Top all-time · #6923
blog.codekills.net
Personal blog · blog.codekills.netprogrammingsecurity
blog.codekills.net is a personal blog at blog.codekills.net about programming and security. Since 2007, 12 different Hacker News readers have linked it 13 times. No feed was found, so read it on the site itself.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link the 'Adventures in X.509' post on certificate validation pitfalls, such as name constraints not being enforced by TLS libraries. Other linked posts cover nested Git repository handling.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/6 people · 6 mentions · first linked 2014-11-19
What Hacker News says?
Name constraints don't work [1] [2]. It's a nice thought, though :-/ [1] http://blog.codekills.net/2012/04/08/adventures-in-x509-the-... [2] http://middleware.internet2.edu/pki06/proceedings/chadwick-n...
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Launching in 2015: A Certificate Authority to Encrypt the Entire Web”Submitted Beautiful Code: That Pesky Binary Search as a story · 5 points
HN discussionI wonder about the downvotes, with the long documented history of software failing to properly validate certificate chains (or worse, trees). See for example http://blog.codekills.net/2012/04/08/adventures-in-x509-the-... about what really happens when one steps outside the well traveled path of certificate attributes...
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Google pulling China CNNIC CA from its products”Submitted Should I check parameter types in Python as a story · 3 points
HN discussionSupposedly name constraints are not universally supported though. See: http://security.stackexchange.com/questions/31376/certificat... http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Chinese CA WoSign faces revocation after possibly issuing fake certificates”Submitted What Makes a Good Resume as a story · 1 points
HN discussionYeah, docs are a bit fuzzy and I'm not exactly sure what the right answer is. So there are actually two ways to go about it AFAIK and I'm not entirely sure which one is the best. One is to list files in MANIFEST.in and then access it via __file__, but I think this doesn't work if your module gets turned into an egg/wheel (it's for source dists). On the other hand is using pkg_resources, where you declare the list of…
Comment linking /2011/07/15/lies,-more-lies-and-python-packaging-documentation-on--package_data-/
on “Use JSON files as if they are Python modules”Submitted Optimal Movie Seating Puzzle as a story · 1 points
HN discussionWell, there is the name constraints mechanism, but I'm not sure how well supported that is in TLS libraries and web browsers. https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... https://timothy-quinn.com/name-constraints-in-x509-certifica... https://www.sysadmins.lv/blog-en/x509-name-constraints-certi... https://blog.codekills.net/2012/04/08/adventures-in-x509-the...
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Increasing HTTPS Adoption”- ab · 2015-07-08
Enforcement of nameConstraints is inconsistent at best. I experimented with name constraints a couple years ago for a private CA project, with the idea that I could restrict the private CA to issuing only names within a chosen subdomain. I remember being able to enforce nameConstraints on the subjectAltName, but I was never able to get it to enforce anything on the subject Common Name. In theory new certificates sho…
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Forthcoming OpenSSL releases” Oh my God! What? How is this not a major, major thing? How are Mozilla and Google not pushing hard for government CAs to have these, like, stat? And for OpenSSL to actually check them? I am bewildered. What happened? Is this just apathy? http://blog.codekills.net/2012/04/08/adventures-in-x509-the-... Unbelievable. This is SRV for HTTP all over again. The Betamax of the 21st century.
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Forthcoming OpenSSL releases”I wonder. How difficult can it be to mimic mercurial's subrepos? http://blog.codekills.net/2011/07/14/nested-repository-handl...
Comment linking /2011/07/14/nested-repository-handling-in-git-and-mercurial/
on “Why your company shouldn't use Git submodules”> Isn't it possible for a CA cert to have authority only for *.foo.com? Technically, you can do that with name constraints. In practice, you can't because many SSL implementations (like, say, OpenSSL[0]) won't honour it, so it'd effectively be an unrestricted root CA for those. [0] http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...
Comment linking /2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/
on “Embedded Devices Share, Reuse Private SSH Keys, HTTPs Certificates”