3 ms·
> We sometimes have to connect to older systems that use insecure keys, and no those systems cannot be fixed At least there's now a way to tell management "hey
by mschuster91 3y ago
> We sometimes have to connect to older systems that use insecure keys, and no those systems cannot be fixed
At least there's now a way to tell management "hey, there is no choice, <thing> must be replaced because we literally won't be able to connect to it any more".
- patrakov 3y agoEvil manager from hell: nope, you can still reconfigure the <thing> to use telnet. At least it would be then plain obvious that there is no security, instead of the current security theater with DSA.
- throw0101d 3y ago> Evil manager from hell: nope, you can still reconfigure the <thing> to use telnet. Possible reply for some folks: our cyber-insurance mandates encryption for all logins.
- midasuni 3y agoTelnet uses double rot 13 encryption.
- robertlagrant 3y agoOr just use an existing version of OpenSSL. They aren't sending a terminator back in time to purge DSA support from all of time.
- oynqr 3y agoThat would be a better timeline than this one.
- acdha 3y agoThe grind of audit requirements tends to mean those managers are a lot more willing to do the right thing now – it’s less risk than putting your name in writing on the thing which the auditors / insurance company will be using to fail you.
- crote 3y agoI don't think anything using SHA-1 for security is going to pass an audit anyways...
- acdha 3y agoYes, or telnet. My point was that it used to be that random acts of management/ BOFH were more common because they could play politics out of consequences; now that lots of people have insurance or regulatory checks, that’s harder to do. That paperwork might not be the most efficient way to do it but it does at least produce a slow grind forcing the business people to pay attention to problems they used to ignore.