|
Sniep posted:well, a good use of self signed in the wild is intranet/corp poo poo where they run a CA and push the root to alt heir machines like i said earlier. but that's about it. it has already been pointed out that this is not an example of a self-signed cert. it's just a non-standard CA. with that out of the way, people don't run internal CAs anymore. too much effort we live in the age of byod. workers have smartphones, tablets, and unmanaged laptops that all need to be able to reach intranet applications. nobody can manage installing and revoking CA certs for a dozen versions of a half-dozen platforms (windows, osx, linux, android, ios, winpho, blackberry). it's just way too fuckin hard given the choice between accidentally training everyone to ignore ssl errors 100% of the time, and just spending money for public certs on internal services, most people choose to spend a few bucks
|
![]() |
|
![]()
|
# ? Apr 26, 2024 15:49 |
|
byod is dumb
|
![]() |
|
also you would only need a public cert for the external endpoint the byods come in on and then any work they do from then on would be on internal machines which have your own roots. unless u r suggesting you let them store sensitive company materials on their personal, virus infested clunkers.
|
![]() |
|
how emblematic of linux in general is it that this thread devolves into caremad argument posting every 3 pages
|
![]() |
|
ruby idiot railed posted:keep loving that chicken self-signed ssl stymie Shameful ssl posting itt.
|
![]() |
|
this thread is like linux a pos
|
![]() |
|
Shaggar posted:byod is dumb
|
![]() |
Phoenixan posted:agreeing with shaggar. Shaggar was right
|
|
![]() |
|
so is it just "deb" now
|
![]() |
|
.
Sassafras fucked around with this message at 00:51 on Nov 25, 2014 |
![]() |
|
Notorious b.s.d. posted:but that just moves the problem to dns. what the gently caress clients support secure dnssec reliably? who the gently caress publishes secure dns records? quote:; <<>> DiG 9.4.3 <<>> cia.gov ANY +dnssec ![]()
|
![]() |
|
IPvSH6T posted:
I was once offered a government job admining an important (state) government server, using an obscure system I had never heard of. I had also never adminned a server of any kind. I was told, "You can just learn as you go. C'mon, you'll get long lunches and a nice salary! No one else here knows what they're doing anyway."
|
![]() |
|
Jesus gently caress, everyone is wrong about PKI.
|
![]() |
|
*complains about self signed certs* *sshes into newly created EC2 instance*
|
![]() |
|
Zombywuf posted:*complains about self signed certs* *gets warning about unknown remote host because its insecure and could be mitm
|
![]() |
|
*ignores warning and continues anyway*
|
![]() |
|
I haven't read any of this thread except the last three pages and it's been a lot of careposting about CA infrastructure that we also discussed in the yossec thread the difference is that it was on topic in that thread and also didn't contain a bunch of idiot hell fuckers that don't understand the difference between a self-signed cert and a private CA and the conversation moved on within like four posts I came here to look at bad screenshots and maybe read arguments about sysv unit and systemd or maybe rpm and dpkg but noooooo
|
![]() |
|
systemd sucks rpm sucks ssl sucks
|
![]() |
|
all linuxes and unixes suck especially mac os ten dot ten
|
![]() |
|
actually they are all Good is this really what u want ![]() http://esr.ibiblio.org/?p=1046 http://esr.ibiblio.org/?p=1573 http://esr.ibiblio.org/?p=184 http://esr.ibiblio.org/?p=4270 http://scienceblogs.com/deltoid/2009/12/01/quote-mining-code/ http://www.catb.org/~esr/aim/ http://rationalwiki.org/wiki/Eric_S._Raymond
|
![]() |
|
ESR is such a goddamn creep
|
![]() |
|
Zombywuf posted:*ignores warning and continues anyway* mitm chances on initial login are infinitesimal and if the fingerprint ever changes ssh refuses to connect
|
![]() |
|
yeah sslchat is pretty offtopic but every yospos thread eventually degenerates into foodchat anyway this one time i ate an entire jar of mayonnaise just spooning it out with my bare hand like an animal
|
![]() |
|
that's extremely relevant to the desktop linux thread tho
|
![]() |
|
linux is to oses as pineapple is to pizza toppings. for those with terrible taste
|
![]() |
|
I put beans in chili
|
![]() |
|
Kiwi Ghost Chips posted:mitm chances on initial login are infinitesimal and if the fingerprint ever changes ssh refuses to connect Clearly you've never worked with AWS. I make initial logins every day, hopefully no-ones hacked my router.
|
![]() |
|
Mr Dog posted:yeah sslchat is pretty offtopic but every yospos thread eventually degenerates into foodchat anyway the most disgusting part is not making your own mayo
|
![]() |
|
Zombywuf posted:the most disgusting part is not making your own mayo
|
![]() |
|
Shaggar posted:also you would only need a public cert for the external endpoint the byods come in on and then any work they do from then on would be on internal machines which have your own roots. the terrible thing about byod is that you don't have a choice. people are gonna do what they're gonna do, and if you try to stop them from doing it, they just get mad as hell e.g. enterprise poo poo for ipad/iphone came about because executives were gonna use an ipad/iphone no matter what IT said. this happened in every fortune 500. IT mgmt had zero choice on the matter
|
![]() |
|
i thought byod is what you call it when ppl browse facebook on their phones instead of being pissed off that it's blocked by websense on their pcs
|
![]() |
|
Notorious b.s.d. posted:the terrible thing about byod is that you don't have a choice. people are gonna do what they're gonna do, and if you try to stop them from doing it, they just get mad as hell for ipads/iphones there are management tools so you can lock down their devices if they're on your network and since they're closed source you can trust them. w/ android or just a regular old laptop you aren't gonna be able to lock them down so your choice are don't allow them or let them be used as thin clients that access ur network thru a vpn and remote desktop/app virtualization
|
![]() |
|
Mr Dog posted:i thought byod is what you call it when ppl browse facebook on their phones instead of being pissed off that it's blocked by websense on their pcs byod has 2 meanings 1) "Hey, im the ceo and I want my email on my personal iphone" 2) "hey, we aren't going to buy you a computer, but you can totally use your personal laptop to do your job!" 1 is legitimate and easy to handle securely in a few different ways. 2 is most often a sign of a bad company
|
![]() |
even the case 1 byod is just mark down a "i told u so" somewhere, shrug, and move on :[
|
|
![]() |
|
haven't read any of this thread but we're 100 pages in and the year is nearly over and I'm not getting a very good feeling about 2014 actually being the year of Linux on the desktop. good effort, though. better luck next year.
|
![]() |
|
2014 is the year we just gave up on computers being secure
|
![]() |
|
Notorious b.s.d. posted:the terrible thing about byod is that you don't have a choice. people are gonna do what they're gonna do, and if you try to stop them from doing it, they just get mad as hell *bing*bong* your dumb opinion is being paged to return to http://forums.somethingawful.com/showthread.php?threadid=3564747 *bing*bong*
|
![]() |
|
Cocoa Crispies posted:*bing*bong* your dumb opinion is being paged to return to http://forums.somethingawful.com/showthread.php?threadid=3564747 *bing*bong* lol that thread current topic: all users a special snowflakes UGH
|
![]() |
|
notorious bad poo poo dumbass
|
![]() |
|
![]()
|
# ? Apr 26, 2024 15:49 |
dsyp ![]()
|
|
![]() |