News for hackers. Stuff that matters.
Re:Instagram's Million Dollar Bug by bigiain on Thursday December 17, 2015 @06:27PM (#10755457)
I can't work out how to not make this sound almost infinitely cynical, but their ssl key expires in 13 days - they only had to shut him up for another few weeks and they could have pretended they weren't currently MITM-able:

https://www.instagram.com

Not Valid After: Thursday, 31 December 2015 11:00:00 pm Australian Eastern Daylight Time

Maybe they'll upgrade it to something better than: Signature algorithm SHA1withRSA WEAK

Re:Instagram's Million Dollar Bug by agrot3ra on Thursday December 17, 2015 @06:31PM (#10755489)
Does this have anything to do with the SHA1 sunset on 31 December?
Re:Instagram's Million Dollar Bug by bigiain on Thursday December 17, 2015 @06:39PM (#10755535)
That'll be why the key expires on Dec 31 even though it was only issued back in April.

It doesn't explain why Instagram has been happily using a known-compromised wildcard ssl key for two weeks now.

Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO...

Re:Instagram's Million Dollar Bug by Phlarp on Thursday December 17, 2015 @06:52PM (#10755612)
>Makes you wonder who actually values and protects Instagram's user privacy more - the researcher or the Facebook CSO...

No, I don't wonder about this at all.

Re:Instagram's Million Dollar Bug by secalex on Thursday December 17, 2015 @06:44PM (#10755563)
Different key, dude. We rotated what was exposed.
Re:Instagram's Million Dollar Bug by bigiain on Thursday December 17, 2015 @07:11PM (#10755714)
So this new rotated key I'm seeing that has an April 2015 start date is a different key to the one your team replaced after it expired and broke everything back in April?

What a coincidence...

[dead]
Re:Instagram's Million Dollar Bug by dang on Thursday December 17, 2015 @07:03PM (#10755675)
> Do you believe that after this chain of events anyone still believes you?

Personal attacks, which this crosses into, are not allowed on Hacker News. Please comment civilly or not at all.

Re:Instagram's Million Dollar Bug by JackFr on Thursday December 17, 2015 @08:39PM (#10756050)
I don't see that as uncivil or a personal attack. It's either a reasonable direct question or a rhetorical one. And as a rhetorical question, it's not a personal attack, but rather makes the point that other posts seem to damage his credibility.
Re:Instagram's Million Dollar Bug by dang on Thursday December 17, 2015 @09:04PM (#10756140)
It's obviously not a direct question (there are people defending him in this thread, so of course he "believes" that), and as a rhetorical one it implies that he is lying. That's not a civil debate tactic—there's a reason why parliamentary systems expel people for using it.

Everyone needs to err in favor of respect when addressing someone on the other side of an argument, especially when one's passions are agitated, because the default is to forget all that.

Re:Instagram's Million Dollar Bug by duncan_bayne on Friday December 18, 2015 @12:35AM (#10756847)
Seems like a reasonable, if rhetorical, question. Hope Alex doesn't complain to his employer about it though ;-P
Re:Instagram's Million Dollar Bug by kuschku on Thursday December 17, 2015 @07:22PM (#10755768)
I am not talking about the person, but the company.

And I am sorry, but after these acts the company has taken, the little bit of trust that was left in the company is gone.

I am sorry if it sounded like a personal attack, that was not intended.

Re:Instagram's Million Dollar Bug by blazespin on Thursday December 17, 2015 @07:31PM (#10755805)
OH COME ON Dang, Alex called up Wes's employer and threatened him with criminal charges and then had the balls to lie about it in his facebook post that he didn't "Threaten". Are you seriously defending this??
Re:Instagram's Million Dollar Bug by dang on Thursday December 17, 2015 @07:48PM (#10755854)
Asking HN users to be civil defends nothing except civility.

There's a relevant general point here though. Reactions like this, and many others in this thread, are reflexive. That's really not what this site is for. Good comments for HN aren't reflexive, they're reflective. Practicing that distinction is the most important thing for being a contributor here, and it's orthogonal to one's actual views.

Re:Instagram's Million Dollar Bug by zorpner on Thursday December 17, 2015 @09:18PM (#10756201)
Asking HN users to be civil defends nothing except civility.

This would only be true if that request were applied equally whenever HN users were uncivil. As it stands, it does generally come off as defending specific users.

...it's orthogonal to one's actual views.

Believing this is going to made you a worse moderator -- this is "fair and balanced"-style thinking. There are many perspectives whose projection onto comment reflectivity are anything but zero.

Re:Instagram's Million Dollar Bug by dang on Thursday December 17, 2015 @10:37PM (#10756456)
> if that request were applied equally whenever HN users were uncivil

That's asking us to operate like machines—supermachines, in fact, with incivility detection and moderation powers. That's unrealistic. HN users' capacity to be uncivil exceeds our capacity to ask them not to, so the latter maxes out.

> it does generally come off as defending specific users

We try hard not to play favorites. I'm biased, of course, but there's more than one kind of bias here. People are more likely to notice us criticizing a comment they identify with than the cases that go the other way. We're biased to notice what we dislike and assign more weight to it.

> Believing this is going to made you a worse moderator

In that case I'm a bad moderator already, because everything I've learned about HN is packed into what I said there.

Re:Instagram's Million Dollar Bug by droopybuns on Thursday December 17, 2015 @11:21PM (#10756605)
outstanding question.