Timeline for Let’s Encrypt chain of trust changes will affect a small number of users on Stack Exchange
Current License: CC BY-SA 4.0
26 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 7 at 11:17 | comment | added | user1502910 | @ShadowWizard All that said, I may have inadvertently implied that this isn’t a lot of people or that they’re not important, but that’s not Slate’s point. Just that it isn’t a large enough sample size to really learn anything from in terms of changes to overall site usage, never mind the motivation behind any such change. | |
| Sep 7 at 11:14 | comment | added | user1502910 | @ShadowWizard And even if someone does go out today and buy a brand new phone with Android 7 factory installed, doesn’t mean they aren’t upgrading, installing secure browsers that aren’t affected, or both. | |
| Sep 7 at 11:13 | comment | added | user1502910 | @ShadowWizard I don’t think that page was showing 603 phone currently being sold with Android 7, and I don’t think they’re all new phones, either. Clicking through, most barely support 4G, and I couldn’t find one that supports 5G, though I didn’t look at more than a dozen. And even if some are new phones companies are trying to sell, doesn’t mean people are buying. On Amazon most phones are coming with 13/14 installed. I found one with 7, it was a several-years old senior phone with gigantic number keys and was missing the typical “n sold in the past month” banner. | |
| Sep 7 at 8:17 | comment | added | Shadow Wizard | @testing-for-ya I don't expect SE to do anything, just trying to make a point that even though 0.07% looks minor, it still means lots of people, and since new devices still being sold with Android 7, it won't go away any time soon. (And also making "accessing the site from old Android devices" not very accurate.) | |
| Sep 6 at 20:21 | comment | added | President James K. Polk | @EndAntisemiticHate: You are correct, they will be less likely to use SE, but they will be fine if they start using Firefox Mobile as recommended in the Let's Encrypt article. And since many websites use certificates from Let's Encrypt, they'll almost be forced to install Firefox Mobile anyway, at which point they access SE sites without a problem. | |
| Sep 6 at 14:27 | comment | added | user1502910 | @ShadowWizard Maybe so. I still don't know what people here are expecting SE to do about that. | |
| Sep 6 at 14:25 | comment | added | Shadow Wizard | @testing-for-ya but looks like hundreds of new smartphones are still being sold with Android 7, so even if people will decide to "upgrade" old device they lost or drowned, they might get a new device with ancient OS. | |
| Sep 6 at 14:12 | comment | added | Amazon Dies In Darkness | @Slate Thanks. That's what I was wondering. | |
| Sep 6 at 14:11 | comment | added | Amazon Dies In Darkness | @MadScientist Yes, it's not an SE-specific issue. It's good that SE wrote this helpful post to document what's going on & why. Although many are concerned about security, it's amazing how many sites still don't support SSL or TLS: faqs.org, tcpipguide.com, testmyipv6.com, wordsafety.com, devtoolschallenger.com, terrafly.com, packages.linuxmint.com, markdown2pdf.com, mailcatch.com, en.dnstools.ch, online-domain-tools.com, dyndns.com, blackle.org, moreofit.com, cssdrive.com, wtfpl.net, stahlworks.com, isstracker.com, toyotaproblems.com, xpather.com, developerexcuses.com, and the list goes on... | |
| Sep 6 at 14:10 | comment | added | Slate StaffMod | @EndAntisemiticHate If I'm understanding your question correctly, I don't think we're going to be tracking that. Since it represents a small segment of users, and it's not really something we can fix, not too much point putting work into measuring this change in a detailed manner. It's also such a small segment of users that it's probably too noisy to meaningfully determine change. | |
| Sep 6 at 13:52 | comment | added | Amazon Dies In Darkness | @testing-for-ya Sorry, yes, 0.07%. Unfortunately, edits are only allowed for 5 minutes for comments. I'm just wondering if the traffic delta will be tracked. Nothing more. | |
| Sep 6 at 11:41 | comment | added | Mad Scientist | @EndAntisemiticHate These kinds of changes affect large parts of the entire internet. There are already some other TLS-related reasons why many old devices can't connect to a large number of modern websites. And some of these changes are necessary to improve security. This is not something SE can fix, but as mentioned in the Let's Encrypt blog post newer Android versions can update root certificates independently, which minimizes this problem. | |
| Sep 6 at 10:36 | comment | added | user1502910 | @EndAntisemiticHate It’s 0.07, not 0.7. But anyway, my point was not that they can’t continue monitoring the traffic; they obviously can. But just like all the recent hoopla about ChatGPT, if the traffic changes, you still can’t know why. It is just as likely they’ve “left” for the reasons I suggested as for the big scary banner they’re probably seeing in a lot of other places, too. In any case, let’s say they do observe a dip in traffic for these users on ancient devices. Let’s say the traffic dips to 0.05% or 0.02%, and that you “know” why. What then? What would you want SE to do about it? | |
| Sep 6 at 5:49 | comment | added | Amazon Dies In Darkness | @testing-for-ya I haven't spent much time thinking about the mechanism(s) to track it, but here's a little brainstorming: Right now about 0.7% of traffic comes from such users. So we know those connections can be measured. It may be as simple as measuring the traffic from such users every week/month in the future. Or it may involve monitoring the number of HTTP connections. Or it may be possible to monitor the number of HTTPS connections with non-validated TLS certificates. Or perhaps a combination of those techniques with other techniques. | |
| Sep 6 at 4:22 | comment | added | user1502910 | @EndAntisemiticHate Well, I don’t know how (and maybe I don’t want to think about how) they could possibly track people who stop coming for that reason. However those people you’re concerned about are going to face this issue across a lot of the Internet, not just here. I suspect many sites won’t provide this type of heads-up. | |
| Sep 6 at 3:03 | comment | added | Amazon Dies In Darkness | An unfortunate consequence of this is that people who can't afford new devices (or who do not want to contribute to eWaste) will now be less likely to use Stack Exchange sites. People who cannot afford expensive universities are the exact people that likely benefit from Stack Exchange the most. It will be interesting to see if people choose to stop using Stack Exchange or if they choose to ignore the important security warnings. Will Stack Exchange be tracking that data? | |
| Sep 6 at 2:27 | history | edited | SlateStaffMod | CC BY-SA 4.0 |
deleted 8 characters in body
|
| Sep 6 at 2:18 | comment | added | Journeyman Geek | I suspect it's the exact same situation. Also there's going to be invariably a few folks deeply invested in not upgrading for all sorts of reasons 😅 | |
| Sep 6 at 2:04 | comment | added | Meta Andrew T. | Maybe related (as some history): Invalid certificate on all SE sites. Also, maybe related on Android.SE: Let's Encrypt: Is there a workaround for the 2021 SSL "cutoff" for pre-7.1.1 Android devices? | |
| Sep 5 at 20:24 | comment | added | user1502910 | @Shadow Well I also took “will be affected” as predicting the future. As in, “in the past, we’ve observed 0.07% of our traffic is using this old browser/OS combo, but we can only estimate that that will continue.” In fact I would expect it to gradually decline (and not have been a constant 0.07% across all of time, either) as people finally get their wits about them and upgrade, lose or drown their phones and replace them, etc. So I guess it all depends on what you’re estimating, unless you’re also time traveling. | |
| Sep 5 at 20:16 | comment | added | Slate StaffMod | @ShadowWizard I don't tend to say a number is exact unless I am very sure it is verifiably exact. There are sources of error in virtually all measurements regarding web traffic. But for clarity's sake, I expect that 0.07% estimate to be very precise. | |
| Sep 5 at 20:05 | comment | added | Shadow Wizard | Why do you need to estimate? Browsers also send OS info, and you're using Google Analytics so the percentage should be known. | |
| Sep 5 at 18:16 | history | edited | bad_coder | CC BY-SA 4.0 |
Refined wording, added link to concept.
|
| Sep 5 at 17:58 | history | edited | V2Blast | CC BY-SA 4.0 |
bolded summary
|
| Sep 5 at 17:48 | comment | added | Machavity | Security Certificates: forcing the Internet to upgrade since 1995 (when SSL2 died a fiery death) | |
| Sep 5 at 17:39 | history | asked | SlateStaffMod | CC BY-SA 4.0 |