Technology

59300 readers

4489 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

190

Sysadmins slam Apple’s SSL/TLS cert lifespan cuts (www.theregister.com)

submitted 4 weeks ago by misk@sopuli.xyz to c/technology@lemmy.world

82 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] fartsparkles@sh.itjust.works 15 points 4 weeks ago (1 children)

Smells like Apple knows something but can’t say anything. What reason would they want lifespans cut so short other than they know of an attack vector that means more than 10 days isn’t safe?

AFAIK they’re not a CA that sells certs so this can’t be some money making scheme. And they’ll be very aware how unpopular 10 day lifespans would be to services that suck and require manual download and upload every time you renew.

[+] 0x0@programming.dev -7 points 4 weeks ago (2 children)

Smells like you didn't read the article, it's an ongoing trend:

Max lifespans of certs have been gradually decreasing over the years in an ongoing effort to boost internet security. Prior to 2011, they could last up to about eight years. As of 2020, it's about 13 months.

[–] li10@feddit.uk 34 points 4 weeks ago (1 children)

Reducing it to one year made sense, one year down to 10 days is actually a fucking massive difference. Practically speaking, it’s a far, far bigger change than 8 years down to 1.

This isn’t just an “ongoing trend” at this point, it would be a fundamental change to the way that certificates are managed i.e. making it impossible to handle renewals manually for any decently sized business.

[–] Cort@lemmy.world 3 points 3 weeks ago

They never said the ongoing trend wasn't logarithmic. By 2030 you'll be updating certs 6-8 times a day! Please drink verification can.

[–] fartsparkles@sh.itjust.works 26 points 4 weeks ago* (last edited 4 weeks ago) (2 children)

Thank you for the smug response however I did indeed read the article and going from 13 months to 10 days is not a trend but a complete rearchitecture of how certificates are managed.

You have no idea how many orgs have to do this manually as their systems won’t enable it to be automated. Following a KBA once a year is fine for most (yet they still forget and websites break for a few days; this literally happened to NVD of all things a few weeks ago).

This change is a 36x increase in effort with no consideration for those who can’t renew and apply certs programmatically / through automation.

[–] corsicanguppy@lemmy.ca 6 points 4 weeks ago

This change is a 36x increase in effort with no consideration for those who can’t renew and apply certs programmatically / through automation

Don't worry. All that old gear is at least 45 days old - so old - and isn't an apple product anyway probably. Ergo, support isn't their issue and you will have to take that up with your OEM because la-la-la-laaaaa, can't hear you. Wanna go ride bikes?

[–] 0x0@programming.dev -5 points 4 weeks ago

I did indeed read the article

Smells like Apple knows something but can’t say anything.

Then do explain your conspiracy theory. Sectigo could go for a money grab, otherwise... probably just forcing automation without thinking of impact, as usual.