| *** spiiroin has quit IRC | 00:12 | |
| *** thuttu77 has quit IRC | 00:12 | |
| *** spiiroin has joined #maemo | 00:13 | |
| *** thuttu77 has joined #maemo | 00:13 | |
| *** thuttu77 has quit IRC | 00:48 | |
| *** thuttu77 has joined #maemo | 00:48 | |
| *** Pali has quit IRC | 01:05 | |
| *** Venemo has quit IRC | 01:12 | |
| *** xkr47 has quit IRC | 01:24 | |
| *** xkr47 has joined #maemo | 01:31 | |
| *** florian has quit IRC | 02:02 | |
| *** florian has joined #maemo | 02:02 | |
| *** florian has quit IRC | 02:19 | |
| *** florian has joined #maemo | 02:29 | |
| brolin_empey | Wow, apparently even the bmw.de Web site uses Let’s Encrypt. | 02:43 |
|---|---|---|
| *** florian has quit IRC | 02:50 | |
| *** infobot has quit IRC | 03:22 | |
| DocScrutinizer05 | lol, really? | 03:29 |
| DocScrutinizer05 | indeed https://i.imgur.com/2C5Hw2o.png X-P | 03:31 |
| *** Kilroo has joined #maemo | 03:33 | |
| *** Kabouik has joined #maemo | 03:49 | |
| *** infobot has joined #maemo | 04:31 | |
| *** ChanServ sets mode: +v infobot | 04:31 | |
| *** tm has quit IRC | 05:18 | |
| *** tm has joined #maemo | 05:21 | |
| *** luke-jr has quit IRC | 05:22 | |
| *** luke-jr has joined #maemo | 05:22 | |
| *** Kabouik has quit IRC | 06:01 | |
| *** Kilroo has quit IRC | 06:13 | |
| *** LauRoman has quit IRC | 06:23 | |
| *** pagurus has joined #maemo | 06:56 | |
| *** pagurus` has quit IRC | 06:59 | |
| *** LauRoman has joined #maemo | 07:05 | |
| *** povbot has joined #maemo | 07:33 | |
| *** spiiroin has quit IRC | 07:42 | |
| *** spiiroin has joined #maemo | 08:36 | |
| totalizator | why not? | 08:39 |
| *** mavhc has quit IRC | 09:02 | |
| *** mavhc has joined #maemo | 09:14 | |
| brolin_empey | totalizator: No reason not to in my experience and opinion but DocScrutinizer05 has his reasons to buy a certificate instead of using LE. Personally I like LE because it allows me to automate the process of renewing the certificate. That is actually a large part of the reason I switched to LE. The reason for using a computer in the first place is to work more efficiently by having the computer do tedious, repetitive work to save valuable human time for | 09:29 |
| brolin_empey | things the computer cannot do itself, such as programming the computer. I do not want to risk interruption of service because I have to manually renew certificates if this renewal process can be automated. | 09:29 |
| *** hurrian has quit IRC | 09:31 | |
| *** hurrian has joined #maemo | 09:32 | |
| brolin_empey | In this case, though, I found it remarkable that BMW uses LE because BMW is a large company with broad brand recognition by the general public, not only by engineers. In my experience, it seems that large companies usually still buy a conventional certificate instead of using LE, at least for their Web sites that I access as a basically English-language monoglot whose travels IRL are limited to Canada, USA including Hawaii and Alaska, and Mexico. | 09:33 |
| brolin_empey | But hey, I can speak x86 assembly language and machine code. :-P | 09:36 |
| *** dafox has joined #maemo | 09:38 | |
| brolin_empey | It took me around three decades of living in Canada, not Quebec though, to realise that “bonjour” literally means “good day” instead of “hello”. I thought it meant “hello” because “hello” is usually translated to French as “bonjour” in my experience. | 09:39 |
| brolin_empey | Do new road vehicles sold in continental Europe have miles on the speedometer? It surprises me that some automakers, at least Volkswagen and Audi, no longer include miles on the speedometer of vehicles sold in Canada even though most Canadians live close to the USA, where road signs still use miles instead of metric, same as the UK. | 09:45 |
| brolin_empey | I realised that if the Tesla brand was used for a diesel vehicle then the vehicle may have a “Tesla coil” indicator light. :-D | 09:50 |
| brolin_empey | Does anyone from Taiwan say “flag of Taiwan” instead of “flag of the Republic of China”? | 09:55 |
| brolin_empey | Strictly speaking, there is, as far as I can tell, no flag of Taiwan, only the flag of the Republic of China, which is effectively a flag of Taiwan. | 09:57 |
| brolin_empey | I mean the current flag of the ROC, not the previous flag of the ROC. | 09:59 |
| brolin_empey | Serious question that I thought of: What do a Commodore 64 or Commodore 128 and a car with an automatic transmission with a horizontally-moving gear selector lever have in common? | 10:01 |
| Vajb | harware restrictions ;) | 10:02 |
| brolin_empey | Or a typewriter, which is why the early Commodore computers have the thing that is the answer. | 10:03 |
| brolin_empey | The answer is (a) shift lock as opposed to a caps lock. | 10:05 |
| brolin_empey | I do not know if a vehicle with an automatic transmission with a column shifter has a shift lock because I have possibly literally zero experience driving such a vehicle. | 10:07 |
| brolin_empey | I have more experience with 5.25-inch flexible disc drives than with automatic transmissions. | 10:08 |
| brolin_empey | Vajb: Seriously, though, does any Commodore computer truly have hardware restrictions, other than the write prevent mechanism of the flexible disc drive? I thought that Commodore usually did not try to restrict the user of their products. | 10:11 |
| *** dafox has quit IRC | 10:11 | |
| *** eMHa has quit IRC | 10:16 | |
| brolin_empey | It also occurred to me recently that the automotive industry may have originally had only one manual that covered both using and servicing a vehicle before splitting the service manual from the user manual? | 10:18 |
| brolin_empey | DocScrutinizer05: What does “DocScrutinizer” mean? Document(ation) Scrutinizer? Doctor Scrutinizer? | 10:24 |
| *** Venemo has joined #maemo | 10:35 | |
| *** eMHa has joined #maemo | 11:10 | |
| Juesto | brolin_empey: doctor is most likely, perhaps look it up? | 11:30 |
| Juesto | pfft | 11:30 |
| Juesto | thats a silly comparsion | 11:31 |
| *** jskarvad has joined #maemo | 11:42 | |
| sixwheeledbeast | I assumed Doctor. the issue with certificates is it's a massive chain of trust and if that is compromised somehow it leads to false security. Cert companies have gone bust by blindly or systematically adding certs you loose that web of trust and no one will trust you. | 12:00 |
| Maxdamantus | Do big companies use conventional certificates because they're better, or because that's just what companies have always done? | 12:08 |
| Maxdamantus | You can probably find a bunch of other technologies that are pretty much only used by big companies, mostly because it's big companies that have been around long enough to still be using them. | 12:10 |
| Maxdamantus | things like Java application servers come to mind. | 12:10 |
| Juesto | Maxdamantus: companies use standard certificates because its whats trusted and what browsers have built in, they use their own within the trusted well known root certificate that is on the OSes | 12:11 |
| sixwheeledbeast | I would imagine larger companies would be happy to pay for a better known more trusted company. Also they maybe happy with the relationship they have built up with the company. | 12:11 |
| Maxdamantus | Juesto: browsers obviously support LE though, otherwise LE wouldn't be very useful. | 12:12 |
| sixwheeledbeast | It possible BMW have got new people in to work on there web stack. | 12:12 |
| Juesto | ? | 12:12 |
| Maxdamantus | Juesto: “its whats trusted and what browsers have built in” | 12:13 |
| Juesto | LE? | 12:13 |
| Maxdamantus | Juesto: LE is trusted in the same way as other CAs. | 12:13 |
| Maxdamantus | Juesto: letsencrypt. | 12:13 |
| Juesto | oh right | 12:13 |
| Juesto | yeah, LE is pretty recent as far i gather | 12:13 |
| Juesto | but that one likely uses another well known root cert | 12:14 |
| Juesto | apologies for the little confusion i had | 12:14 |
| Maxdamantus | I was under the impression that LE has their own root cert(s), but I haven't looked into it. | 12:14 |
| Juesto | go ahead and confirm? | 12:15 |
| Maxdamantus | "DST Root CA X3"? | 12:16 |
| Maxdamantus | Ah okay, that's a certificate from some "IdenTrust" . | 12:18 |
| Juesto | :) | 12:18 |
| Maxdamantus | But that's obviously quite a lot of trust that "IdenTrust" must be putting in LE. | 12:20 |
| sixwheeledbeast | Exactly... | 12:22 |
| * Maxdamantus isn't particularly familiar with certificates, but presumably they've signed LE's certificate saying they can sign for any domain. | 12:22 | |
| Maxdamantus | So IdenTrust and LE are effectively the same thing here. | 12:23 |
| Maxdamantus | "I trust you to have as much power as I have" | 12:23 |
| sixwheeledbeast | With all encryption like this you have some public key and private key. The cert co's job is as a third party to verify those keys are correct and valid. | 12:27 |
| Maxdamantus | Well, its job is to vouch for the association of some public key with some domain name. | 12:28 |
| Maxdamantus | I understand how it works in principle, just don't know the details around validation processes, the actual trust delegation, etc | 12:29 |
| Maxdamantus | I can't see something explicitly like "domain: *" in the information about the LE certificate through Firefox's certificate viewer, so presumably the delegation is in the form of something like "Signer" | 12:30 |
| Maxdamantus | I'm guessing it's the "Is a Certificate Authority" part under "Extensions > Certificate Basic Constraints" | 12:32 |
| Maxdamantus | so if a valid certificate says "Is a Certificate Authority", then any certificate signed by that certificate is also valid. | 12:33 |
| Maxdamantus | But surely there must be other ways to delegate these things, eg, if you have a valid certificate for "*.google.com", presumably you can sign another certificate for "mail.google.com", without being a CA. | 12:34 |
| *** florian has joined #maemo | 12:37 | |
| Maxdamantus | Google has at least one of these CA certificates too. | 12:42 |
| Maxdamantus | issued by GlobalSign | 12:42 |
| sixwheeledbeast | Google have Google Trust Services | 12:45 |
| sixwheeledbeast | Superfish... | 12:51 |
| * sixwheeledbeast shudders | 12:51 | |
| *** spiiroin has quit IRC | 13:00 | |
| *** florian has quit IRC | 13:03 | |
| *** jskarvad has quit IRC | 13:05 | |
| *** Kabouik has joined #maemo | 13:05 | |
| *** jskarvad has joined #maemo | 13:06 | |
| Vajb | hmm I wonder, if company x trusts company y and company y trusts company x. Who is to say that x and y are trustworthy? | 13:14 |
| Vajb | question raised while reading a backlog | 13:15 |
| Maxdamantus | Vajb: the trust statements are backwards relative to how certificates normally work. | 13:16 |
| Maxdamantus | It should be "y is trusted by x" and "x is trusted by y", since that's what's in the certificates ("y is trusted by x" -> "y includes a signature produced by x") | 13:17 |
| KotCzarny | i think vajb wants to know who is at the top of trust | 13:18 |
| Vajb | hmm ok, Im still not quite there yet or maybe what KotCzarny said... | 13:19 |
| Maxdamantus | but what's imporant is whether you can follow the "_ is trusted by _" relations to a certificate that you're willing to inherently trust, which will happen in this case if either certificate exists in the browser's/OS' certificate store. | 13:19 |
| Maxdamantus | afaik, being a "root" is not really important. | 13:20 |
| Vajb | I thought more of as is there company z who says x and y are trustworthy | 13:21 |
| KotCzarny | no? someone decides who can get in and when and at what conditions | 13:21 |
| Vajb | but is this more related to blockchain? | 13:22 |
| KotCzarny | and i suppose those in lower roots have to agree to some root conditions | 13:22 |
| Maxdamantus | unless "root" means "exists in the browser's/OS' certificate store" | 13:22 |
| Maxdamantus | as opposed to being issued by itself. | 13:22 |
| KotCzarny | certificate stores usually use whatever is popular/"trusted" | 13:23 |
| Vajb | so browser creator gets to decide what certificates his browser has by default? | 13:26 |
| KotCzarny | yes | 13:26 |
| KotCzarny | unless they use system's one | 13:26 |
| Vajb | or maybe develober instead of creator... | 13:26 |
| Vajb | developer* | 13:26 |
| KotCzarny | but since browser's had to be consistent, they bundle certs themselves | 13:27 |
| Vajb | ah os has its own certificates too? | 13:27 |
| KotCzarny | some specific builds might use system's one | 13:27 |
| KotCzarny | yeah | 13:27 |
| Vajb | hmm | 13:27 |
| KotCzarny | in debianish world they usually come as ca-certificates package | 13:27 |
| KotCzarny | but curl packs it's own often | 13:28 |
| Vajb | if some rogue developer puts some dubious certificates in his store would it be possible to them to spread and compromise whole chain of trust? | 13:28 |
| KotCzarny | so basically it's a mess, which wouldnt be a mess in updated and supported distro | 13:28 |
| KotCzarny | yup | 13:28 |
| KotCzarny | but it would only be used by a that particular app | 13:29 |
| KotCzarny | unless it goes rogue and modifies system | 13:29 |
| Vajb | and that _could_ be possible with, say LE? | 13:29 |
| KotCzarny | nah, LE is different story | 13:29 |
| Vajb | ok, Im trying to wrap my head around why it is starbge that BMW uses LE. | 13:30 |
| Vajb | strange* | 13:30 |
| Juesto | eh, its a standard-ish thing | 13:30 |
| KotCzarny | because LE is new kid on the block | 13:30 |
| Juesto | root certificates are like the root domains, they're on top of the chain | 13:30 |
| KotCzarny | and we have yet to see how well they manage things | 13:30 |
| Juesto | if LE was a root cert on its own it would have been perhaps a little more exposed/scandalous/newsworthy | 13:31 |
| Vajb | ah so it trust exp runs quite low still and it needs few level ups ;) | 13:32 |
| Juesto | its more a service | 13:33 |
| Vajb | I see. | 13:33 |
| Juesto | apparently | 13:33 |
| Juesto | dont quote me | 13:33 |
| Juesto | neither rely | 13:34 |
| KotCzarny | also, their value gets undermined by a 'free cert for everyone' idea | 13:34 |
| KotCzarny | which basically includes malware | 13:34 |
| Juesto | pfft | 13:34 |
| *** florian has joined #maemo | 13:34 | |
| Juesto | what a scam(?) | 13:34 |
| KotCzarny | user might see 'oh it's a trusted site' without checking who is the owner of the cert | 13:34 |
| Vajb | so should we always check who issued the cert? And even block some certs if they seem dubious? | 13:37 |
| KotCzarny | no, who owns the cert | 13:38 |
| KotCzarny | issuers are trusted | 13:38 |
| Vajb | I think I never checked any certs | 13:38 |
| Juesto | issuer != owner | 13:38 |
| KotCzarny | but they might sell/issue cert to dubious entity | 13:38 |
| Vajb | ah missed that part | 13:38 |
| Vajb | actually I recall firefox complaining about certs being old in some page | 13:39 |
| Vajb | (I know this is not related to this) | 13:39 |
| Vajb | hmm that | 13:40 |
| Juesto | must have been your clock or your store being outdated | 13:40 |
| KotCzarny | or old browser without updated certs | 13:41 |
| Vajb | or I was in some shady back alley of internet | 13:41 |
| KotCzarny | might be that too | 13:41 |
| Juesto | lel | 13:41 |
| Juesto | oh ya you reminded me | 13:42 |
| Vajb | I backed off, if you wonder ;) | 13:42 |
| Juesto | yes some internet connection can cause issues with certs | 13:42 |
| Juesto | and browser warnings | 13:42 |
| Juesto | especially flaky ones | 13:42 |
| Vajb | hmm can't recall if it was home or with some "free" wlan | 13:42 |
| Juesto | there you go | 13:43 |
| Juesto | wifi can be terrible | 13:43 |
| Vajb | yup. That's why I don't use anything sensitive anymore while on free wifi | 13:45 |
| Vajb | like on holidays | 13:45 |
| *** spiiroin has joined #maemo | 13:45 | |
| Juesto | :) | 13:47 |
| Maxdamantus | 23:28:39 < Vajb> if some rogue developer puts some dubious certificates in his store would it be possible to them to spread and compromise whole chain of trust? | 13:50 |
| Maxdamantus | In his own store? Then he's just compromising whatever software uses that store. | 13:51 |
| Maxdamantus | The trust store isn't going to magically replicate to other machines. | 13:51 |
| Maxdamantus | The rogue developer would need to do something like change what certificates are distributed as part of something like a Firefox package, or curl or ca-certificates. | 13:52 |
| Maxdamantus | (by "a Firefox package", I mean the package used for something like Debian) | 13:53 |
| *** florian has quit IRC | 13:53 | |
| *** Venemo has quit IRC | 13:54 | |
| Maxdamantus | But ultimately, the "top" of the trust chain is the stuff running on your system. | 13:55 |
| Maxdamantus | Since it's your browser that decides to look in certain places on the filesystem for certificates, and it's your harddrive that decides to return the blocks in the filesystem that happen to be stored certificates, and it's your CPU that decides to execute the browser's code in the correct way. | 13:57 |
| KotCzarny | top, but still uses trust from the internet | 13:58 |
| KotCzarny | so not the toppish top | 13:58 |
| Maxdamantus | But you can say that about any CA, not just the "root" ones. | 13:59 |
| KotCzarny | yup | 13:59 |
| Maxdamantus | and since LE has a valid CA certificate, they're already fully trusted through these chains. | 13:59 |
| Maxdamantus | whether that trust comes from certificates stored directly in Firefox/ca-certificates, or from another such certificate signing LE's one. | 14:00 |
| Maxdamantus | actually, LE is already such a certificate on my system. | 14:04 |
| Maxdamantus | so it's trusted by both my browser directly, and by DST (which my browser trusts directly) | 14:06 |
| *** florian has joined #maemo | 14:24 | |
| *** Venemo has joined #maemo | 14:57 | |
| sixwheeledbeast | An issue is something like superfish, someone gets a fake cert into peoples cert store either through browser or bundled by manufacturer. In this example it was a fake Google cert so you think TLS is working. Malware can then MITM your data on your machine, potentially leaving you with your private and public keys written to your drive in plaintext, that's bad. | 15:49 |
| sixwheeledbeast | Older companies are more trusted and therefore further up the web of trust. | 15:51 |
| sixwheeledbeast | s/Older/Established | 15:51 |
| *** Natch has quit IRC | 16:03 | |
| *** Venemo has quit IRC | 16:37 | |
| *** florian has quit IRC | 16:46 | |
| *** Venemo has joined #maemo | 16:47 | |
| *** Natch has joined #maemo | 17:04 | |
| *** eMHa has quit IRC | 17:12 | |
| *** eMHa has joined #maemo | 17:25 | |
| *** florian has joined #maemo | 17:38 | |
| *** Gizmokid2005 is now known as Zombiekid2005 | 18:00 | |
| *** Pali has joined #maemo | 18:15 | |
| *** Venemo has quit IRC | 19:18 | |
| *** dafox has joined #maemo | 19:25 | |
| *** Pali has quit IRC | 19:35 | |
| *** dafox has quit IRC | 19:57 | |
| *** Kabouik_ has joined #maemo | 20:18 | |
| *** Kabouik has quit IRC | 20:20 | |
| *** Venemo has joined #maemo | 20:34 | |
| *** Kabouik_ has quit IRC | 20:44 | |
| *** LauRoman|Alt has joined #maemo | 21:21 | |
| Maxdamantus | Well, the superfish case is kind of analogous to just including actual software that can be considered malware. | 21:37 |
| Maxdamantus | eg, some program that automatically runs and manipulates memory used by web browsers such that it shows websites as being safe when they're not. | 21:37 |
| *** povbot_ has joined #maemo | 21:41 | |
| *** yosafbridge has joined #maemo | 21:42 | |
| *** RedM has joined #maemo | 21:42 | |
| *** till- has joined #maemo | 21:43 | |
| *** script_ has joined #maemo | 21:43 | |
| *** LauRoman|Alt has quit IRC | 21:48 | |
| *** florian has quit IRC | 21:48 | |
| *** jskarvad has quit IRC | 21:48 | |
| *** povbot has quit IRC | 21:48 | |
| *** Milhouse has quit IRC | 21:48 | |
| *** till has quit IRC | 21:48 | |
| *** grinsekatze has quit IRC | 21:48 | |
| *** kraft has quit IRC | 21:48 | |
| *** r00t|home has quit IRC | 21:48 | |
| *** Oksana has quit IRC | 21:48 | |
| *** RedW has quit IRC | 21:48 | |
| *** ceene has quit IRC | 21:48 | |
| *** yosafbridge` has quit IRC | 21:48 | |
| *** script has quit IRC | 21:48 | |
| *** r00t|home has joined #maemo | 21:49 | |
| *** kraft has joined #maemo | 21:49 | |
| *** florian has joined #maemo | 21:50 | |
| *** grinsekatze has joined #maemo | 21:51 | |
| Maxdamantus | note: the point of the above comments is: superfish is not the fault of any particular trust system, since any trust system is vulnerable to attacks involving control over software distribution. | 21:53 |
| *** dafox has joined #maemo | 21:53 | |
| *** troulouliou_div2 has joined #maemo | 21:54 | |
| *** troulouliou_div2 has joined #maemo | 21:55 | |
| *** eMHa has quit IRC | 22:01 | |
| *** LauRoman|Alt has joined #maemo | 22:02 | |
| *** __LauRoman has quit IRC | 22:02 | |
| *** Kilroo has joined #maemo | 22:12 | |
| *** BitEvil has joined #maemo | 22:24 | |
| *** SpeedEvil is now known as Guest17737 | 22:24 | |
| *** mavhc has quit IRC | 22:47 | |
| *** jskarvad_ has quit IRC | 22:49 | |
| *** troulouliou_div2 has quit IRC | 22:50 | |
| *** mavhc has joined #maemo | 22:51 | |
| *** keithzg has quit IRC | 22:56 | |
| *** keithzg has joined #maemo | 22:56 | |
| *** infobot has quit IRC | 22:57 | |
| *** Milhouse has joined #maemo | 23:02 | |
| DocScrutinizer05 | >><brolin_empey> DocScrutinizer05: What does “DocScrutinizer” mean? Document(ation) Scrutinizer?<< <<-that | 23:08 |
| brolin_empey | DocScrutinizer05: OK. | 23:09 |
| DocScrutinizer05 | lice prolly all Nicks this one got 'designed' by a creative process and been inspired by "Mr Reisenweber eats documents for breakfast<< (quote of a colleague), Frank Zappa's "Joe's Garage", and the character of DocHoliday | 23:10 |
| *** infobot has joined #maemo | 23:11 | |
| *** ChanServ sets mode: +v infobot | 23:11 | |
| DocScrutinizer05 | https://en.wikipedia.org/wiki/Doc_Holliday | 23:12 |
| *** peetah has quit IRC | 23:16 | |
| DocScrutinizer05 | oops, the quote of my colleage actually was >>joerg eats datasheets for breakfast<< | 23:17 |
| DocScrutinizer05 | but there's no 3char file extension specific for datasheets ;-D | 23:18 |
| DocScrutinizer05 | it's surprising how often the reference to Joe's Garage gets instantly noticed though | 23:20 |
| *** peetah has joined #maemo | 23:31 | |
| *** eMHa has joined #maemo | 23:38 | |
| *** dafox has quit IRC | 23:51 | |
Generated by irclog2html.py 2.15.1 by Marius Gedminas - find it at mg.pov.lt!
