News for hackers. Stuff that matters.
Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by nindalf on Wednesday January 10, 2018 @04:23AM (#16113566)
I agree that a blog post would be more helpful, but the barrier to creating one is higher. This sort of update wouldn't fly there because its an off-the-cuff status report that will be buried in a day or two. The Let's Encrypt blog will be available and readable for all eternity (give or take a few years), so it requires an update that's more in-depth and vetted by all the people involved in solving this issue.

I'd imagine that once they fix this issue the first thing they'll do is to post a post-mortem on their blog.

Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by vog on Wednesday January 10, 2018 @04:48AM (#16113708)
I see. So this is more to be interpreted as a rushed preliminary report, forced upon them by appearing at the HN front page, to prevent uninformed rumor to appear and to spread. Or, did I miss something?

EDIT: Apparently the latter didn't work, as the very first response to their comment starts with "Do we get points for speculation based on these hints? ..."

Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by tialaramex on Wednesday January 10, 2018 @05:09AM (#16113798)
It prevented _uninformed_ rumours :D

Almost all the speculation was about the exact scenario that Let's Encrypt have subsequently confirmed - you can trick some bulk hosting or CDN providers into letting you (a customer) answer a challenge for one of their other customers' systems.