If you don't, you can never tell what a device is sending/receiving, and devices have a hardcoded end-of-life date where they become useless. Would love to see groups starting to push in this direction.

The main eMudhra root cert backing these intermediates is "emSign ECC Root CA - G3", which was issued back in 2018 and was widely trusted for TLS way before these intermediates were created. The certs were also cross-signed by Sectigo using their "AAA Certificate Services" which was issued in 2004 (!!!) and was trusted in TLS stores until 2025 (after that it got removed/demoted to email signing only, depending on the store).

Everything which trust one of those roots will trust the intermediates (putting aside revocation, CT checks, lack of ECC support, etc) so the window is much much longer. The AAA does expire at the end of 2028 though!

They're not generally (there is a specific case of preloaded intermediates, but that's not the main problem here). The certs here aren't in any trust stores I'm aware of directly. The key change to mitigate this is indeed revocation, but that's hard, because many non-browser clients don't actually support revocation in any functional way.

Firefox has gone further though, and distrusted the corresponding root completely in their store. That's not strictly required if you support revocation for the intermediate, but their trust store is widely reused elsewhere and this guarantees the certs won't be trusted even without revocation support. And honestly everybody is now suspicious as hell of eMudhra, so they'd rather be over cautious.

Revolut uses Google Cloud: https://cloud.google.com/customers/revolut

They've been expanding hard across Europe recently, this might dent people's confidence in these new fangled neobanks a bit...

From their last filings, they have 70+ million individual customers, 850k business customers. Highest in the UK: about 13 million, so nearly 20% of the population. Ouch.

Bad news, sorry, the article says:

> We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime.

Sounds like Celld will live on within workerd, Deno is over.

If you want to hit it hard, or you just want to avoid any risk of limits in future, it's a one-liner to host it yourself with Docker: `docker run --rm -it -p 3000:3000 httptoolkit/testserver`, then open http://example.localhost:3000/. Advanced config options for CAs etc are in the GitHub README.

Also as a _long_ list of other specialist TLS endpoint configurations if you're interested, which can be arbitrarily combined, see https://testserver.host/#tls-endpoints.

That gives neat tricks like https://tls-v1-2--expired--incomplete-chain--http2.testserve...: only accepts TLS 1.2, then sends an expired certificate but fails to send the intermediate cert for the chain (so the client must infer it) and then negotiates HTTP/2 for the connection on top. Fun!

Also open-source and self-hostable: https://github.com/httptoolkit/testserver. Lots of other endpoints too, full docs here: https://testserver.host/

Comments URL: https://news.ycombinator.com/item?id=49813144

Points: 3

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=49478312

Points: 9

# Comments: 2

If the power isn't enough to power a device, that's annoying, but it's strictly better than when we had a unique power cable per-device. We've replaced "carry a charger per device" with "carry one charger for your highest power device, and it can do everything else too". And even with just a low-power cable you can usually trickle-charge overnight or something.

The only optional feature you'll run into that may or may not work at all is monitor support. Would it be better to have a whole different USB-C2 spec which requires display support (and so is significantly more expensive)? If the connector is the same you have the same problem (it's just labelling) and if it's not that sounds like you've just invented display cables which your monitor almost certainly supports today anyway.

This would completely defeat the point.

There is a range of needs for cables. Some devices have simple needs for power/data transfer/extra functionality, and some devices have more. A $3 USB-powered lamp does not need a cable for gigabit data transfer and 100W charging - this cable would be more expensive than the product. Similarly, new features & performance levels will emerge and we want to be able to use these in new cables backward compatibly.

Given a range of needs, you have two options:

- A single cross-compatible connector, but with a range of capabilities

- Different types of connector for every capability

We used to be in the latter situation, USB-C is an attempt to do the former. Having different capabilities for same-shaped cables is the goal.

Labelling would be great, but standardizing one single spec for all cables would defeat the point.

Comments URL: https://news.ycombinator.com/item?id=49084813

Points: 274

# Comments: 195

In practice, obviously most personal payments are well under that margin, so within-EU bank transfers are defacto instant everywhere. Most banking apps I've seen don't even show an 'instant/slow' option any more, it's just all instant.