Reputation
355
Top tag
Next privilege 500 Rep.
Access review queues
Badges
1 14
Newest
 Tag Editor
Impact
~10k people reached

May
27
comment Is “curl -u username:password http://example.com” secure?
@rr IMHO you get untrusted only if there's a problem with missing (or wrong) intermediate certs on the server
May
27
comment Is “curl -u username:password http://example.com” secure?
@rr How do you assert StartSSL is not trusted by most browsers? Do you expect many Windows 95 or Firefox 1.5 users?
May
25
comment ERR_ICANN_NAME_COLLISION when trying to use localhost .dev in Chrome
@Archimedix .local may be problematic as well: support.apple.com/en-us/HT204684
May
25
answered ERR_ICANN_NAME_COLLISION when trying to use localhost .dev in Chrome
May
6
revised Certification Authority migration - cannot install Web Enrollment role
added 13 characters in body; edited title
May
6
answered Certification Authority migration - cannot install Web Enrollment role
May
5
comment When I hit DEL during start up, am I entering CMOS or BIOS?
Now which piece of software is actually already running and reads the keyboard and decides to enter CMOS setup? :)
May
5
answered BASH : grep count same word occurrence
May
5
revised pki wiki excerpt
added 120 characters in body
May
5
awarded  Tag Editor
May
5
revised pki wiki description
added 120 characters in body
May
5
revised Certification Authority migration - cannot install Web Enrollment role
edited title
May
5
wiki created pki description
May
5
wiki created pki excerpt
May
5
suggested approved edit on pki tag wiki
May
5
suggested approved edit on pki tag wiki excerpt
May
5
asked Certification Authority migration - cannot install Web Enrollment role
Apr
4
comment Apple's Mail showing “the identity of smtp.gmail.com cannot be verified”
Yeah, I should have said "not trusted" instead of "invalid". Of course the process of setting expiry dates is executed with enough safety margin to allow acceptance "shortly" beyond expiry date. Then again, Google won't have to even bother adding the cert to a CRL if they happened to learn now that the key was explicitly compromised. Hence the CRL safety net is removed after expiry
Apr
4
comment Apple's Mail showing “the identity of smtp.gmail.com cannot be verified”
Well, in principle the fact that the intermediate is outdated means that a cautious person would no longer expect straight away that its key could not have been broken by an attacker using brute-force for a couple of years. Such an attacker could easily have forged the smtp.gmailcom certificate that you see. Of course the assumption that such an attacker succeeds precisely at th emoment o fexpiry is unfounded. Still, Google should have checked their certificate expiry schedule - encouraging users to ignore security warnings (though ok in this case) educates them into the wrong direction!
Mar
29
comment Is there a way to set symbolic links to only executable files in Linux?
The notion of executability is of course in the eye of the beholder