Hacker News: jcase

New comment by jcase in "EMudhra Intermediate CA Compromise"

jcase — Tue, 20 Oct 2026 23:28:18 +0000

I’ve asked this question before and the answer was that not all HSMs support it and they're too expensive to replace.

New comment by jcase in "Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open"

jcase — Tue, 12 May 2015 23:47:20 +0000

Thanks. You're right. Now I'm just wondering what IdenTrust gains from free DV certificates.

New comment by jcase in "Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open"

jcase — Tue, 12 May 2015 23:37:54 +0000

Acceptance into Mozillaʼs CA Certificate Program is usually discussed in public. Let's encrypt is not on the list of pending CA applications[0]. Does anyone know if they are introducing a new root certificate or teaming up with an existing CA?

[0] https://wiki.mozilla.org/CA:PendingCAs

New comment by jcase in "Stupid certificate tricks"

jcase — Sun, 10 May 2015 01:30:04 +0000

Running the openssl s_client command from the article will show you live.

New comment by jcase in "Researching a new form of HTTP caching optimization"

jcase — Sat, 10 Jan 2015 20:12:56 +0000

When you mentioned discourse serving 19k req/sec, does it hit the ruby stack at all? If no, serving 19k req/sec of cached HTML doesn't seem that impressive. What am I missing?

New comment by jcase in "Launching in 2015: A Certificate Authority to Encrypt the Entire Web"

jcase — Wed, 19 Nov 2014 12:20:33 +0000

You're (almost) describing certificate pinning. Have a look at http://tack.io although it appears down for the moment. Here is the HN thread: https://news.ycombinator.com/item?id=4010711

New comment by jcase in "Launching in 2015: A Certificate Authority to Encrypt the Entire Web"

jcase — Wed, 19 Nov 2014 12:11:27 +0000

With SSH you usually own both endpoints (or at least trusting your cloud provider).

The example you give with regards to exchanging a piece of paper is very similar. It's ridiculously hard to do such a thing on large scale without trusting intermediaries.

I'm putting my eggs on certificate pinning.

New comment by jcase in "Launching in 2015: A Certificate Authority to Encrypt the Entire Web"

jcase — Wed, 19 Nov 2014 12:02:39 +0000

This article[0] is largely about DNSSEC and DANE but it might give you some insights why making registrars the sole authorities isn't such a good idea.

[0] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

NewsgroupDirect Security Breach

jcase — Wed, 09 Jul 2014 22:47:27 +0000

Article URL: http://www.newsgroupdirect.com/blog/2014/07/09/important-newsgroupdirect-security-breach/

Comments URL: https://news.ycombinator.com/item?id=8012635

Points: 1

# Comments: 0

New comment by jcase in "Why is FreeBSD deprecating GCC in favor of Clang/LLVM?"

jcase — Wed, 14 Aug 2013 01:30:03 +0000

Well, whatever the license, here is to a bright future! That a rising tide may lift all boats.

New comment by jcase in "Why is FreeBSD deprecating GCC in favor of Clang/LLVM?"

jcase — Tue, 13 Aug 2013 23:35:15 +0000

I'm not sure this is true (anymore?). There are many open source projects who are thriving under non copyleft licenses.

If someone wanted to be a dick about it they could release modified GPL code as one big diff and publish it on some obscure webpage only their customers have access to. Instead we see more and more companies and individuals becoming friendly open source citizens. Perhaps some because the GPL mandates it but I would like to think mainly because they feel it's right thing to do—copyleft or not.

New comment by jcase in "Why is FreeBSD deprecating GCC in favor of Clang/LLVM?"

jcase — Tue, 13 Aug 2013 23:25:44 +0000

Not sure if you mean for profit and proprietary or just making money in general. For some reason though a lot of people think you can't sell GPL'd software which you absolutely can.

New comment by jcase in "Decentralized SSL cert verification"

jcase — Sun, 14 Jul 2013 23:54:04 +0000

DANE isn't without its own problems. Moxie Marlinspike wrote an excellent blog post about it.

http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

New comment by jcase in "Decentralized SSL cert verification"

jcase — Sun, 14 Jul 2013 23:41:10 +0000

If users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start though.

Ideally OS/Browser vendors would drop compromised CAs. That happened with DigiNotar. It's not always an option though — the three largest CAs have a 83.97%[0] market share. Dropping any one of them breaks the internet.

Unfortunately a lot of people seem hell bent on destroying rather than improving on top of it.

[0] https://ssl.netcraft.com/ssl-sample-report/CMatch/certs

New comment by jcase in "Decentralized SSL cert verification"

jcase — Sun, 14 Jul 2013 15:37:15 +0000

Sounds very similar to Convergence. In fact, it turns out that "Convergence is based on previous work from the Perspectives Project at Carnegie Mellon University".[0] I don't think this (or Convergence) will see widespread adoption though. For now, public key pinning (e.g. Tack.io) seems like the best way forward.

For what it's worth, many CA's are trying to raise the bar by way of the CA/Browser Forum.[1] The public mailing list is quite interesting at times.

[0] https://en.wikipedia.org/wiki/Convergence_(SSL)#Background

[1] https://www.cabforum.org

New comment by jcase in "Ask HN: Google Chrome heuristic warnings pose threat to our business"

jcase — Mon, 01 Jul 2013 20:55:05 +0000

Same version, no warning. Edit: Oops, had yet to read that it's now temporarily whitelisted by google.

New comment by jcase in "Show HN: Like Airbnb but for food"

jcase — Wed, 22 May 2013 18:18:52 +0000

Interesting, thanks!

New comment by jcase in "Show HN: Like Airbnb but for food"

jcase — Wed, 22 May 2013 17:09:38 +0000

When the EU region was announced[1] last month they weren't Safe Harbor compliant (yet). Has that changed?

[1] https://blog.heroku.com/archives/2013/4/24/europe-region (near the bottom).

New comment by jcase in "Bad as Shit"

jcase — Mon, 13 May 2013 15:27:07 +0000

For some reason it reminded me of "The Electronic Money Mill". Original site is gone but The Internet Archive has a copy: http://web.archive.org/web/20080412233535/http://www.msen.co...

Fun (semi-fictional) read about Electronic Funds Transfer, crypto and the FBI.

New comment by jcase in "AWS Launches CloudHSM, Hardware Security Module For Managing Cryptographic Keys"

jcase — Sun, 28 Apr 2013 01:02:09 +0000

The Luna SA they are using doesn't come cheap. For an H/A setup with all the extras (backup tools, service contract) I was quoted ~$80k.