• 2 Posts
  • 82 Comments
Joined 1 year ago
cake
Cake day: June 5th, 2023

help-circle



  • If approved, it will affect all Safari certificates, which follows a similar push by Google, that plans to reduce the max-validity period on Chrome for these digital trust files down to 90 days.

    Max lifespans of certs have been gradually decreasing over the years in an ongoing effort to boost internet security. Prior to 2011, they could last up to about eight years. As of 2020, it’s about 13 months.

    Apple’s proposal would shorten the max certificate lifespan to 200 days after September 2025, then down to 100 days a year later and 45 days after April 2027. The ballot measure also reduces domain control validation (DCV), phasing that down to 10 days after September 2027.

    And while it’s generally agreed that shorter lifespans improve internet security overall — longer certificate terms mean criminals have more time to exploit vulnerabilities and old website certificates — the burden of managing these expired certs will fall squarely on the shoulders of systems administrators.

    Over the past couple of days, these unsung heroes who keep the internet up and running flocked to Reddit to bemoan their soon-to-be increasing workload. As one noted, while the proposal “may not pass the CABF ballot, but then Google or Apple will just make it policy anyway…”

    However, as another sysadmin pointed out, automation isn’t always the answer. “I’ve got network appliances that require SSL certs and can’t be automated,” they wrote. “Some of them work with systems that only support public CAs.”

    Another added: “This is somewhat nightmarish. I have about 20 appliance like services that have no support for automation. Almost everything in my environment is automated to the extent that is practical. SSL renewal is the lone achilles heel that I have to deal with once every 365 days.”

    Until next year, anyway.












  • Exactly true in the newpipe comparison. Same with YT-dlp variants.

    I’m an always on VPN sort of guy, but most are not. So yes the fingerprint tradeoff is one I accept within my ability to deal with inconvenience. Mostly upside at this point with no ads, just sponsors that slip through sponsor block.

    My fingerprint it’s perfect, but I know it’s working as I can see other peoples feeds are more adaptive and directed then whatever I get. I know I have a hole when I see something spammy too.

    https://coveryourtracks.eff.org/ always worth a check.







  • I appreciate the cogent context and solution oriented post.

    I’d also say though that from a privacy standpoint self-hosting invidious is still allowing GeoIP info to be attached to downloaded videos, which is a fingerprint which can be used by data mining. Admittedly rather abstract as in this case the primary point of deplatforming might just be to de-ad, or give better video control, etc, and not obfuscate for privacy sake.

    As I said though great points!