen 3y ago
Huh, I thought it was Facebook's. The source on Wikipedia has a surprisingly helpful title: > Meta fights to overturn UK order to sell Giphy
paulgb 3y ago
This has been removed. It seems that whoever added it confused Gfycat with Giphy (afaik they have no relation) https://en.m.wikipedia.org/wiki/Special:MobileDiff/1156016633 https://en.m.wikipedia.org/wiki/Special:MobileDiff/115601663...
- tpmx 3y ago
  Incorrectly removed.
  - ihuman 3y ago
    It was restored
  - paulgb 3y ago
    Oh you’re right, I missed this line in the cited article: > Snap later acquired Gfycat, a competitor to Giphy.
    - deleted 3y ago

jeroenhd 3y ago

If you're looking to archive/download/whatever the images on gfycat.com, you can do the following: 0. This process only works in Chrome(-based) browsers 1. Open each of the following domains: - gfycat.com - api.gfycat.com - weblogin.gfycat.com - thumbs.gfycat.com 2. You will see a scary HTTPS warning. This is fine. 3. Type "thisisunsafe" into the page (no need to select anything or click and input field). This overrides any and all HTTPS errors that aren't technical issues. 4. After doing this for every domain, the HTTPS errors will be ignored for the rest of the session and the site will work again. If anything is still broken, hit F12 for the dev tools and check the network tab to see what domains failed and maybe try the above again. Two days of downtime starting on a week day is not a good sign. Back up any images you want to keep!

tommoor 3y ago
> Type "thisisunsafe" into the page great tip
yegle 3y ago
https://chromium.googlesource.com/chromium/src/+log/refs/heads/main/components/security_interstitials/core/browser/resources/interstitial_large.js https://chromium.googlesource.com/chromium/src/+log/refs/hea... and here's where this is defined in the source code. It's a way to bypass the SSL errors due to the HSTS headers.
bscphil 3y ago
Does anyone know of a similar workaround on Firefox for HSTS?

Animats 3y ago

Do we really need full encryption and signing for cat videos?

aaomidi 3y ago
Yes. https://doesmysiteneedhttps.com/ https://doesmysiteneedhttps.com/
- Lammy 3y ago
  Strong disagree. Requiring TLS has made the web less private, not more, because now every request has to hit origin servers and can't be proxied at network edges like I used to do with Squid. Every single connection now gives away metadata about my browsing habits. It doesn't matter that the contents of those connections are encrypted: https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad... I run TLS on all of my sites, but it's one more thing making hosting harder for an average person and one more thing driving people into walled gardens. Even "professional" sites now fall apart if not maintained as evidenced by the submission we're commenting on. Even automatic LetsEncrypt is still a moving part that has the possibility to fail in <x> number of ways that plain-files-in-a-directory-behind-httpd never could. Snowden showed us that the Internet is a giant spy machine, and our response was to get Google Analytics running over TLS and to make sure every independent site now comes with a built-in expiration date. Cosmic irony.
  - bastawhiz 3y ago
    > now every request has to hit origin servers and can't be proxied at network edges like I used to do with Squid And presumably you ran your own DNS servers as well? And ensured your proxy wasn't in turn being monitored? And what's stopping you from middleboxing your own traffic and re-encrypting it with a root certificate? Your technically complex privacy solution is still technically possible. > making hosting harder for an average person The average person isn't running squid. And the average person uses a service to host their website which will take care of the certificate for them. > Even automatic LetsEncrypt is still a moving part that has the possibility to fail in <x> number of ways that plain-files-in-a-directory-behind-httpd never could. In all my life, I've never had downtime due to an automatic certificate renewal failing. And I get an email when my certificates are almost ready for renewal. But I have had downtime because the httpd logs filled up the disk. And because my box had gotten popped because I was on an insecure, outdated kernel. And once because I was FTPing plain-files-in-a-directory at the same time as someone else was FTPing those same plain-files-in-a-directory. The web never has been some impervious concrete thing that has been made complicated and brittle with HTTPS. We live in an era where HTTPS is fewer than five commands that you run a single time. And if you truly need anonymity to the point where you don't want to reveal the origins you're connecting to, use Tor.

explaininjs 3y ago

Is there any actual benefit to auto-expiring SSL certs? Presumably if your SSL cert is leaked, you would like to have the ability to revoke it without waiting a full year or whatever. On the flip side, if your SSL cert isn’t leaked it benefits quite precisely nobody to have it become invalid just because a caesium-133 atom has gone through however many transitions. The only benefit I’ve heard voiced is that it forces organizations to develop processes for cycling said certs - but that’s absolutely bogus. Imagine if S3 auto-deleted all buckets after a number of days and said “This is a good thing! Us auto-deleting these buckets forces you to set up processes to deal with us auto-deleting these buckets! You’re welcome.”

kobalsky 3y ago
the custom probably comes from the era when people had to pay for SSL certificates, but it's still good security hygiene. it's easy to revoke a certificate that you know was compromised, but what if you don't know it was? a temporal security gap could expose your eternal private key. with a short shelf-life it doesn't give attackers a lot of room to maneuver. otherwise, they could wait for an opportunity to chain it with another exploit and really ruin your day.
sbierwagen 3y ago
Scenario: you register foo.com and generate a certificate. You get bored and let the domain lapse. A decade later, a bank re-registers the domain. At best, they can only revoke your cert after it's used in a MITM attack, and a single fraudulent bank transfer from a rich person can net you a million bucks.
- explaininjs 3y ago
  Is it impossible to query for (then revoke) existing certs for a domain you have just acquired? If not, that seems like the system failure here. Otherwise you have a ~year of MITM to worry about for any domain you obtain, regardless of expirations.