News for hackers. Stuff that matters.

A comment on Encrypted traffic interception on Hetzner and Linode targeting Jabber service. Parent comment

Re:Encrypted traffic interception on Hetzner and Linode targ... by aaomidi on Friday October 20, 2023 @02:29PM (#37959733)
> but the tldr is that all SCT-checking clients have to be able to respond to ecosystem changes very quickly.

This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.

I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.

[ Parent | on HN ]
Re:Encrypted traffic interception on Hetzner and Linode targ... by agwa on Friday October 20, 2023 @02:46PM (#37959907)
> This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.

People should do this, but in practice it often doesn't happen - as witnessed by the Appmattus library fiasco earlier this year.

> I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.

Considering how slowly updates to the various ca-certificates packages propagate, this would be absolute disaster for CT.

[ Parent | on HN ]