**** BEGIN LOGGING AT Wed Oct 24 03:00:00 2018
Oct 24 05:39:50 <totalizator> why not?
Oct 24 06:29:24 <brolin_empey> totalizator: No reason not to in my experience and opinion but DocScrutinizer05 has his reasons to buy a certificate instead of using LE.  Personally I like LE because it allows me to automate the process of renewing the certificate.  That is actually a large part of the reason I switched to LE.  The reason for using a computer in the first place is to work more efficiently by having the computer do tedious, repetitive work to save valuable human time for 
Oct 24 06:29:24 <brolin_empey> things the computer cannot do itself, such as programming the computer.  I do not want to risk interruption of service because I have to manually renew certificates if this renewal process can be automated.
Oct 24 06:33:43 <brolin_empey> In this case, though, I found it remarkable that BMW uses LE because BMW is a large company with broad brand recognition by the general public, not only by engineers.  In my experience, it seems that large companies usually still buy a conventional certificate instead of using LE, at least for their Web sites that I access as a basically English-language monoglot whose travels IRL are limited to Canada, USA including Hawaii and Alaska, and Mexico.
Oct 24 06:36:14 <brolin_empey> But hey, I can speak x86 assembly language and machine code. :-P
Oct 24 06:39:08 <brolin_empey> It took me around three decades of living in Canada, not Quebec though, to realise that “bonjour” literally means “good day” instead of “hello”.  I thought it meant “hello” because “hello” is usually translated to French as “bonjour” in my experience.
Oct 24 06:45:14 <brolin_empey> Do new road vehicles sold in continental Europe have miles on the speedometer?  It surprises me that some automakers, at least Volkswagen and Audi, no longer include miles on the speedometer of vehicles sold in Canada even though most Canadians live close to the USA, where road signs still use miles instead of metric, same as the UK.
Oct 24 06:50:40 <brolin_empey> I realised that if the Tesla brand was used for a diesel vehicle then the vehicle may have a “Tesla coil” indicator light. :-D
Oct 24 06:55:27 <brolin_empey> Does anyone from Taiwan say “flag of Taiwan” instead of “flag of the Republic of China”?
Oct 24 06:57:46 <brolin_empey> Strictly speaking, there is, as far as I can tell, no flag of Taiwan, only the flag of the Republic of China, which is effectively a flag of Taiwan.
Oct 24 06:59:20 <brolin_empey> I mean the current flag of the ROC, not the previous flag of the ROC.
Oct 24 07:01:12 <brolin_empey> Serious question that I thought of: What do a Commodore 64 or Commodore 128 and a car with an automatic transmission with a horizontally-moving gear selector lever have in common?
Oct 24 07:02:52 <Vajb> harware restrictions ;)
Oct 24 07:03:59 <brolin_empey> Or a typewriter, which is why the early Commodore computers have the thing that is the answer.
Oct 24 07:05:47 <brolin_empey> The answer is (a) shift lock as opposed to a caps lock.
Oct 24 07:07:10 <brolin_empey> I do not know if a vehicle with an automatic transmission with a column shifter has a shift lock because I have possibly literally zero experience driving such a vehicle.
Oct 24 07:08:41 <brolin_empey> I have more experience with 5.25-inch flexible disc drives than with automatic transmissions.
Oct 24 07:11:52 <brolin_empey> Vajb: Seriously, though, does any Commodore computer truly have hardware restrictions, other than the write prevent mechanism of the flexible disc drive?  I thought that Commodore usually did not try to restrict the user of their products.
Oct 24 07:18:08 <brolin_empey> It also occurred to me recently that the automotive industry may have originally had only one manual that covered both using and servicing a vehicle before splitting the service manual from the user manual?
Oct 24 07:24:37 <brolin_empey> DocScrutinizer05: What does “DocScrutinizer” mean?  Document(ation) Scrutinizer?  Doctor Scrutinizer?
Oct 24 08:30:16 <Juesto> brolin_empey: doctor is most likely, perhaps look it up?
Oct 24 08:30:50 <Juesto> pfft
Oct 24 08:31:01 <Juesto> thats a silly comparsion
Oct 24 09:00:49 <sixwheeledbeast> I assumed Doctor. the issue with certificates is it's a massive chain of trust and if that is compromised somehow it leads to false security. Cert companies have gone bust by blindly or systematically adding certs you loose that web of trust and no one will trust you.
Oct 24 09:08:24 <Maxdamantus> Do big companies use conventional certificates because they're better, or because that's just what companies have always done?
Oct 24 09:10:47 <Maxdamantus> You can probably find a bunch of other technologies that are pretty much only used by big companies, mostly because it's big companies that have been around long enough to still be using them.
Oct 24 09:10:57 <Maxdamantus> things like Java application servers come to mind.
Oct 24 09:11:39 <Juesto> Maxdamantus: companies use standard certificates because its whats trusted and what browsers have built in, they use their own within the trusted well known root certificate that is on the OSes
Oct 24 09:11:51 <sixwheeledbeast> I would imagine larger companies would be happy to pay for a better known more trusted company. Also they maybe happy with the relationship they have built up with the company.
Oct 24 09:12:24 <Maxdamantus> Juesto: browsers obviously support LE though, otherwise LE wouldn't be very useful.
Oct 24 09:12:30 <sixwheeledbeast> It possible BMW have got new people in to work on there web stack.
Oct 24 09:12:35 <Juesto> ?
Oct 24 09:13:00 <Maxdamantus> Juesto: “its whats trusted and what browsers have built in”
Oct 24 09:13:13 <Juesto> LE?
Oct 24 09:13:15 <Maxdamantus> Juesto: LE is trusted in the same way as other CAs.
Oct 24 09:13:19 <Maxdamantus> Juesto: letsencrypt.
Oct 24 09:13:30 <Juesto> oh right
Oct 24 09:13:48 <Juesto> yeah, LE is pretty recent as far i gather
Oct 24 09:14:20 <Juesto> but that one likely uses another well known root cert
Oct 24 09:14:49 <Juesto> apologies for the little confusion i had
Oct 24 09:14:58 <Maxdamantus> I was under the impression that LE has their own root cert(s), but I haven't looked into it.
Oct 24 09:15:25 <Juesto> go ahead and confirm?
Oct 24 09:16:49 <Maxdamantus> "DST Root CA X3"?
Oct 24 09:18:02 <Maxdamantus> Ah okay, that's a certificate from some "IdenTrust" .
Oct 24 09:18:41 <Juesto> :)
Oct 24 09:20:57 <Maxdamantus> But that's obviously quite a lot of trust that "IdenTrust" must be putting in LE.
Oct 24 09:22:41 <sixwheeledbeast> Exactly...
Oct 24 09:22:48 * Maxdamantus isn't particularly familiar with certificates, but presumably they've signed LE's certificate saying they can sign for any domain.
Oct 24 09:23:16 <Maxdamantus> So IdenTrust and LE are effectively the same thing here.
Oct 24 09:23:44 <Maxdamantus> "I trust you to have as much power as I have"
Oct 24 09:27:04 <sixwheeledbeast> With all encryption like this you have some public key and private key. The cert co's job is as a third party to verify those keys are correct and valid.
Oct 24 09:28:31 <Maxdamantus> Well, its job is to vouch for the association of some public key with some domain name.
Oct 24 09:29:12 <Maxdamantus> I understand how it works in principle, just don't know the details around validation processes, the actual trust delegation, etc
Oct 24 09:30:11 <Maxdamantus> I can't see something explicitly like "domain: *" in the information about the LE certificate through Firefox's certificate viewer, so presumably the delegation is in the form of something like "Signer"
Oct 24 09:32:30 <Maxdamantus> I'm guessing it's the "Is a Certificate Authority" part under "Extensions > Certificate Basic Constraints"
Oct 24 09:33:09 <Maxdamantus> so if a valid certificate says "Is a Certificate Authority", then any certificate signed by that certificate is also valid.
Oct 24 09:34:56 <Maxdamantus> But surely there must be other ways to delegate these things, eg, if you have a valid certificate for "*.google.com", presumably you can sign another certificate for "mail.google.com", without being a CA.
Oct 24 09:42:06 <Maxdamantus> Google has at least one of these CA certificates too.
Oct 24 09:42:37 <Maxdamantus> issued by GlobalSign
Oct 24 09:45:16 <sixwheeledbeast> Google have Google Trust Services
Oct 24 09:51:11 <sixwheeledbeast> Superfish...
Oct 24 09:51:17 * sixwheeledbeast shudders
Oct 24 10:14:42 <Vajb> hmm I wonder, if company x trusts company y and company y trusts company x. Who is to say that x and y are trustworthy?
Oct 24 10:15:17 <Vajb> question raised while reading a backlog
Oct 24 10:16:16 <Maxdamantus> Vajb: the trust statements are backwards relative to how certificates normally work.
Oct 24 10:17:43 <Maxdamantus> It should be "y is trusted by x" and "x is trusted by y", since that's what's in the certificates ("y is trusted by x" -> "y includes a signature produced by x")
Oct 24 10:18:27 <KotCzarny> i think vajb wants to know who is at the top of trust
Oct 24 10:19:07 <Vajb> hmm ok, Im still not quite there yet or maybe what KotCzarny said...
Oct 24 10:19:35 <Maxdamantus> but what's imporant is whether you can follow the "_ is trusted by _" relations to a certificate that you're willing to inherently trust, which will happen in this case if either certificate exists in the browser's/OS' certificate store.
Oct 24 10:20:41 <Maxdamantus> afaik, being a "root" is not really important.
Oct 24 10:21:36 <Vajb> I thought more of as is there company z who says x and y are trustworthy
Oct 24 10:21:55 <KotCzarny> no? someone decides who can get in and when and at what conditions
Oct 24 10:22:10 <Vajb> but is this more related to blockchain?
Oct 24 10:22:18 <KotCzarny> and i suppose those in lower roots have to agree to some root conditions
Oct 24 10:22:30 <Maxdamantus> unless "root" means "exists in the browser's/OS' certificate store"
Oct 24 10:22:30 <Maxdamantus> as opposed to being issued by itself.
Oct 24 10:23:04 <KotCzarny> certificate stores usually use whatever is popular/"trusted"
Oct 24 10:26:24 <Vajb> so browser creator gets to decide what certificates his browser has by default?
Oct 24 10:26:31 <KotCzarny> yes
Oct 24 10:26:39 <KotCzarny> unless they use system's one
Oct 24 10:26:49 <Vajb> or maybe develober instead of creator...
Oct 24 10:26:58 <Vajb> developer*
Oct 24 10:27:00 <KotCzarny> but since browser's had to be consistent, they bundle certs themselves
Oct 24 10:27:25 <Vajb> ah os has its own certificates too?
Oct 24 10:27:27 <KotCzarny> some specific builds might use system's one
Oct 24 10:27:36 <KotCzarny> yeah
Oct 24 10:27:45 <Vajb> hmm
Oct 24 10:27:50 <KotCzarny> in debianish world they usually come as ca-certificates package
Oct 24 10:28:05 <KotCzarny> but curl packs it's own often
Oct 24 10:28:39 <Vajb> if some rogue developer puts some dubious certificates in his store would it be possible to them to spread and compromise whole chain of trust?
Oct 24 10:28:40 <KotCzarny> so basically it's a mess, which wouldnt be a mess in updated and supported distro
Oct 24 10:28:44 <KotCzarny> yup
Oct 24 10:29:10 <KotCzarny> but it would only be used by a that particular app
Oct 24 10:29:32 <KotCzarny> unless it goes rogue and modifies system
Oct 24 10:29:34 <Vajb> and that _could_ be possible with, say LE?
Oct 24 10:29:45 <KotCzarny> nah, LE is different story
Oct 24 10:30:19 <Vajb> ok, Im trying to wrap my head around why it is starbge that BMW uses LE.
Oct 24 10:30:26 <Vajb> strange*
Oct 24 10:30:28 <Juesto> eh, its a standard-ish thing
Oct 24 10:30:34 <KotCzarny> because LE is new kid on the block
Oct 24 10:30:51 <Juesto> root certificates are like the root domains, they're on top of the chain
Oct 24 10:30:59 <KotCzarny> and we have yet to see how well they manage things
Oct 24 10:31:45 <Juesto> if LE was a root cert on its own it would have been perhaps a little more exposed/scandalous/newsworthy
Oct 24 10:32:15 <Vajb> ah so it trust exp runs quite low still and it needs few level ups ;)
Oct 24 10:33:02 <Juesto> its more a service
Oct 24 10:33:27 <Vajb> I see.
Oct 24 10:33:44 <Juesto> apparently
Oct 24 10:33:49 <Juesto> dont quote me
Oct 24 10:34:03 <Juesto> neither rely
Oct 24 10:34:08 <KotCzarny> also, their value gets undermined by a 'free cert for everyone' idea
Oct 24 10:34:21 <KotCzarny> which basically includes malware
Oct 24 10:34:28 <Juesto> pfft
Oct 24 10:34:34 <Juesto> what a scam(?)
Oct 24 10:34:40 <KotCzarny> user might see 'oh it's a trusted site' without checking who is the owner of the cert
Oct 24 10:37:56 <Vajb> so should we always check who issued the cert? And even block some certs if they seem dubious?
Oct 24 10:38:06 <KotCzarny> no, who owns the cert
Oct 24 10:38:12 <KotCzarny> issuers are trusted
Oct 24 10:38:18 <Vajb> I think I never checked any certs
Oct 24 10:38:25 <Juesto> issuer != owner
Oct 24 10:38:32 <KotCzarny> but they might sell/issue cert to dubious entity
Oct 24 10:38:40 <Vajb> ah missed that part
Oct 24 10:39:34 <Vajb> actually I recall firefox complaining about certs being old in some page
Oct 24 10:39:53 <Vajb> (I know this is not related to this)
Oct 24 10:40:02 <Vajb> hmm that
Oct 24 10:40:26 <Juesto> must have been your clock or your store being outdated
Oct 24 10:41:13 <KotCzarny> or old browser without updated certs
Oct 24 10:41:16 <Vajb> or I was in some shady back alley of internet
Oct 24 10:41:30 <KotCzarny> might be that too
Oct 24 10:41:54 <Juesto> lel
Oct 24 10:42:03 <Juesto> oh ya you reminded me
Oct 24 10:42:07 <Vajb> I backed off, if you wonder ;)
Oct 24 10:42:16 <Juesto> yes some internet connection can cause issues with certs
Oct 24 10:42:19 <Juesto> and browser warnings
Oct 24 10:42:30 <Juesto> especially flaky ones
Oct 24 10:42:55 <Vajb> hmm can't recall if it was home or with some "free" wlan
Oct 24 10:43:33 <Juesto> there you go
Oct 24 10:43:40 <Juesto> wifi can be terrible
Oct 24 10:45:01 <Vajb> yup. That's why I don't use anything sensitive anymore while on free wifi
Oct 24 10:45:23 <Vajb> like on holidays
Oct 24 10:47:26 <Juesto> :)
Oct 24 10:50:52 <Maxdamantus> 23:28:39 < Vajb> if some rogue developer puts some dubious certificates in his store would it be possible to them to spread and compromise whole chain of trust?
Oct 24 10:51:06 <Maxdamantus> In his own store? Then he's just compromising whatever software uses that store.
Oct 24 10:51:26 <Maxdamantus> The trust store isn't going to magically replicate to other machines.
Oct 24 10:52:01 <Maxdamantus> The rogue developer would need to do something like change what certificates are distributed as part of something like a Firefox package, or curl or ca-certificates.
Oct 24 10:53:04 <Maxdamantus> (by "a Firefox package", I mean the package used for something like Debian)
Oct 24 10:55:51 <Maxdamantus> But ultimately, the "top" of the trust chain is the stuff running on your system.
Oct 24 10:57:03 <Maxdamantus> Since it's your browser that decides to look in certain places on the filesystem for certificates, and it's your harddrive that decides to return the blocks in the filesystem that happen to be stored certificates, and it's your CPU that decides to execute the browser's code in the correct way.
Oct 24 10:58:41 <KotCzarny> top, but still uses trust from the internet
Oct 24 10:58:50 <KotCzarny> so not the toppish top
Oct 24 10:59:13 <Maxdamantus> But you can say that about any CA, not just the "root" ones.
Oct 24 10:59:18 <KotCzarny> yup
Oct 24 10:59:53 <Maxdamantus> and since LE has a valid CA certificate, they're already fully trusted through these chains.
Oct 24 11:00:26 <Maxdamantus> whether that trust comes from certificates stored directly in Firefox/ca-certificates, or from another such certificate signing LE's one.
Oct 24 11:04:31 <Maxdamantus> actually, LE is already such a certificate on my system.
Oct 24 11:06:13 <Maxdamantus> so it's trusted by both my browser directly, and by DST (which my browser trusts directly)
Oct 24 12:49:50 <sixwheeledbeast> An issue is something like superfish, someone gets a fake cert into peoples cert store either through browser or bundled by manufacturer. In this example it was a fake Google cert so you think TLS is working. Malware can then MITM your data on your machine, potentially leaving you with your private and public keys written to your drive in plaintext, that's bad.
Oct 24 12:51:10 <sixwheeledbeast> Older companies are more trusted and therefore further up the web of trust.
Oct 24 12:51:23 <sixwheeledbeast> s/Older/Established
Oct 24 18:37:16 <Maxdamantus> Well, the superfish case is kind of analogous to just including actual software that can be considered malware.
Oct 24 18:37:56 <Maxdamantus> eg, some program that automatically runs and manipulates memory used by web browsers such that it shows websites as being safe when they're not.
Oct 24 18:38:55 <Maxdamantus> It's basically using the same "attack" vector: you control distribution of software, so you can control what the software does, either by including bad/modified software, or by including bad/modified "data" along with that software, such as certificates.
Oct 24 18:53:14 <Maxdamantus> note: the point of the above comments is: superfish is not the fault of any particular trust system, since any trust system is vulnerable to attacks involving control over software distribution.
Oct 24 20:08:39 <DocScrutinizer05> >><brolin_empey> DocScrutinizer05: What does “DocScrutinizer” mean?  Document(ation) Scrutinizer?<<  <<-that
Oct 24 20:09:31 <brolin_empey> DocScrutinizer05: OK.
Oct 24 20:10:41 <DocScrutinizer05> lice prolly all Nicks this one got 'designed' by a creative process and been inspired by "Mr Reisenweber eats documents for breakfast<< (quote of a colleague), Frank Zappa's "Joe's Garage", and the character of DocHoliday
Oct 24 20:12:27 <DocScrutinizer05> https://en.wikipedia.org/wiki/Doc_Holliday
Oct 24 20:17:24 <DocScrutinizer05> oops, the quote of my colleage actually was >>joerg eats datasheets for breakfast<<
Oct 24 20:18:18 <DocScrutinizer05> but there's no 3char file extension specific for datasheets ;-D
Oct 24 20:20:16 <DocScrutinizer05> it's surprising how often the reference to Joe's Garage gets instantly noticed though
Oct 24 21:10:33 <sixwheeledbeast> CSVScrutinizer05
Oct 24 21:40:34 <DocScrutinizer05> :-D
Oct 24 22:22:54 <sixwheeledbeast> Wow, a week of no spam on the wiki... well no anything. Maybe I have finally blocked all the rogue IPs... unlikely.
**** ENDING LOGGING AT Thu Oct 25 03:00:00 2018