• 0 Posts
  • 46 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle

  • An additionap note on what a certificate is, to supplement everyone here who’ve desceibe howbthat’s the missing piece:

    A certificate’s first main purpose is being the vehicle vy which the public key is distributed, but additionally it contains information ABOUT the owner. Then the whole thing is digitally signed with the private key (and also a trusted CA’s private key), so that a receiver can validate the authenticity of the cert with the public key.

    The “info” in the cert can theoretically be anything, but the most important one is the domain. Your browser knows that visiting google.com is secure because it checks the cert it gets from google.com to see if it states that it owns the google.com domain, and then we trust the root CAs around the world to make clients prove they own that domain, before issung a cert for it.


















  • There was another article I read that had a snippet from F5. As I read it, their concern was that they have two release tracks: the paid/subscription track, and the free track. They are actually the same code, but the free track is just 2 releases behind, so the idea is that if you want the “latest and greatest” stuff, you gotta pay. It’s a fairly common strategy in the industry.

    So, the concern is that for security vulnerabilities that are not CVEs, info about the vulnerability (and how to exploit it) is out in the wild for two whole releases, before the patch reaches the free-tier users.

    Seems like an actively good position on F5’s part, from this angle.