Slashdot Mirror

← Back to Stories (view on slashdot.org)

US Homeland Security Employees Locked Out of Computer Networks (reuters.com)

Posted by msmash on from the trouble-in-connection dept.

Dustin Volz, reporting for Reuters: Some U.S. Department of Homeland Security employees in the Washington area and Philadelphia were unable to access some agency computer networks on Tuesday, according to three sources familiar with the matter. It was not clear how widespread the issue was or how significantly it affected daily functions at DHS, a large government agency whose responsibilities include immigration services, border security and cyber defense. In a statement, a DHS official confirmed a network outage that temporarily affected four U.S. Citizenship and Immigration Services (USCIS) facilities in the Washington area due to an "expired DHS certificate." Reuters first reported the incident earlier Tuesday, which a source familiar with the matter said also affected a USCIS facility in Philadelphia. Employees began experiencing problems logging into networks Tuesday morning due to a problem related to domain controllers, or servers that process authentication requests, which could not validate personal identity verification (PIV) cards used by federal workers and contractors to access certain information systems, according to the source.

88 of 133 comments (clear)

  1. Security focused by Fire_Wraith · · Score: 5, Insightful

    DHS is the primary government agency responsible for protecting the country's civilian infrastructure, including the internet and computer networks. I feel so much better knowing that they're so good at keeping their own systems secure, that even their own workers can't access them.

    1. Re:Security focused by Anonymous Coward · · Score: 5, Insightful

      What's so insecure about denying access due to an expired certificate? Isn't that an example of security measures working as expected?

    2. Re:Security focused by sycodon · · Score: 2

      I work for one of the largest Defense companies in the nation. In the last year we have had two major network outages. One related to provider issues and the other related to firewall changes gone bad.

      This shit happens. Creating/Managing/Upgrading huge networks like this a very complicated and delicate task.

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    3. Re:Security focused by Notabadguy · · Score: 4, Insightful

      Plot twist, the government doesn't manage their own networks anymore, for a while now they've been getting rid of military trained personnel and replacing them with civilian contractors.

      Keep in mind that Department of Homeland security != Military; the Department of Defense (military) is a separate department. And many DHS personnel are unskilled, uneducated workers. TSA and all the security theater is part of DHS. This news article is as special as "Exxon gas station cashiers locked out of computer network."

      Baggage handlers, X-Ray viewers, clerks, and even janitorial staff proudly introduce themselves in public as "I'm with Homeland Security." It sounds a lot better than "I'm a baggage handler at the airport."

    4. Re:Security focused by freeze128 · · Score: 1

      Just because the security measures are EXPECTED to work that way, doesn't mean that they're good.

    5. Re:Security focused by Anonymous Coward · · Score: 1

      Availability is a third of the information security triad (Confidentiality, Integrity, Availability). They should have had a plan in place and an alert being sent to a person or three to ensure the cert gets renewed or replaced.

    6. Re:Security focused by Streetlight · · Score: 1

      Sounds like the ultimate in security - pull the plug.

      --
      In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
    7. Re:Security focused by hambone142 · · Score: 1, Troll

      We're talking about government "workers". Perhaps they were upgrading their LGBTQRSTV skills or brushing up on break taking.

    8. Re:Security focused by Nunya666 · · Score: 1

      I work for one of the largest Defense companies in the nation. In the last year we have had two major network outages. One related to provider issues and the other related to firewall changes gone bad.

      This shit happens. Creating/Managing/Upgrading huge networks like this a very complicated and delicate task.

      Certificate management is not a complicated task. Expired certificates is an example of incompetence, not an example of "complicated shit that just happens". It should be somebody's job to manage those expiration dates, period.

    9. Re:Security focused by aaarrrgggh · · Score: 1

      Replying to fix a fat-fingered mod.

      Much like the most secure computer ever made: no drives, no network, no HMI, and no power supply.

    10. Re:Security focused by zugmeister · · Score: 1

      Isn't that an example of security measures working as expected?

      Security measures working properly is only good in the proper context.

      Car analogy: Your alarm goes off and locks both your steering and brakes. This is good for anti-theft. This is bad if it happens as you're cruising down the freeway.

    11. Re:Security focused by GeekBird · · Score: 2

      On the systems I administer, we have an alert that checks the certificate expiration once a day, and alerts it plenty of time to get it renewed.

      But a lot of people don't do that, they just mark it on a calendar somewhere, or expect the certificate issuer to notify them. For the latter, often the contact email is to a person no longer with the organization, or in a different role, so it is ignored. That's why my current $Employer insists that certificate emails go to an email list for a group, rather than just to one person.

      It wouldn't be quite as funny if it wasn't so very common.

      --
      use Sig::Witty;
    12. Re:Security focused by dbIII · · Score: 1

      I feel so much better knowing that they're so good at keeping their own systems secure, that even their own workers can't access them

      Given some of the people working for them (eg. the TSA gropers) I actually would feel good about it, but not as good as if they slash that massive mall cop welfare program and have some sort of professional airport security instead. While they are at it they can get rid of the DHS guys who go around to toy shops and check if rubicks cubes are legit instead of knockoffs (now that was a weird story).

    13. Re:Security focused by dbIII · · Score: 1

      It's an example of mismanagement and no proper procedures to keep the certificates up to date and an incredibly common failure. Even Microsoft had a very high profile failure of that kind not long ago.

      Incompetence is someone not doing their allotted tasks.
      Mismanagement is forgetting to allocate a required task to someone.

    14. Re:Security focused by ebvwfbw · · Score: 1

      How can you? Sure, if you have just one machine or two it's no big deal. Suppose you have a modern government agency, a business of any real size, etc? You have the web site - no big deal, they just get a warning message. Then there are the Unix based systems that run ldap, san, well most everything. Blade centers for VMs and such. Then the lightweight stuff that feed the dumb people like the Windows domain controllers and such. Things that people don't use much. It's getting to be a real PIA to find all of these frickin' certificates! They aren't even on standard ports to find. We had a san certificate that had a 10 year life blow out recently because we hit the expiration date. Things came to a grinding halt. That one was by IBM and IBM doesn't even own it anymore.

      It's a bitch. If you set it so it doesn't halt things, nobody cares. They'll use a decades old expired certificate - which BTW is almost certainly fine. Expire it and things come to a grinding halt, people can't get work done, sometimes people can't even get machines working to the point they can even fix it anytime soon.

      I'm just waiting for something like this to happen to say an amusement park on opening day, right on the day some government agency spent a whole bunch of money to promote - say IRS tax day or something. Wouldn't it be hilarious if they have a big march and all the electronic equipment comes to a grinding halt because the certificate was generated in the morning 5 years before and that was the die by date. Just before the big deal.

      Imagine self driving cars. Poof, you're really nice super Edison Roadster shuts down entirely and won't do a thing now because the Mr. Reactor has an expired certificate and you're in the Holland Tunnel into NYC. So are other Edison Roadsters all over town, all over the country!

    15. Re:Security focused by arglebargle_xiv · · Score: 1

      Exactly. Certificate expiry is a CA billing mechanism to make sure you pay your dues every year. Claiming that a certificate that's fully secure at 11:59:59 is totally insecure at 12:00:01 just because the clock ticked is nonsense.

  2. Doing more with less.. by lionchild · · Score: 5, Insightful

    I think I'd like to take this opportunity to point out that this is what happens as we do more and more with IT on less and less staff. While I understand sometimes we think of IT as a cost-center and not a revenue generator, it probably needs to be thought of as more like a utility; because without the lights, water, phones...and internet, you can't do business very effectively these days.

    That being said, this happens more and more. Someone is responsible for renewing certificates, but as we renew them for longer and longer periods, that means we simply start to forget about them. Then with the certificate issuer sends out an notification to that IT staffer who used to do that, but was 'right sized' a year and a half ago...no one gets the email. So, the certificate expires and this happens. Same song, different, louder verse, apparently when it happens to DHS, and likely more embarrassing.

    Bottom line: Doing more with less, isn't always in everyone's best interest.

    --
    Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
    1. Re:Doing more with less.. by TechyImmigrant · · Score: 4, Insightful

      That being said, this happens more and more. Someone is responsible for renewing certificates, but as we renew them for longer and longer periods, that means we simply start to forget about them.

      An alternative viewpoint is that this is one of the ludicrously bad failings of PKI. Requiring someone to remember to do an infrequent and short task at a point 1 or 2 years in the future, or the whole system collapses when they forget or leave or get booted. We could fix (I.E. delete and replace) PKI and this specific failure would not happen, so the overworked IT staff can go back to deploying Windows NT patches.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    2. Re:Doing more with less.. by swb · · Score: 1

      I think you're basically right, PKI implementations are horribly complex in practice and doubly (or more!) so with Windows.

      It seems to get worse as certificate-based security gets added into products as defaults installations. As an example, Exchange 2016 installs a self-signed certificate by default which gets assigned to SMTP and IIS. The normal (spanning back several releases) process of adding and assigning a public certificate to services doesn't change the self-signed certificate assignment and use for the IIS Exchange Back-End site or for transport connectors.

      I ran into these are problems recently with a customer who deleted the self-signed certificate after installing and assigning his public certificate. Bam, dead Exchange GUI -- had to re-bind the back-end Exchange site in IIS with the public certificate.

      Another customer had "verify certificates" enabled on their spam service and when they switched SMTP delivery to the new server, the self-signed cert was still being used by the front-end receive connector. It took some kludgy, un-documented Powershell to force the connector to use the public certificate -- ie, the attribute has to be built as a compound variable using sub-attributes of the public certificate combined with some text, and then that variable assigned as the TlsCertificateName on the connector.

      So even if you're trying to use certificates, application behavior and certificate selection is pretty opaque in many cases and can actually ignore specific certificate assignment options.

      I won't even get into the management trainwreck that is Windows certificate server, with its 2003-era dialog boxes and management tools. In my mind at least, all of this could be modernized and made much simpler to manage, but the toolchain remains completely user-hostile.

    3. Re:Doing more with less.. by Archangel+Michael · · Score: 1

      There are several issues with most systems that require certificates to work correctly.

      1) Certificates Expire, on a regular basis, have a plan to update them (Auto renew)
      2) Notifications should be sent to a "group" email address, not an individual.
      3) We have these things called "Calendars" use them
      4) Documentation is key, even if 1-3 fail you should have a searchable document that has they dates listed for key events.

      The problem is, nobody ever documents shit like this, because actual documentation process takes more time than actually doing the Cert updates.Except when you measure the failure to renew it in time.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    4. Re:Doing more with less.. by EndlessNameless · · Score: 4, Informative

      Requiring someone to remember to do an infrequent and short task at a point 1 or 2 years in the future

      Bullshit.

      I could write a PowerShell script in maybe 10 minutes that will list all of the computers in the domain, connect to them, and check for expiring certificates. I can get a reminder in advance---90 days, 30 days, a week, whatever I want. All I have to do is one thing: understand my job.

      Alternatively, some tools (like Nessus, which is FOSS) have audits which automatically check for expiring certificates. They can be configured to email a report, and you can notified every day/week/month if you have expiring certs.

      This is a stupid, incompetent failure. You can build or buy a tool to avoid this problem very easily. Compared to using passwords, the only reasonable complaint is that you require decent sys admins.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    5. Re:Doing more with less.. by Joe_Dragon · · Score: 1

      what about something like certteam@gov.org get's lost in a resizing / outsourcing and is no longer tied to anyone and then the renew cert emails go no where?

    6. Re:Doing more with less.. by swb · · Score: 1

      Why aren't these tools built in, though?

      IMHO, PKI on Windows is problematic less because PKI is complex but more because the in-built tools suck or are non-existent.

      Most IT admins are oversubscribed enough that writing that Powershell script or putting together the third party tools for certificate expiration won't happen, especially when you consider for most organizations the number of certificates that matter is relatively small.

      I will grant an exception for Homeland Security, though, as any organization using PKI to that extent ought to have an entire team responsible for managing it, which means they would have the time/tools/experience to deal with it.

    7. Re:Doing more with less.. by Attila+Dimedici · · Score: 1

      OK, so you have written such scripts to notify you. Now the company decides they do not need you any more. Are you going to rewrite those scripts to notify someone else? Or even bother to mention to someone that they should do so?

      Or the other scenario where you get another job midway between renewals (when you have not had a notification in several months). Will you remember to change who gets notified? Will you remember to tell someone? When you remember 3-6 months later that you would be getting notifications about now, will you call your old employer to let someone know the notifications were never changed?

      In a lot of companies, certificate renewal becomes someone's job because they are in the right place at the right time to handle it and everyone else forgets that it even happens until something goes wrong. If nothing goes wrong for several years, no one, except the guy who handles it, remembers that it even happens. This happens with a lot of tasks, and is my biggest fear whenever someone leaves our IT Department: what minor tasks were they doing that they were doing so well we all forgot about them?

      It has been great at my current job, only one of the people in our IT Department who was here long enough to do anything everyone would forget about who subsequently left was good enough at it for people to forget...that one person only left because they became suddenly ill and died. Dealing with their absence has been a mess.

      --
      The truth is that all men having power ought to be mistrusted. James Madison
    8. Re:Doing more with less.. by thegarbz · · Score: 1

      Requiring someone to remember

      Requiring someone to remember to do something is not a bad failing of PKI.

      It's a bad failing of organisational systems that are supposed to catch this.
      It's a bad failing of automation systems which could remove the task.
      It's a bad failing of management systems that ensure the task is complete before it becomes an issue and flag it for appropriate response.

    9. Re:Doing more with less.. by Rastl · · Score: 1

      Requiring someone to remember to do an infrequent and short task at a point 1 or 2 years in the future

      Bullshit.

      I could write a PowerShell script in maybe 10 minutes that will list all of the computers in the domain, connect to them, and check for expiring certificates. I can get a reminder in advance---90 days, 30 days, a week, whatever I want. All I have to do is one thing: understand my job.

      Alternatively, some tools (like Nessus, which is FOSS) have audits which automatically check for expiring certificates. They can be configured to email a report, and you can notified every day/week/month if you have expiring certs.

      This is a stupid, incompetent failure. You can build or buy a tool to avoid this problem very easily. Compared to using passwords, the only reasonable complaint is that you require decent sys admins.

      You forgot the part where you were part of a RIF 18 months ago and now your script points to an email address that no longer works. Good on you for automating it but it still takes coordination and adequate staffing to make it happen.

      Instead of bragging about how great you are maybe you could look at the challenges of managing a huge infrastructure and see how some things - important things - can be overlooked because someone 'just made it happen', didn't document it, tied it to their personal account, and then is no longer there.

    10. Re:Doing more with less.. by lgw · · Score: 1

      Terrible management if that happens. No doubt that's the case here.

      Any big network has a dedicated monitoring system with all sorts of plug-ins. Certificate monitoring is just another plug-in. You (if competent) write the plug-in once, and the notification is just the normal for the whole system. You (if good) write a system to auto-renew all your certs based on these scans and notifications, and alarm if the auto-renew fails for long enough..

      We had a team that did that where I work. It was particularly amusing when that team's certs all expired - they had chosen to leave themselves out of their own system, for some reason.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    11. Re:Doing more with less.. by GeekBird · · Score: 1

      Terrible management if that happens. No doubt that's the case here.

      Any big network has a dedicated monitoring system with all sorts of plug-ins. Certificate monitoring is just another plug-in. You (if competent) write the plug-in once, and the notification is just the normal for the whole system. You (if good) write a system to auto-renew all your certs based on these scans and notifications, and alarm if the auto-renew fails for long enough..

      We had a team that did that where I work. It was particularly amusing when that team's certs all expired - they had chosen to leave themselves out of their own system, for some reason.

      I've written plugins like that.

      What gets bad is the alert goes off, and says you have 90 days to renew. Having no power to spend money, you dutifully route a request for a renewal to be paid for. It goes back and forth to accounting for a couple months asking for justifications for the (trivial) expense because no one will give the operations people a p-card or budget. Finally, if you are lucky, a P.O. is issued (for a trivial amount), and you can buy a new certificate before the old one expires. If not, it expires, everyone bitches and calls you incompetent, and all you can do is point to the three month old purchase request and say "We tried to do the needful". Then you are first in the next round of layoffs because of "incompetence" and having embarrassed the bean counters.

      --
      use Sig::Witty;
    12. Re:Doing more with less.. by dbIII · · Score: 1

      Yes the task is not difficult.
      However very frequently nobody has been assigned to do the task.

      I'm in a small place and can feel smug due to stuff like certwatch notifiying multiple people, but in large places with poor management tasks fall between the cracks. "I thought X was going to do it" is a frequent cry in large barely functional shambolic orgs where execs spend more time golfing than managing, hence the DHS getting hit with this.

    13. Re:Doing more with less.. by dbIII · · Score: 1

      OK, so you have written such scripts to notify you. Now the company decides they do not need you any more. Are you going to rewrite those scripts to notify someone else?

      In the *nix world you send it to root, postmaster or whatever - a role not a person, so that the next person in the role gets the notifications. That's assuming a real mail server someone and not an enormous flaky suite that tells you to Exchange it for something more reliable.

    14. Re:Doing more with less.. by lionchild · · Score: 1

      Additionally, all of the above isn't overly helpful (except maybe the group email address), if you start outsourcing whole departments. Even if if you document things, the chances are there will be some things, like this, lost in translation.

      However, you're right, they're generally effective steps to mitigate this issue. Especially number 1, if your credit card info never expires. :-)

      --
      Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
    15. Re:Doing more with less.. by EndlessNameless · · Score: 1

      OK, so you have written such scripts to notify you. Now the company decides they do not need you any more. Are you going to rewrite those scripts to notify someone else? Or even bother to mention to someone that they should do so?

      Shouldn't be a problem.

      1. The script and its purpose should be documented. Another admin should be able to update it as needed.

      2. The output can be emailed or dumped to a file share. Virtually every mail servers supports lists, so the list (or the file share ACL) would just need to be updated.

      In a lot of companies, certificate renewal becomes someone's job because they are in the right place at the right time to handle it and everyone else forgets that it even happens until something goes wrong.

      First, this "problem" does nothing to change the fact that 2FA is far more secure than passwords.

      Second, this is the result of poor management. Any process can become failure-prone in the face of poor management. You need some ITIL training (or equivalent).

      It takes a lot of effort to become a well-run organization, but it is totally worth it.

      Dealing with their absence has been a mess.

      Entirely avoidable. But it requires discipline from the organization.

      1. Poorly-defined processes.

      2. Lack of documentation.

      3. Lack of personnel depth (aka, cross-training---if you need redundant servers then you also need redundant skill sets)

      4. Poor change control (his solo fixes should have been discussed and understood by management and the team)

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    16. Re:Doing more with less.. by EndlessNameless · · Score: 1

      Having no power to spend money, you dutifully route a request for a renewal to be paid for. It goes back and forth to accounting for a couple months asking for justifications for the (trivial) expense because no one will give the operations people a p-card or budget.

      While it's usually bad to exaggerate, you don't need to.

      The justification should mention that the entire corporate network will become unstable or unavailable if this procurement is not completed by the deadline, which should be at least a few days ahead of the actual expiration date.

      Ideally, the IT management hierarchy will understand and push it through. If not, they should at least be capable of understanding the necessity when their experts start barking about the importance of such a minor purchase.

      And if it takes an organization 100 days to procure things, then the staff should begin a critical procurement at least 120 days in advance. The alerts are useless if they do not allow time to respond.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    17. Re:Doing more with less.. by EndlessNameless · · Score: 1

      Why aren't these tools built in, though?

      PowerShell is a very powerful tool, and it is built in. But that's not what you meant.

      There are two ways to get it from the vendor. You pay in cash or labor.

      Microsoft is happy to sell you SCOM, which is their network management dashboard (among other things). Very useful in a Windows-dominated environment, but there are better third-party options for shops with Linux and Mac systems.

      Unless you're talking about the lowest tier of admins, scripting is part of the job. I cannot understand how people function without CLI literacy. The number of repetitive tasks would be mind-numbing.

      I have no problem going to management saying "you can pay $XX thousand per year for operations management software, or I can spend a couple days writing and testing a script." I am perfectly happy offering a cheaper alternative that adds to my credibility and value. Always expand your expertise and share with your team if you have the chance.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    18. Re:Doing more with less.. by TechyImmigrant · · Score: 1

      Nope it's a bad failing of PKI. Writing a spec that takes something computers do well and humans to badly and handing it over to the humans.

      Not everybody has an IT department. Do you think they should not benefit from communication security because they don't fit the PKI model well.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    19. Re:Doing more with less.. by swb · · Score: 1

      I like the idea, but I find it clashes with reality too often.

      Management wants everything for free, SCOM they won't pay for and scripting is seen variously as a kind of technological masturbation and time wasting or the creation of unmanageable spaghetti.

    20. Re:Doing more with less.. by swb · · Score: 1

      That's kind of bullshit, really, because the enable-exchangecertificate -services flag specifies specific services in an umbrella manner (eg, IIS, SMTP, etc) and neither it nor its official documentation explains that assigning a certificate to these services *won't* actually use this certificate.

      Ie, the -services iis flag will get your assigned cert for OWA/ActiveSync/OA with IIS, but the Backend site will hang onto the self-signed cert at installation, as will hub transport SMTP. And it's poorly documented at best and NOT mentioned in the enable-exchangecertificate documentation in addition to running counter to past version behavior.

      But the larger problem is that Exchange on premise is rapidly become a spaghetti mess of code written mostly for O365 hosting and cut-down and neutered for sites not quite ready to pay 3 to 5 times as much for hosted Exchange. The documentation blows, which is magnified as more and more configuration melts into a maze of Powershell commands.

      I predict that by Exchange 2019 or whatever the next version is that MS will have reduced the documentation and ease of management so much that only sites large enough to support dedicated exchange teams (and access to high-level support) will even be able to run it on premise.

    21. Re:Doing more with less.. by thegarbz · · Score: 1

      Writing a spec that takes something computers do well and humans to badly and handing it over to the humans.

      The spec has done no such thing.

    22. Re:Doing more with less.. by TechyImmigrant · · Score: 1

      Writing a spec that takes something computers do well and humans to badly and handing it over to the humans.

      The spec has done no such thing.

      Show me where in any X.509/PKI/Application auth related spec it solves the automated continuity problem.
         

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    23. Re:Doing more with less.. by thegarbz · · Score: 1

      If you can do it with a person and you don't need someone to manually verify something, then it can be automated. PKI specs do not prevent you from doing that.

    24. Re:Doing more with less.. by TechyImmigrant · · Score: 1

      But the CA model certainly does.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  3. A problem that is easily fixated by DickBreath · · Score: 1

    No big worry if it is merely an expired certificate. Merely incompetence. An ordinary thing that is to be expected.

    It would have been a bigger concern if, for security reasons, the president had ordered all passwords changed to the same code used on the president's luggage.

    --

    I'll see your senator, and I'll raise you two judges.
    1. Re:A problem that is easily fixated by XxtraLarGe · · Score: 1

      12345?

      --
      Taking guns away from the 99% gives the 1% 100% of the power.
  4. Re:NOT NEWS! by NatasRevol · · Score: 1

    It's Wednesday. The issue happened on Tuesday.

    So, how did it come out 'TWO DAYS AGO'?

    --
    There are two types of people in the world: Those who crave closure
  5. GOOD! by Gravis+Zero · · Score: 1

    That's how expired certificates are supposed to work!

    --
    Anons need not reply. Questions end with a question mark.
  6. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    Journalists need a minimum of two anonymous sources to report something as factual to the public. Three anonymous sources is probably CYA from a #FakeNews accusation.

  7. Re:Too Hard by __aaclcg7560 · · Score: 1

    The new version of PHP should fix that problem.

    https://developers.slashdot.org/story/17/02/21/2039256/php-becomes-first-programming-language-to-add-modern-cryptography-library-in-its-core

  8. Cert expiration == not a surprising cause by ErichTheRed · · Score: 2

    The interesting part of the article isn't about who is affected, but the "certificate expiration" aspect. I've recently started doing the legwork necessary to learn about public key infrastructure (for our company's internal consumption) and have found that there are 3 prevalent camps out there:
    - Developers who just say "here's my credit card, VeriSign, make my customers' browser address bars turn green."
    - Admins who get just enough of a PKI background to make the certificate errors go away, then run away screaming -- or worse yet, had it implemented a decade ago by a consultant and have NO CLUE how it works or how to fix it
    - Auditors who just say "lock icon, green browser windows, check. Congrats, you're PCI compliant."

    For something so critical like certificates, there really is a dearth of resources out there that isn't aimed at hardcore security programmers or one of these three groups. Cert expirations have figured prominently in many outages -- Azure had a partial outage a few years ago because of that very reason. I'm seriously considering writing a "PKI for non-dummies" series of blog posts or something because the amount of misinformation out there is scary!

    1. Re:Cert expiration == not a surprising cause by Scarred+Intellect · · Score: 1

      I'm seriously considering writing a "PKI for non-dummies" series of blog posts or something because the amount of misinformation out there is scary!

      Please do. I'm going to have to start learning about this pretty soon for a project I'm working on. I've avoided it up to this point by Googling and clicking boxes and trying and knowing JUST ENOUGH to scrape by and expand existing infrastructure...

    2. Re:Cert expiration == not a surprising cause by aaarrrgggh · · Score: 1

      There really is plenty of good documentation out there, and it isn't that hard to manage. The real problem is category 2 and its permutations-- oh, they expire!, what is a CRL!, or where is the offline root certificate stored!?

      The main issue I have is effectively planning, compartmentalization, and execution to ensure a multi-level PKI system is effective and maintainable. It stops me each time I go to set up PKI for our VPN or phone system or ...anything else. A poorly planned system can make things worse.

  9. No problem by PPH · · Score: 1

    Just call Sandeep in the IT department and have him fix .......

    Uh, oh.

    --
    Have gnu, will travel.
  10. Re:Stop the presses! Someone in IT fucked up! by barbariccow · · Score: 1

    If I'm one anonymous source... I'm a thousand.

  11. Re:Stop the presses! Someone in IT fucked up! by fahrbot-bot · · Score: 1

    Journalists need a minimum of two anonymous sources to report something as factual to the public. Three anonymous sources is probably CYA from a #FakeNews accusation.

    On the other hand, what's the standard for getting #RealNews from our new administration? Seems the more sources they provide, the less "real" their news and facts are. Hmm... Let me do some math... Maybe zero administration sources are needed.

    --
    It must have been something you assimilated. . . .
  12. Re:NOT NEWS! by K.+S.+Kyosuke · · Score: 1

    No way! The Shuttle DISINTEGRATED?

    --
    Ezekiel 23:20
  13. Re:NOT NEWS! by TWX · · Score: 1

    Space Shuttle Challenger DISINTEGRATES in the upper atmosphere. Several ASTRONAUTS without parachutes are DEAD.

    Did you write UNIX fortune entries back in the day? This is formatted just like a lot of them...

    --
    Do not look into laser with remaining eye.
  14. Some apps need to have the certs installed into th by Joe_Dragon · · Score: 1

    Some apps need to have the certs installed into them even with LDAP stuff each app may need the LDAP keys installed to it's own key store for it to be able to ldap login's.

  15. Check the boss's pc. by samspock · · Score: 1

    I would be very funny to check Trumps laptop to see something like "Your files have been encryped. Send 2 million bitcoins if you ever want to see them again" It's always the boss that does this.

  16. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    Maybe zero administration sources are needed.

    The current administration is leaking like the Titanic while everyone is too busy rearranging the deck chairs in the Oval Office.

  17. Nothing to worry about by 93+Escort+Wagon · · Score: 1

    Giuliani was just converting all the servers to a five-year-old version of Joomla.

    --
    #DeleteChrome
    1. Re:Nothing to worry about by Bob+the+Super+Hamste · · Score: 1

      Giuliani was just converting all the servers to a five-year-old version of Joomla.

      So a massive modernization then.

      --
      Time to offend someone
  18. Re:Stop the presses! Someone in IT fucked up! by Archangel+Michael · · Score: 3, Interesting

    All News is fake depending on who is reporting and who is the reader/viewer.

    Kind of like "Planned Parenthood doesn't use public funding for abortion services". Technically "accurate", but really not even close to being accurate.

    A woman comes in for an abortion, but gets six other "tests" and diagnostics done. Pregancy test, Pap smear .... etc. All those other "tests" are paid for by government money, none of which are part of the actual "abortion" procedure. Since that Planned Parenthood clinic provides mostly abortion related services, they are "government funded" and would fold if they didn't get any other funding. They subsidize the Abortion with federal monies, using loopholes.

    Technically it is "true" that PP doesn't use federal dollars for "abortion". Realistically it is fully subsidized procedure using loopholes. Both sides are considered "alternative facts" by the other side. And the reason we can't have civil discourse about anything any more.

    And watch this get modded "Troll" since I used the inflammatory "Planned Parenthood / Abortion" example by people who can't actually debate the actual topic.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  19. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    If I'm one anonymous source... I'm a thousand.

    That may work for Fox News. Real journalists care about their reputation. If they ever get into court and have to reveal their sources, it would be awfully embarrassing that a thousand anonymous sources turned out to be one person.

  20. Re:Stop the presses! Someone in IT fucked up! by barbariccow · · Score: 1

    For me, at least, there's a difference between "anonymous" and "name not released" or "redacted." Like if I make an anonymous tip, it's different than if I make a tip on the condition of anonymity. It's generally reported on differently too when they list the source. Maybe I'm just trusting the summary writer in their use of terms too much though; this is slashdot after all.. you wouldn't actually expect me to verify the summary with TFA would you??

  21. Re:Stop the presses! Someone in IT fucked up! by fahrbot-bot · · Score: 1

    And watch this get modded "Troll" since I used the inflammatory "Planned Parenthood / Abortion" example by people who can't actually debate the actual topic.

    I don't know enough to discuss the example you provided, but can offer that the funding/expense for Planned Parenthood is probably more complicated than what you proposed and certainly open to skewed interpretation (especially by those opposed to their services -- specifically and, apparently, as a whole) as described by this article from Fact Check: http://www.factcheck.org/2015/...

    --
    It must have been something you assimilated. . . .
  22. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    Maybe I'm just trusting the summary writer in their use of terms too much though; this is slashdot after all.. you wouldn't actually expect me to verify the summary with TFA would you??

    One time I submitted an manuscript to a magazine. When the magazine was published, I've noticed many errors in every piece. When I asked the editor about all the errors, his response killed me: "An editor doesn't edit."

    I never did find out what an editor does if he doesn't edit.

  23. First Rule of IT by IWantMoreSpamPlease · · Score: 2

    Always install a backdoor.

    For times like this.... ...and for "other" times, as needed.

    --
    So rise up, all ye lost ones, as one, we'll claw the clouds.
  24. Re:NOT NEWS! by NatasRevol · · Score: 1

    Given that a) the 00:00 wasn't part of the story, and b) 23:59 hasn't happened yet in the affected area, c) what the fuck are you on about?

    --
    There are two types of people in the world: Those who crave closure
  25. Re:Mammograms by __aaclcg7560 · · Score: 1

    That's right, PP has not performed a SINGLE breast cancer screening, despite it being the first thing they list every time funding is threatened from them.

    Planned Parenthood does clinical breast exams and make referrals for mammograms if warranted. Interestingly enough, its the group's supporters who talk about mammograms all the time.

    https://www.washingtonpost.com/news/fact-checker/wp/2015/10/02/the-repeated-misleading-claim-that-planned-parenthood-provides-mammograms/

  26. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    There was a riot in Sweden yesterday, setting a city on fire, started by refugees, in an area designated by the local police as a "no-go area".

    That took place after Trump's "last night in Sweden" speech. What Trump may have been referring to was something he saw on Fox News. If it was on Fox News, it must obviously be true. Unfortunately, Fox News is not an accurate news source.

  27. Re:Stop the presses! Someone in IT fucked up! by Fire_Wraith · · Score: 1

    First, you shouldn't be surprised if you get modded Troll for deliberately using a flamebait/trolling example that is wholly unrelated to the topic.

    Second, you're deliberately confusing the issue. If I operate a business, and I sell pork products, and you buy a steak from me, you're not paying for pork, no matter how much you scream about marginal costs and fungible funds.

    Third, you're creating a strawman argument, because Planned Parenthood does not primarily provide abortion services, attempts to play cute with the numbers aside. At most the number of PP patients who received an abortion was 12% of the total, and that's assuming none had more than 1.
    Reference: http://www.factcheck.org/2015/...

  28. Re:NOT NEWS! by TheGratefulNet · · Score: 2

    timecube guy.

    4 simultaneous days.

    something along those line. details are unimportant.

    --

    --
    "It is now safe to switch off your computer."
  29. Re:Mammograms by __aaclcg7560 · · Score: 1

    You would be better served just shutting up at this point.

    I'm going to exercise my 1st and 2nd Amendment rights. Don't like it? Fuck off.

  30. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    Do people on the left ever think for themselves?

    I'm a moderate conservative. I DON'T SUPPORT TRUMP!

  31. Told you to pay that bill by WillAffleckUW · · Score: 1

    Next time listen

    --
    -- Tigger warning: This post may contain tiggers! --
  32. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    Sure, thats why you lie to support Planned Parenthood, lie to smear Trump, and then threaten to shoot people.

    Where in my comment did I threaten to shoot people?

    Moderate indeed. Lie #3 from you just today.

    Calling me a liar doesn't change the fact that you're wrong.

  33. Re:Stop the presses! Someone in IT fucked up! by Archangel+Michael · · Score: 2

    1) Yeah, which is why I did it. Inflamatory subject using rational thought. Imagine that.

    2) If you ran a Hamburger Restaurant and said that you're not a "Hamburger" place because only 33% of your business was "Hamburgers", would you be telling the truth, or telling a lie?

    You sell Hamburger, fries, and a soda, and count that as 1/3, 1/3, 1/3 you'd technically be correct. But everyone in the world would understand that you're in the "hamburger" business. Right?

    3) So, yeah, Abortion procedure itself is only 12%. Technically correct using the metric as applied by PP, which is VERY similar to how I explained above. How about you ask the question differently. How many people visiting PP are there to get an abortion vs "other" services they offer. BTW, those "other" services are fairly limited to .... being an abortion provider.

    They claim to be "women's health" but they do not offer Prenatal anything ... except abortion. They don't offer Mammograms like they continue to claim (as in NONE). They don't do .... a whole lot of things related to "women's health". (Fact Check article is technically correct: Lies, Damn Lies and Statistics)

    BUT I have an idea, I've suggested a number of times. Planned Parenthood can keep all the funding it gets now, if they stop providing abortion or referrals for abortion. Lets see how much of their Business is Abortion. I'll bet it is like a Hamburger shop not being able to actually sell burgers. Just fries, cokes .... And yes, this would settle the case, once and for all. Their primary business is abortion. They can't exist without it.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  34. Re:Stop the presses! Someone in IT fucked up! by lgw · · Score: 1

    Real journalists care about their reputation.

    Nice one! Of course, actual journalists threw all that overboard in a desperate attempt to get the Right Person elected. Lost both credibility and the election.

    Journalism has been "fiction inspired by true events" for decades, maybe forever. Journalists believe their job is telling the peasants what to think. The truth is one of many tools for that job.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  35. Re:Same Problem different Cause by GeekBird · · Score: 1

    The contract to support the network is sent out for rebid and the winning contractor sees the position responsible for managing certificates as a cost-savings "opportunity" and eliminates the position or combines it with another task and now no one is responsible for the task or the guy that knew how/when the certificates needed to be renewed got too expensive so the position was filled with a newbie with no experience.

    Yep. That happens all too often in accountant managed companies.

    Half of the real reason that tech outfit like to hire young RCGs and recent immigrants is that they cost much less than anyone with even 5 years of experience, much less 25 years. This is why most software sucks.

    --
    use Sig::Witty;
  36. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    Of course, actual journalists threw all that overboard in a desperate attempt to get the Right Person elected.

    The media got the person that they wanted for POTUS: Donald J. Trump. His administration will make Nixon and Reagan look like amateurs in terms of scandals, indictments and prison sentences.

    Journalism has been "fiction inspired by true events" for decades, maybe forever.

    Creative non-fiction. People don't want facts, they want a story (or, in today's political discourse, a narrative).

  37. Re:Stop the presses! Someone in IT fucked up! by GeekBird · · Score: 1

    Link or it is just more right wing fake news

    --
    use Sig::Witty;
  38. Re:Stop the presses! Someone in IT fucked up! by dbIII · · Score: 1

    What Trump may have been referring to was something he saw on Fox News

    There's no point trying to find out a reason for one of Trumps lies. By the time you've done it there's a new one, so it's best to judge the "biggest electoral college winner" on what he does instead of what he says. That's kind of hard to do since he's been all talk and no action for most of his life, but it's all we can do.

  39. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    This Comment that you posted just a little while ago, so I'm not sure how you forgot that you threatened to shoot me.

    Let's look at that comment: "I'm going to exercise my 1st and 2nd Amendment rights. Don't like it? Fuck off."

    Where exactly in THIS COMMENT did I threaten to shoot you? Note that the word "shoot" doesn't appear in the comment.

    You have deep psychological problems.

    I'm not the one that needs help.

  40. Re:NOT NEWS! by Hylandr · · Score: 1

    I think it's that new quantum time all those research dollars went into finally being put to work.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  41. Re:Stop the presses! Someone in IT fucked up! by __aaclcg7560 · · Score: 1

    There's no point trying to find out a reason for one of Trumps lies.

    I find it more fun to push the buttons of trump supporters, watch them go from aggressor ("You lie!") to victim ("You threaten to shoot me!").

  42. Re:Stop the presses! Someone in IT fucked up! by Archangel+Michael · · Score: 1

    I'll give you one example of how "marketing" doesn't equal "services". Your linked page, regarding Prenatal care, can you show me where they announce they actually provide prenatal services? The page is nothing more than a wikipedia type page on Prenatal care. I could put the same page up on a personal blog, in its entirety, and would that mean I am actually providing prenatal care? NOPE.

    Thanks for trying, but you're believing the hype and not the reality.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  43. Re:Stop the presses! Someone in IT fucked up! by dbIII · · Score: 1

    Considering how incredibly politically naive most of them are (they are certainly in for a few shocks and a feeling of betrayal) that's going to get as old as picking on Nixon apologists was.

  44. Re:Stop the presses! Someone in IT fucked up! by Archangel+Michael · · Score: 1

    Yes, they do provide birth control. I never said they didn't. You can even get condoms there, does that mean they can claim they are a male health care provider like they claim they are a "women's healthcare provider" because they perform abortions and give out birth control?

    To me, a woman's health center would be more concerned about actual health of women. Abortion is very hard on a woman's body, and there is plenty of documented studies that show this. Not that PP would ever tell you the long term risks of abortion on women.

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  45. Re:Stop the presses! Someone in IT fucked up! by michael_wojcik · · Score: 1

    And watch this get modded "Troll" since blah blah blah I'm so fucking daring.

    Sigh. The "call me a troll" prolepsis was a tired, trite cliche on Usenet in 1990.

    Eternal September remains eternal.