News for hackers. Stuff that matters.
Re:JPL Institutional Coding Standard for the C Programming L... by Alupis on Sunday February 17, 2019 @08:21PM (#19188028)
Looks valid on my machine (win10, chrome)
Re:JPL Institutional Coding Standard for the C Programming L... by segfaultbuserr on Sunday February 17, 2019 @11:13PM (#19188597)
Because OCSP is not reliable. Yeah, SSL/TLS is still broken at large, can you believe it, by default, there is NO reliable way to revoke a certificate... If OCSP times out, it just times out, the browser simply ignores it and loads the page without warnings. Active attackers can just block the OCSP server before they can use a revoked certificate with leaked private key to launch a MITM attack.

This is why we need OCSP pinning and OCSP Must Staple. OCSP pinning makes the web server itself to delegate OCSP responses in-band, thus eliminates the need for clients to make an unreliable connection to a 3rd-party, improves both security and performance. OCSP Must Staple is a certificate attribute that forces the browser to enforce pinned OCSP checkings. This is also the reason that Let's Encrypt limits the certificate lifetime to 90 days.

Re:JPL Institutional Coding Standard for the C Programming L... by cbsks on Sunday February 17, 2019 @08:45PM (#19188108)
Safari on iOS does not trust the certificate
Re:JPL Institutional Coding Standard for the C Programming L... by brandonjm on Sunday February 17, 2019 @09:23PM (#19188221)
Safari, Chrome and Firefox all do not trust it on macOS as well.
Re:JPL Institutional Coding Standard for the C Programming L... by saagarjha on Sunday February 17, 2019 @11:48PM (#19188713)
My Safari does, to give another viewpoint.