Hacker News Reader

That tweet says "Despite what the browsers may be saying, the site is still safe to visit."

Is it though?

Asking people to ignore browser warnings seems like bad advice from a security expert.

Yeah, I, too, found that to be a really odd piece of advice from a security expert.

If I were the Brian (but I'm not), I would have asked followers to not trust the site until the certificate issue is fixed, even though I "know" my site is still safe. I think the properly cautious attitude is to consider all bets being off when a certificate is invalid for whatever reason. There is no guarantee what your visitors are actually getting.

Bias finds its way into every corner. And no, it's not safe unless you do some extensive analysis of the certificate in question. Is this actually a valid/genuine certificate, besides the timestamp? A normal user will have a hard time verifying that.

It's safe considering the threat model: the worst his site has seen is some DDOS attacks. With a MITM his site might end up hosting a 0-day, but hijacking is unlikely to begin with due to how low-profile his site is (outside of tech circles). And they'd have to attack DNS as well as his certificate.

Reply on news.ycombinator.com