Hacker News Reader

Hacker News

Comment by rbanffy | Hacker News Reader

Parent Full thread

rbanffy

1- They could host their own DNS servers.

2- Signing an SSL certificate is a one-time thing.

3- A bit more complicated but still doable to have fiber to more than one ISP. To say nothing about net neutrality.

View on HN

> 2- Signing an SSL certificate is a one-time thing.

Certificates are definitely the weak spot here, as many of them already have a poor track record regarding security so probably poor spines too. Certificates requires central authority somewhere in the chain, and if they don't let you in, you don't stand a chance. Self-signed certificates are not gonna fly for most parts, unless you teach people to self-validate certificates with out-of-band ones.

It is, but if a CA refuses do sign a certificate without a good reason, I'd say it would make a lot of noise.

I can't imagine LetsEncrypt refusing to sign certificates for Parler.

Section 4.3 vi) of their subscriber agreement prohibits use of the certificate to enable ‘criminal activity’.

Which might cover incitement to insurrection.

TOS and documents like that are written by lawyers. What an organization might or might not do in practice has almost no bearing to their "subscriber agreement" and other legal documents.

I'd say the same about CloudFlare some time ago when it comes to blocking "enemies" that are not explicitly breaking the law, but here we are. Never say never, and even if an organization would never do such a thing today, who knows who is controlling the organization tomorrow.

Point taken.

Yeah, here I thought the same would happen if technology companies started banning people without any anti-criminal justification but again, here we are. Parler built a platform that could be used for bad, so instead of letting the country deal with the bad outcomes of the platform (like how we deal with Twitter and Facebook), the "modern" western world decided, without any intervention from the government, that Parler is not allowed to exist anymore.

You should still renew your SSL certificate every year (397 days to be exact).

Your certificate can be issued for as long as your issuer wants. It's not uncommon to have 5y certs.

Technically yes, but no issuer will provide long expiry certificates anymore [1]. They won't be recognised by major browsers even if they do anyway.

Some still sell 2 or 3 year certificates but that's a marketing ploy. You pay the price for the next 3 years in advance but you still have to renew it every year.

[1] https://docs.digicert.com/manage-certificates/end-2-year-pub...

Reply on news.ycombinator.com