News for hackers. Stuff that matters.

A comment on ICANN picks the domain it will never, ever release. Parent comment

Re:ICANN picks the domain it will never, ever release by mdaniel on Saturday January 27, 2024 @01:00PM (#39158018)
IMHO if you are already doing some process of "push certificates out to devices," you'll likely be much happier with getting a wildcard cert using DNS-01 and change that update process from "all devices all the time according to their schedule" over to "all devices but once every 80 days"

I do appreciate the threat model of one device getting owned leaks all your certs but security is always a trade-off between security and convenience. It also lowers the load upon the LE servers, for what that's worth

[ Parent | on HN ]
Re:ICANN picks the domain it will never, ever release by eqvinox on Saturday January 27, 2024 @04:16PM (#39159924)
Not sure everything updating at the same time is more "convenient" than staggered failures. For one, if multiple things break at the same time, it's easier to lock yourself out of things in more complicated ways. Also it's generally the first refresh that breaks, and everything at once only helps when you freshly roll out certs to a whole bunch of devices… if you add things incrementally (e.g. either because you finally get around to it, or you just bought something new) it makes no difference if it's all in the same cycle. Except now you have a wildcard cert floating around…
[ Parent | on HN ]