Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team
<p>Speaking of broken embargoes, “Baseline Requirements”, say a CA must revoke a mis-issued certificate within five days. GoDaddy managed to revoke 170,566 by the deadline, and about 227,000 a day later.
Mass revocation is genuinely hard: every one of those certificates is installed on someone’s server, and revoking it before it’s replaced breaks their website. That’s exactly why the browser root programs care so much about CAs being able to do it on time. Short-lived certificates, the kind Let’s Encrypt has been pushing for years, make this a lot less painful because a bad certificate expires on its own in days instead of months. We’ll be living the revocation long-tail experience with eMudhra certificates for years with devices which don’t, or can’t, check revocation lists for the long-running CA certificates.
Tailscale wormability
Tailscale and headscale, its self-hosted, open source control server, have become extremely popular. This is especially so in the maker and homelab world, where they are used for building private networks between devices. Under the hood, Tailscale builds a mesh of WireGuard VPN tunnels between every device, with a central control server deciding who can talk to whom. It also offers “Tailscale SSH”, which replaces the normal SSH server on a device and authorizes logins based on which device is connecting, rather than passwords or keys.
Erica Windisch of Cyberdione Labs has published
<p>FoxIO is back with “goto fail” bug in 2014, where a single duplicated line silently skipped certificate verification. Crypto code fails quietly: the handshake completes and everything looks fine. GoAhead 6.1.1 fixes all three, but for the hundreds of millions of embedded devices running it, the fix depends on every vendor shipping a firmware update, and on owners installing it. Which will surely happen rapidly and effectively, right?
