CertStream
Security and privacy
certificate transparency monitoring
SHOW HN2017
How HN took it
3 positive, 5 neutral or asking, 0 mixed, 2 critical, out of 10 comments about the project. Thread score +0.14.
Execution: 1 for, 1 againstDesign: 1 for, 0 againstPrivacy: 0 for, 1 againstIdea: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Nice, useful project for monitoring certificates
From 3 comments
Nice work! Congrats How are you dealing with googles 60min-ish flushes of their log?
tty7 on HNVery cool! I love the simple JSON-over-WebSockets API and would love to see more streaming APIs like this available in the wild.
wybiral on HNThis is quite neat. I'll probably look at the go-library to build something out of that. In the meanwhile, crt.sh also offers a Atom feed of issued certificates. Definitely not…
tscs37 on HN
Clean landing page design
From 1 comment
Sweet landingpage!
waibelp on HN
Objections
CT logs expose subdomain names, aiding attackers
From 2 comments
One thing I totally dislike with CT is that literally everybody can see all the subdomains that my certificate is valid for (esp. LetsEncrypt), but also for cases where your…
mschuster91 on HN> You should not expect a service which has been exposed to the open internet to be hidden. Of course not, but CT dramatically lowers the bar for attackers. That's what I mean.
mschuster91 on HN
Requests
Alerting service built on the stream
From 1 comment
> I would have to check regularly on CT logs You would indeed, which is part of the reason I released this service + libraries, so some enterprising developer can build a nice…
zer01 on HN
Questions
How the stream handles Google log flushes every hour or so
From 1 comment
Nice work! Congrats How are you dealing with googles 60min-ish flushes of their log?
tty7 on HN
Privacy risk of correlating domain ownership via timing
From 1 comment
Interesting project. I was wondering if you think they are any privacy issues around Certificate Transparency, like grouping ownership of domains through the timings.
kbody on HN
Alternatives named
crt.sh with RSS/Atom feed
From 2 comments
one could also use crt.sh and the RSS feed.
gsich on HNThis is quite neat. I'll probably look at the go-library to build something out of that. In the meanwhile, crt.sh also offers a Atom feed of issued certificates. Definitely not…
tscs37 on HN
CertSpotter
From 1 comment
> "So to be sure nobody issued a cert for one of my properties I would have to check regularly on CT logs to be sure that only certs requested by me are issued." CertSpotter does…
tonyztan on HN
ctadvisor
From 1 comment
>so some enterprising developer can build a nice alerting service I launched https://ctadvisor.lolware.net/ some time ago.
technion on HN