Top all-time · #5002
Ryan Hurst
Personal blog · unmitigatedrisk.comsecurityweb
Ryan Hurst writes Unmitigated Risk, a personal blog at unmitigatedrisk.com about security and web. Since 2012, 15 different Hacker News readers have linked it 27 times, most often “Understanding risks and avoiding FUD”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for posts on certificate authorities, root trust stores, and OCSP stapling. Commenters mostly cite or link it as a source or follow-up to their own points, without judging the writing.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Essays by Ryan Hurst on security design, the WebPKI, compliance, and AI.
Most-linked posts?
- Understanding risks and avoiding FUD3 people · 3 mentions · first linked 2016-01-07
- Incident Mis-Issued Certificates for IP Address 1.1.1.12 people · 2 mentions · first linked 2025-09-04
- CAs and SSL and Phishing2 people · 2 mentions · first linked 2017-04-02
What Hacker News says?
For folks discovering this: Unfortunately, this isn’t a good idea, and can seriously harm your system. I’ll be the first to tell you that I believe Google and Mozilla have done a lot for supervising TLS, but realize that the trust stores contain many other non-TLS purposes, and with the CAs constrained from TLS issuance (e.g. only trust for S/MIME). CryptoAPI, for its warts, is actually beautifully engineered, in th…
Comment linking /?p=259
on “Many of the root certificates on Windows are not needed”Submitted Certificate-based Mozilla Persona IdP as a story · 42 points
HN discussionMy post responding to this - https://unmitigatedrisk.com/?p=552
Comment linking /?p=552
on “Let’s Encrypt Now Being Abused by Malvertisers”Submitted Tenement Farming and Cloud HSMs as a story · 40 points
HN discussionnot currently, their move off of OpenSSL to their own libraries makes this more complicated for them to do but I am hopeful they will soon. Here is a summary of where clients were a year ago, opera has support now so its slightly out of date - http://unmitigatedrisk.com/?p=24
Comment linking /?p=24
on “For sale: Trusted root SSL CA signing certificate”Submitted Incident Mis-Issued Certificates for IP Address 1.1.1.1 as a story · 17 points
HN discussionI totally understand the concern and I think the CA industry as a whole does as well. Moving forward Name Constraints will be adopted (finally) which is a good thing. Today it is supported by the majority of devices on the internet and given how fast browsers update now it wont be too long until the extension can be marked critical. On a semi-related note check out how many governments have their own roots : http://…
Comment linking /?p=181
on “For sale: Trusted root SSL CA signing certificate”Submitted How Facebook can avoid losing revenue when they switch to always-on SSL as a story · 14 points
HN discussionI think you are misunderstanding. First off so there is no ambiguity let me say clearly that GlobalSign's policies do not allow the use of certificates that chain to our roots to be used for MiTM purposes (or other malicious use cases for that matter). That said there are lots of reasons why a company might want or need to operate their own in house PKI and have that PKI trusted; one easy to understand case is googl…
Comment linking /?p=24
on “For sale: Trusted root SSL CA signing certificate”Submitted Microsoft's Root Program and the 1.1.1.1 Certificate Slip as a story · 10 points
HN discussionHello! That's very true, thanks to Maxim Dounin from Nginx[1] And Ryan Hurst[2] from GlobalSign Making SSL faster is really important to be able to support "full https" websites, with HSTS headers[3] and Alternate-Protocol: spdy[4][5] full disclosure, I do work for CloudFlare and on this particular feature :) [1] http://nginx.com/news/nginx-ocsp-stapling.html [2] http://unmitigatedrisk.com/?p=100 [3] http://en.wikip…
Comment linking /?p=100
on “OCSP Stapling: How CloudFlare Just Made SSL 30% Faster”Submitted The Private Key Was Four as a story · 3 points
HN discussionIf you want to go straight to the code you can find it at https://github.com/merklecounty/rget#rget My initial target with the project is to onboard a couple of popular GitHub projects. And because of my experience with etcd and Kubernetes I am starting with those two: https://github.com/kubernetes/kubernetes/issues/70132#issuec... https://github.com/etcd-io/maintainers/issues/16 This is an interesting problem space…
Comment linking /?p=636
on “Show HN: Rget verify GitHub releases against a public recorded cryptographic log”Submitted We Built It with Slide Rules. Then We Forgot How as a story · 3 points
HN discussionSubmitted A CA Built for the Threat Model We Have as a story · 2 points
HN discussionSubmitted Effortless Certificate Lifecycle Management for S/MIME as a story · 2 points
HN discussionSubmitted Secondary effects of encrypting the web as a story · 2 points
HN discussionSubmitted CAs and SSL and Phishing as a story · 2 points
HN discussionSubmitted CAs and SSL and Phishing Oh My as a story · 2 points
HN discussionSubmitted Understanding risks and avoiding FUD as a story · 2 points
HN discussionSubmitted Trusted Everywhere, Impact Everywhere as a story · 1 points
HN discussionSubmitted Domain Control Validation Grew Up. It Only Took Thirty Years as a story · 1 points
HN discussionSubmitted Attestation, What It Proves and Why Everyone Is About to Care as a story · 1 points
HN discussionSubmitted Exploring Requirements for Timelines Certificate Problem Reports and Revocations as a story · 1 points
HN discussionSubmitted We Trust WebPKI Root Certificate Authorities as a story · 1 points
HN discussionSubmitted Do PDFs have to be so frustrating? as a story · 1 points
HN discussionSubmitted Understanding risks and avoiding FUD as a story · 1 points
HN discussion
