4 ms·

Which afaik has an expired certificate. Let's not act like anyone outside the hn and og reddit bubble uses it

bigstrat2003 3y ago
It hardly matters that the cert is expired if you're not logging in. Contrary to popular belief, TLS is not beneficial for sites where you aren't sharing secret data.
- wizzwizz4 3y ago
  It's beneficial for all the other sites if non-secret data is TLS-encrypted, though. If I want to ban secrets, and HTTPS is only used for secrets, I can just ban TLS; but if HTTPS is used for most of the web, I have to ban most of the web (and such a ban will never last long). Additionally, metadata such as browser history can reasonably be considered a secret: TLS helps protect that somewhat.
- ytoawwhra92 3y ago
  > Contrary to popular belief, TLS is not beneficial for sites where you aren't sharing secret data. I wish this meme would die. Integrity is still important for non-secret data. Confidentiality is important for data which may be considered secret in some contexts but not others.
  - ukuina 3y ago
    What are the negative effects of questionable integrity of Reddit textual content?
    - ytoawwhra92 3y ago
      Injecting malicious scripts, malicious links, spam, advertising, misinformation, or other harmful content such that it appears to the user to have been served from a trusted domain.
      - CRConrad 3y ago
        Can't a "trusted" domain itself, i.e. one with a non-expired cert, do all that shit just as well as a "non-trusted" one? AIUI, the cert only confirms that you are who you say you are, not that you're a good guy. I mean,are you saying Facebook doesn't have a cert, or that it doesn't have spam and advertising?
mksybr 3y ago
Seems fine for me. Common Name (CN) \*.reddit.com Organization (O) REDDIT, INC. Organizational Unit (OU) <Not Part Of Certificate> Issued On Thursday, August 31, 2023 at 8:00:00 PM Expires On Wednesday, February 28, 2024 at 6:59:59 PM

bigstrat2003 3y ago

It hardly matters that the cert is expired if you're not logging in. Contrary to popular belief, TLS is not beneficial for sites where you aren't sharing secret data.

wizzwizz4 3y ago
It's beneficial for all the other sites if non-secret data is TLS-encrypted, though. If I want to ban secrets, and HTTPS is only used for secrets, I can just ban TLS; but if HTTPS is used for most of the web, I have to ban most of the web (and such a ban will never last long). Additionally, metadata such as browser history can reasonably be considered a secret: TLS helps protect that somewhat.
ytoawwhra92 3y ago
> Contrary to popular belief, TLS is not beneficial for sites where you aren't sharing secret data. I wish this meme would die. Integrity is still important for non-secret data. Confidentiality is important for data which may be considered secret in some contexts but not others.
- ukuina 3y ago
  What are the negative effects of questionable integrity of Reddit textual content?
  - ytoawwhra92 3y ago
    Injecting malicious scripts, malicious links, spam, advertising, misinformation, or other harmful content such that it appears to the user to have been served from a trusted domain.
    - CRConrad 3y ago
      Can't a "trusted" domain itself, i.e. one with a non-expired cert, do all that shit just as well as a "non-trusted" one? AIUI, the cert only confirms that you are who you say you are, not that you're a good guy. I mean,are you saying Facebook doesn't have a cert, or that it doesn't have spam and advertising?

mksybr 3y ago

Seems fine for me. Common Name (CN) \*.reddit.com Organization (O) REDDIT, INC. Organizational Unit (OU) <Not Part Of Certificate> Issued On Thursday, August 31, 2023 at 8:00:00 PM Expires On Wednesday, February 28, 2024 at 6:59:59 PM