Rstatus rstatus

From here: https://github.com/hotsh/rstat.us/issues#issue/89

HTTPS is lovely and secure and lovely.

We can haz it on rstat.us?

Comments
wilkie 5 days ago | link | edit | delete
In our certificate authority overlords we trust? :)

I wonder what authority status.net uses. People may need to acquire a certificate upon pushing a new node to the system, how does that affect the cost (monetary and time or effort) to do so? This is a good question!

steveklabnik 5 days ago | link | edit | delete
Not that we have to stay heroku forever, but they also have a good illustration of this: http://addons.heroku.com/ssl

Those are basically our options, heroku or no. SNI throws an error in old browsers, but is nice otherwise.

mstevens 5 days ago | link | edit | delete
There's always self-signed hotness.
Show quoted text
burningTyger 3 days ago | link | edit | delete
self signed? Scare people away? Not a good solution.

wilkie 3 days ago | link | edit | delete
@burningTyger you are assuming centralization and trust in verisign doesn't scare people away? ;) Let's overview:

Self-signing "weakens" the level of trust, but given that you can trust the key, the same amount of confidentiality. Verisign, what you pay for, is trust. It does verification, and people say it is ok, because it is Verisign and we trust them. Self-signed certs are root certificates and will not be verified. That means people have to verify them by instinct, by pressing 'ignore', or manually though other means. All-in-all, personally, I'm not sure I buy into the "web of trust" idea of hierarchical certificate authorities. It's all a matter of poor public education, anyway. :)

Self-signed is better than none at all, which is obvious. (The exception is in terms of psychological acceptability, where one thinks they are secure but are not because the key was exposed, and do things they would not have done normally) This problem still exists in the hierarchical scheme, but less so because somebody has the authority to revoke your cert, whereas a self-signed cert can't be revoked by anybody else. Which might be seen as a good thing, especially with respect to limiting the role a government can have in censoring or viewing communication through a backdoor because they have somebody at a certificate authority giving them private keys.

So I'd say there are two schools of thought, and picking the right one should be considered carefully.

burningTyger 3 days ago | link | edit | delete
sorry for the misunderstanding. I thought about people looking at a scary browser message that tells them to either go away or ignore all warnings and accept this evil self signed certificate. I've just been through this whole self signed business with only 30 people. I had to force them to accept the cert :) So maybe default to http and make it voluntary to go https. Otherwise I agree with you. It's definitly the browser that take part in all that.

wilkie 3 days ago | link | edit | delete
@burningTyger nope, never thought you misunderstood. Just putting that there for everyone else. I want us to find a good solution to this, want careful consideration, and wanted to put up a quick (although not complete) explanation to aid this. :)

binarycleric 1 day ago | link | edit | delete
I'd say offer HTTPS as an option (disabled by default, maybe) and use the cheaper SNI certs for now. Also put a giant warning explaining that if you are using an outdated OS then you're going to get a nasty warning error. Expand to a more widely accepted SSL cert once rstat.us becomes more popular.

Self-signing is NOT an option because of how the browsers treat it. The red screen of death that Chrome throws really scares the crap out of people who don't know any better.

wmeddie about an hour ago | link | edit | delete
Although it's root certificate is not installed by default in any browser yet, let me offer a possible alternative cert authority http://www.cacert.org/ .

It's fairly secure (probably more so than other cheap certificate authorities), and free. It's community structure/governance might be a perfect fit for a distributed service like rstat.us.