<![CDATA[This is literally "go fuck yourself" advice.]]>RE: https://mastodon.transneptune.net/@owen/116541558564007666

This is literally "go fuck yourself" advice.

]]>https://board.circlewithadot.net/topic/afa337b6-b5e9-4bb4-bcbf-d8203953f3d2/this-is-literally-go-fuck-yourself-advice.RSS for NodeFri, 15 May 2026 04:33:06 GMTFri, 08 May 2026 23:41:26 GMT60<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 16:40:27 GMT]]>@petrillic @ryanc @viq oh. Oh, shit.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/c0dec0dec0de/statuses/116545606635091537https://board.circlewithadot.net/post/https://hachyderm.io/users/c0dec0dec0de/statuses/116545606635091537Sat, 09 May 2026 16:40:27 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 16:26:09 GMT]]>@ryanc @viq somehow this never quite clicked this way before. This is a great description.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116545550389181003https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116545550389181003Sat, 09 May 2026 16:26:09 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 10:29:46 GMT]]>@ryanc @petrillic ah, thank you.

]]>https://board.circlewithadot.net/post/https://social.hackerspace.pl/users/viq/statuses/116544149037415963https://board.circlewithadot.net/post/https://social.hackerspace.pl/users/viq/statuses/116544149037415963Sat, 09 May 2026 10:29:46 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 06:35:37 GMT]]>@glyph @keithzg @petrillic @ryanc this feels like the words of someone who dumped his ex after finding out she was literally a demon from hell... every so often he thinks of the amazing sex and is halfway to dialling her number before he remembers the claw marks, the ichor, and the creeping, gibbering madness

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/http_error_418/statuses/116543228301547756https://board.circlewithadot.net/post/https://hachyderm.io/users/http_error_418/statuses/116543228301547756Sat, 09 May 2026 06:35:37 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 06:25:10 GMT]]>@viq @petrillic since revocation doesn't work worth shit, they're basically bearer tokens with extra steps

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/ryanc/statuses/116543187240138477https://board.circlewithadot.net/post/https://infosec.exchange/users/ryanc/statuses/116543187240138477Sat, 09 May 2026 06:25:10 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 04:35:14 GMT]]>@glyph @petrillic @ryanc It's been in operation a few years at work and It's Fine™ for our purposes but we're certainly not dynamically provisioning services or any such thing, it's *purely* for "make this host trusted for HTTPS purposes" and those hosts are few and static. And I definitely landed on just doing it with a few manual `openssl` calls and a convenience script or two after surveying the more fully-featured run-your-own-CA software options out there, laughing nervously, and then quickly shutting the door.]]>https://board.circlewithadot.net/post/https://fediverse.keithzg.ca/objects/2015cbdc-ef57-4f92-9132-cbac76581fa1https://board.circlewithadot.net/post/https://fediverse.keithzg.ca/objects/2015cbdc-ef57-4f92-9132-cbac76581fa1Sat, 09 May 2026 04:35:14 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 03:16:14 GMT]]>@petrillic It may be a pain; but at least there are a variety of somewhat non-obvious ways to make it actively dangerous without noticing. What's not to like?

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/fuzzyfuzzyfungus/statuses/116542444295894467https://board.circlewithadot.net/post/https://cyberplace.social/users/fuzzyfuzzyfungus/statuses/116542444295894467Sat, 09 May 2026 03:16:14 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 01:41:17 GMT]]>@keithzg @petrillic @ryanc citation: I once wrote a tool that made every user an mTLS CA in a complex dynamic trust mesh and in my darker moments I still think … maybe it could work …

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/glyph/statuses/116542070916720742https://board.circlewithadot.net/post/https://mastodon.social/users/glyph/statuses/116542070916720742Sat, 09 May 2026 01:41:17 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 00:43:19 GMT]]>@keithzg @petrillic @ryanc yeah everybody who eventually goes through the “find out” phase initially feels like this about operating a CA 🙃

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/glyph/statuses/116541842990110018https://board.circlewithadot.net/post/https://mastodon.social/users/glyph/statuses/116541842990110018Sat, 09 May 2026 00:43:19 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 00:38:51 GMT]]>@glyph @ryanc @petrillic I find running our own CA at my work easy enough, but the scale is verrrry small and frankly I'm probably skipping a lot of steps that "real" CAs wouldn't]]>https://board.circlewithadot.net/post/https://fediverse.keithzg.ca/objects/fe86201b-60e2-4cf3-b3ba-b7f5ea020da1https://board.circlewithadot.net/post/https://fediverse.keithzg.ca/objects/fe86201b-60e2-4cf3-b3ba-b7f5ea020da1Sat, 09 May 2026 00:38:51 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 00:21:19 GMT]]>@ryanc @petrillic as you mentioned in the replies, acme-dns for lan addresses is *almost* reasonable (I also do it, it’s… fine… I am sympathetic to the OP’s desire for more reasonable treatment of .local but I have unironically recommended it to people who have been more or less satisfied with it) but running your own CA is advice from people who have only daydreamed about operating PKI infrastructure.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/glyph/statuses/116541756507584381https://board.circlewithadot.net/post/https://mastodon.social/users/glyph/statuses/116541756507584381Sat, 09 May 2026 00:21:19 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 00:14:26 GMT]]>@ryanc @petrillic I clearly don't know enough. What are some of the reasons for "if you hate yourself"?

]]>https://board.circlewithadot.net/post/https://social.hackerspace.pl/users/viq/statuses/116541729431329505https://board.circlewithadot.net/post/https://social.hackerspace.pl/users/viq/statuses/116541729431329505Sat, 09 May 2026 00:14:26 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Sat, 09 May 2026 00:02:40 GMT]]>@ryanc yourself, and everyone who comes after you.

Whew 🙂 Choices.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116541683181974449https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116541683181974449Sat, 09 May 2026 00:02:40 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Fri, 08 May 2026 23:56:34 GMT]]>@petrillic when I was interviewing for my current job, it was relevant, so I told the guy who was interviewing me "...and you could use mTLS, if you hate yourself", and from that point on we were just casually chatting.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/ryanc/statuses/116541659203547227https://board.circlewithadot.net/post/https://infosec.exchange/users/ryanc/statuses/116541659203547227Fri, 08 May 2026 23:56:34 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Fri, 08 May 2026 23:53:40 GMT]]>@ryanc this is the kind way to view mTLS

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116541647778844206https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116541647778844206Fri, 08 May 2026 23:53:40 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Fri, 08 May 2026 23:51:37 GMT]]>@petrillic I ran a CA for my previous employer, I learned a lot, for example, fuck mTLS.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/ryanc/statuses/116541639741118719https://board.circlewithadot.net/post/https://infosec.exchange/users/ryanc/statuses/116541639741118719Fri, 08 May 2026 23:51:37 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Fri, 08 May 2026 23:47:11 GMT]]>@petrillic It _deeply_ is. I ran a small CA for my own services for a while, and it was a constant thorn in my side. I can't imagine trying to persuade visitors to use it or trying to get some kid's Switch to accept those certs, nor would I want to leave them with the wreckage afterwards.

]]>https://board.circlewithadot.net/post/https://mastodon.transneptune.net/users/owen/statuses/116541622284120569https://board.circlewithadot.net/post/https://mastodon.transneptune.net/users/owen/statuses/116541622284120569Fri, 08 May 2026 23:47:11 GMT<![CDATA[Reply to This is literally "go fuck yourself" advice. on Fri, 08 May 2026 23:42:17 GMT]]>I have, quite literally, written a bunch of code that (at least used to be) is part of a major commercial CA product.

You do not want to do this.

Unless you hate yourself. Deeply.

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116541602990362757https://board.circlewithadot.net/post/https://hachyderm.io/users/petrillic/statuses/116541602990362757Fri, 08 May 2026 23:42:17 GMT