Loqiok, I added "https://amp.theguardian.com/technology/2017/aug/07/uk-citizens-to-get-more-rights-over-personal-data-under-new-laws" to the "See Also" section of /GDPR
KevinMarks, friedcell, deathrow1, glennjones, sl007, Pierre-O, KevinMarks_ and Garbee joined the channel
sl007Hey everyone! My new Laserprinter arrived and is already printing out a bunch of https://github.com/sebilasse/indieweb-origami billboards. I could also send some. Just tell me, aaronpk (US) and jkphl sknebel (BER) …
[tantek]I'd really like to know because I keep hearing anecdotes about cert expiring, and in some ways it seems like the biggest vulnerability there in practice is self-imposed fragility
Loqiadmin tax is all the time you spend maintaining your personal site, rather than actually using it (like to create posts) https://indieweb.org/admin_tax
aaronpkFallback to https isn't something in the realm of what letsencrypt can/should do. That's the job of the web server and you could theoretically do that with any certificate. Tho afaik no web servers have that feature built in so you'd also have to automate that right now
ZegnatForgetting to automate is just as bad on the 12 month lapse as it is on the 3 month lapse. I haven’t seen anyone complain about the 3 month lapse at the places I read, and many there have switched over to Let’s Encrypt. Not sure where your anecdotes are from, [tantek].
[tantek]Whereas cert renewal requires everything to do with two servers and the network connection working. Typically also requires a batch process to tuna script
ZegnatOdd. I would expect almost all of them to have been using certbot or other tooling for Let’s Encrypt in the first place. Those are not hard to set-up for auto-renewal.
ZegnatIf you have to set-up certs yourself, meaning you have shell access to a server and are not at a hosting company that does it for you, no, I do not think it is hard to run a single certbot command: certbot-auto --apache -d example.com -d www.example.com -d other.example.net
ZegnatIf that is too hard for you, you should probably not be at a hosting provider where you need to login through shell access to do server configurations yourself.
sl007sknebel - in https://indieweb.org/principles-de about the first notice : "duolingo" now seems to be a commercial language learning academy and that link is gone …
ZegnatThat’s why most people set the renewal not to 3 months, but to 2. Meaning you have an entire month of play time in case it doesn’t kick on instantly.
ZegnatAnd if for some reason that doesn’t work, I think Let’s Encrypt emails you a week or so in advance. So if you get an email, you know your automation is dead and you need to take a look yourself.
aaronpkIf your host doesn't want you running they'll scripts then they should be providing ssl certs with a checkbox that does it all for you (see DreamHost)
Zegnat“Or your web host hires a new junior sysadmin in that sees a bot script and shuts it down” - wow. I need to install my own certs, but the web host lets junior admins also muck about on my server? That’s a huuuuge red flag.
ZegnatRemember tantek: you should never have to run this yourself in the first place unless you chose to go with a hosting provider that gives you shell access and tells you to handle server configuration yourself.
aaronpkim sure there are other hosts that have done that by now but I don't make it my business to investigate the features of companies providing a service I don't use
ZegnatSo. [tantek]. You are saying people are hosting their websites at hosting companies that give shell access to their users, as well as allow those users to install certificates themselves through this shell. Then an average user installs a lets encrypt cert (magically? How do they know how to use the shell at all?) but don’t set-up automation. And t
ZegnatNo. I am saying automation is *as hard* as initial set-up. Not that is is not hard. Just that if you can do the initial set-up, you can do the automation as well.
ZegnatTwice as much work compared to what though? All certs expire. So all certs need automation set-up. Unless of course you are planning to retire the domain within 2 years.
aaronpkspeaking as someone who has a lot of certs, I can certainly say that the initial work in setting up the automation has already paid off in terms of the work required if renewals were not automated
aaronpkEven for one cert the benefit is short renewals mean you have more chance to remember the process, instead of waiting 1-2 years and forgetting the workflow <-- this was me before letsencrypt
ZegnatBecause if they can do the initial installation (which involves cert generation, getting it signed, getting server to accept it - or install special tooling like certbot - all through a shell), they surely can set-up automation as well (which depending on the tooling in step 1 may just be a single line added to the crontab).
ZegnatNote that this just happens quicker with Let’s Encrypt then. It would still have happened with every other cert, as all of them expire, just a little further down the line.
[tantek]It is provably false for 99.99% of the people in /generations (since clearly it was too hard for kylewm to get right (for whatever reasons/accidents), and he's pretty darn brilliant at this stuff)
ZegnatToo hard implies additional knowledge needed to me. But if you have all the knowledge needed for step 1, you will have the knowledge needed for step 2.
ZegnatHe may not have wanted to auto-renew, but may wanted to do manual, because he was waiting for wildcard certs to be released in the future and wants to move to them asap.
ZegnatWell. I know I didn’t do auto renewal before Let’s Encrypt. Judging from aaronpk’s earlier comment he didn’t do it automatically either. That’s atleast 2 more people pushed towards auto renewal by Let’s Encrypt
ZegnatBut is that fragility Lets Encrypts fault? You would need to compare all HTTP sites that have switched to free HTTPS certs, and then see how many of them remember to renew on time.
sknebelI've seen quite a few people say that they won't switch to Let's encrypt because they don't want to / could not do automatic renewal and they didn't want to do it every 3 months by hand
ZegnatI don’t know any major incidents with expired certs either, sknebel. I thought we were talking about smaller/personal sites specifically at the moment :)
sknebelwell, forgotten renewals has happened all the time for instance, and you'll find many people saying it has happened to them or observing it happening
snarfedbut broadly, yes, servers could definitely build in some smart fallbacks to better handle expired certs, and sadly i've never seen those in any server before
Zegnat[tantek], the camelCase does not matter. It’s actually 2 separate settings. You want the cookie to have the “secure” flag and the “httpOnly” flag.
Loqi [indienews] New post: "Universal Sign-In Button" https://unicyclic.com/mal/2017-08-07-Universal_Sign-In_Button
sl007 Hey everyone! My new Laserprinter arrived and is already printing out a bunch of https://github.com/sebilasse/indieweb-origami billboards. I could also send some. Just tell me, aaronpk (US) and jkphl sknebel (BER) …
Zegnat So. [tantek]. You are saying people are hosting their websites at hosting companies that give shell access to their users, as well as allow those users to install certificates themselves through this shell. Then an average user installs a lets encrypt cert (magically? How do they know how to use the shell at all?) but don’t set-up automation. And t
[tantek] So yes all this stuff is fragile and calling it "not hard" is frankly arrogant and insulting to nearly everyone in /generations.
snarfed from https://indieweb.org/SSL_expired#Maintenance_tax_and_site_fragility : "longevity and privacy/security are all worthwhile goals. We should work toward both of them at the same time, instead of seeing them as a (false) dichotomy."