5 ms·

For extremely sensitive systems, I think a more logical endgame is 30 minutes or so. 30 seconds is practically continuous generation. An semi-distributed (inte

For extremely sensitive systems, I think a more logical endgame is 30 minutes or so. 30 seconds is practically continuous generation. An semi-distributed (intercity) Kubernetes cluster can reasonably change its certificate chain every week, but it needs an HSM if it's done internally. Otherwise, for a website, once or twice a year makes sense if you don't store anything snatch-worthy.

panki27 2y ago
That CRL is going to be HUGE.
- psz 2y ago
  Why you think so? Keep in mind that revoked certs are not included in CRLs once expired (because they are not valid any more).
nottorp 2y ago
> once or twice a year makes sense You don't say. Why are the defaults already 90 days or less then?
- bayindirh 2y ago
  Because most of the sites on the internet store much more sensitive information when compared to the sites I gave as an example, and can afford 1/2 certificates a year. 90 days makes way more sense for the "average website" which handles members, has a back office exposed to the internet, and whatnot.
  - nottorp 2y ago
    That's not the average website, that's a corporate website or an online store. Why do you think all the average web sites have to handle members?
    - bayindirh 2y ago
      Give me examples of websites which doesn’t have any kind of member system in place. Forums? Nope. Blogging platforms? Nope. News sites? Nope. Wordpresss powered personal page? Nope. Mailing lists with web based management? Nope. They all have members. What doesn’t have members or users? Static webpages. How much of the web is a completely static web page? Negligible amount. So most of the sites have much more to protect than meets the eye.
      - nottorp 2y ago
        I could move that all your examples except forums do not NEED members or users... except to spy on you and spam you.
        bayindirh 2y ago
        I mean, a news site needs their journalists to login. Your own personal Wordpress needs a user for editing the site. The blog platform I use (mataroa) doesn’t even have detailed statistics serve many users so they need user support. Web is a bit different than you envision/think.
        ArinaS 2y ago
        > "I mean, a news site needs their journalists to login." Why can't this site just upload HTML files to their web server?
        bayindirh 2y ago
        Two operational requirements: 1. Journalists shall be able to write new articles and publish them ASAP, possibly from remote locations. 2. Eyeball optimization: Different titles, cutting summaries where it piques interest most, some other A/B testing... So you need a data structure which can be modified non-destructively and autonomously. Plus many more things, possibly. I love static webpages as much as the next small-web person, but we have small-web, because the web is not "small" anymore.

panki27 2y ago

That CRL is going to be HUGE.

psz 2y ago
Why you think so? Keep in mind that revoked certs are not included in CRLs once expired (because they are not valid any more).

nottorp 2y ago

> once or twice a year makes sense You don't say. Why are the defaults already 90 days or less then?

bayindirh 2y ago
Because most of the sites on the internet store much more sensitive information when compared to the sites I gave as an example, and can afford 1/2 certificates a year. 90 days makes way more sense for the "average website" which handles members, has a back office exposed to the internet, and whatnot.
- nottorp 2y ago
  That's not the average website, that's a corporate website or an online store. Why do you think all the average web sites have to handle members?
  - bayindirh 2y ago
    Give me examples of websites which doesn’t have any kind of member system in place. Forums? Nope. Blogging platforms? Nope. News sites? Nope. Wordpresss powered personal page? Nope. Mailing lists with web based management? Nope. They all have members. What doesn’t have members or users? Static webpages. How much of the web is a completely static web page? Negligible amount. So most of the sites have much more to protect than meets the eye.
    - nottorp 2y ago
      I could move that all your examples except forums do not NEED members or users... except to spy on you and spam you.
      - bayindirh 2y ago
        I mean, a news site needs their journalists to login. Your own personal Wordpress needs a user for editing the site. The blog platform I use (mataroa) doesn’t even have detailed statistics serve many users so they need user support. Web is a bit different than you envision/think.
        ArinaS 2y ago
        > "I mean, a news site needs their journalists to login." Why can't this site just upload HTML files to their web server?
        bayindirh 2y ago
        Two operational requirements: 1. Journalists shall be able to write new articles and publish them ASAP, possibly from remote locations. 2. Eyeball optimization: Different titles, cutting summaries where it piques interest most, some other A/B testing... So you need a data structure which can be modified non-destructively and autonomously. Plus many more things, possibly. I love static webpages as much as the next small-web person, but we have small-web, because the web is not "small" anymore.